System and method for using web bluetooth api for mobile access control

Abstract

Disclosed herein are systems and methods for using a web / Bluetooth API for mobile access control. In one embodiment, a computing system receives an endpoint identifier associated with a visitor. The system generates a URL associated with the endpoint identifier and transmits the URL to an endpoint associated with the endpoint identifier. The system receives a request for a web / Bluetooth Low Energy (BLE) web page corresponding to the URL from a mobile device associated with the visitor. The system generates the requested web page and transmits the web page to the mobile device. The web page includes valid credentials for accessing a secured resource and executable code for invoking at least one function of the web / BLE API. The system transmits the web page to the mobile device, then receives the credentials from the mobile device via BLE communication, verifies the credentials, and grants access to the secured resource in response to the verification.

Description

[Technical Field]

[0001] Among other technical fields, embodiments of the present disclosure relate to access control systems (including physical, electronic, logical, etc. access control systems), web design, wireless communications (e.g., Bluetooth), application programming interfaces (APIs), and more particularly to systems and methods for using web Bluetooth APIs for mobile access control. [Background technology]

[0002] In today's world, security is an ever-increasing concern. This concern extends to security related to protecting physical spaces such as homes, offices, laboratories, technical facilities, hospitals, among other areas of life. In a typical configuration, using a particular floor of an office building as an exemplary physical space, that floor (and / or the general office building, a particular room therein, an elevator bank, etc.) may be protected by what is known in the art as a physical access control system (PACS) or an electronic access control system (EACS), among other possible systems.

[0003] In an exemplary situation, one or more elevators to a particular floor may lead to a small lobby with a secure door that, when closed and locked, prevents physical access to the remainder of the floor. The door's locking mechanism may be controlled by a device known as a reader. The reader may be operable to respond to one or more types of wireless communications (e.g., Bluetooth or Bluetooth Low Energy (BLE)) from one or more devices, such as radio frequency (RF) tags, fobs, key cards, mobile devices, and / or the like. In some cases, the reader may have a keypad that can be used to key in valid credentials (e.g., a correct passcode). Generally, upon receiving valid credentials from a given device (or its own keypad in some cases), the reader may unlock the door, allowing access to the remainder of the floor. In typical cases, the door may then automatically close and lock on its own.

[0004] A given valid credential may take several different forms and may include one or more encrypted and / or unencrypted data values. More generally, it should be noted that in this disclosure, the term "credential" is used broadly to encompass any set of one or more (encrypted and / or unencrypted) values ​​provided for accessing or activating a given resource, such as a physical space like the office building floor example above, an electronic resource (e.g., a given computing terminal, a given network server, a given online account (e.g., a bank account), etc.), and / or one or more other protected resources. [Brief explanation of the drawings]

[0005] [Figure 1] FIG. 1 illustrates an exemplary security configuration in which at least one embodiment may be implemented. [Figure 2] FIG. 1 illustrates an exemplary method according to at least one embodiment. [Figure 3] FIG. 1 is an exemplary information flow diagram according to at least one embodiment. [Figure 4] FIG. 1 illustrates an exemplary user interface of an exemplary registration portal, according to at least one embodiment. [Figure 5A] FIG. 1 illustrates a screenshot of a first exemplary mobile device, according to at least one embodiment. [Figure 5B] FIG. 10 illustrates a second exemplary mobile device screenshot according to at least one embodiment. [Figure 5C] FIG. 10 illustrates a screenshot of a third exemplary mobile device, according to at least one embodiment. [Figure 5D] FIG. 10 illustrates a screenshot of a fourth exemplary mobile device, according to at least one embodiment. [Figure 5E] FIG. 10 illustrates a fifth exemplary mobile device screenshot, according to at least one embodiment. [Figure 6] FIG. 1 illustrates an example computer system that may be configured to perform at least one embodiment and / or embody one or more devices, systems, etc. in accordance with at least one embodiment. [Figure 7] FIG. 7 illustrates an example software architecture that may be implemented on a computer system, such as the example computer system of FIG. 6, according to at least one embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0006] A more detailed understanding may be had from the following description, given by way of example in conjunction with the above-mentioned drawings, in which like reference numerals are used to refer to like elements throughout.

[0007] With current implementations of access control systems utilizing BLE communication between a given mobile device and a given reader, a user must install (or have already installed) a specific app on their mobile device and then use the app to request access to a specific secured resource. Assuming such a request is approved, the app may receive valid credentials from a given server or generate valid credentials when the user enters a given invitation code or the like into the app's user interface. However, even if the app obtains valid credentials, it may then utilize the mobile device's Bluetooth interface for BLE communication to connect to a given reader and then transmit the valid credentials to the reader to achieve the desired access. Thus, even for short-term access to a given secured resource, users are inconvenienced (and often annoyed) by having to download and install a specific app on their mobile device. Many users are wary of installing unknown apps on their mobile devices for security and privacy reasons.

[0008] To address these and other shortcomings of conventional implementations, disclosed herein are embodiments of a system and method that uses a Web Bluetooth API for mobile access control. In an exemplary embodiment, an engineer at a technology company wishes to meet with an outside patent attorney at the engineer's office building, where the engineer works in a section behind a door secured by a locking mechanism and a reader, in a manner similar to the example above. In this embodiment, the engineer uses a registration portal (e.g., on his company's intranet) to register and invite the prospective visitor. The engineer enters the patent attorney's first and last name, mobile phone number, and visitor privilege expiration date (in the corresponding fields) and selects the appropriate reader from a drop-down list of readers located in the engineer's office building.

[0009] In response to the technician submitting this data through the registration portal, the portal generates a visitor-specific URL and sends the URL (e.g., via text message) to the patent attorney's mobile device. When the patent attorney arrives at the technician's office, the patent attorney taps the URL, at which point the patent attorney's mobile device sends a request to the URL and receives a corresponding web page. In at least one embodiment, this web page is generated to include executable code (e.g., JavaScript) that uses a Web Bluetooth API to instruct the mobile device to perform a specific function. The web page in this example also includes valid credentials that the visitor (i.e., the patent attorney) uses to access the reader.

[0010] The mobile device may load this web page using its browser and then begin executing the code. In some cases, the code checks whether both Bluetooth and location (i.e., location-based services) are currently enabled on the mobile device. If necessary, the visitor may be prompted to enable one or both. The web page may then use the Web Bluetooth API to display a list of nearby Bluetooth devices, including, in this example, the reader designated by the technician via the registration portal. The patent attorney may then tap to connect (e.g., pair) with the reader, and the web page may then respond in response.

[0011] The web page can then present a button to the patent attorney that, when tapped by the patent attorney, causes the web page to use a web Bluetooth API to transmit valid credentials to the reader via BLE communication. The reader can then verify the credentials (in some cases by checking against an access server that may have been provided with matching credential data by the server that generated and transmitted the web page, among other possible implementations). Upon successful credential verification, the reader can activate the locking mechanism to unlock the door and allow access to the visitor.

[0012] Embodiments of the present disclosure have several advantages over conventional implementations. These advantages include not requiring visitors to install any specific access application to successfully transmit valid credentials to a reader. Instead, embodiments of the present disclosure utilize a web browser already installed on the visitor's mobile device. Today, it is nearly impossible to find a mobile device without at least one web browser. Thus, embodiments of the present disclosure provide access control across multiple platforms and across multiple browsers. In embodiments of the present disclosure, BLE connections are typically secured using AES-128 end-to-end encryption, eliminating the security and privacy concerns that arise when installing unfamiliar apps. Furthermore, according to embodiments of the present disclosure, visitors are not prompted to key in a specific invitation code or the like to gain access to corresponding secured resources. Other advantages will be apparent to those skilled in the relevant art given the benefit of this disclosure.

[0013] One embodiment takes the form of a method performed by executing instructions on at least one hardware processor of a computing system. According to the embodiment, the computing system receives an endpoint identifier associated with a visitor. The computing system generates a uniform resource locator (URL) associated with the endpoint identifier and transmits the URL to an endpoint associated with the endpoint identifier. The computing system receives a request for a web / BLE web page corresponding to the URL from a mobile device associated with the visitor. The computing system generates the requested web / BLE web page. The web page includes valid credentials for accessing a secured resource and also includes executable code including at least one call to at least one function of a web Bluetooth API. The computing system transmits the web / BLE web page to the visitor's mobile device. The computing system then receives the credentials from the visitor's mobile device via BLE communication. The computing system then validates the credentials and, in response to the validation, grants access to the secured resource.

[0014] As described herein, one or more embodiments of the present disclosure take the form of a method including a plurality of operations. One or more other embodiments take the form of a system that includes at least one hardware processor and also includes one or more non-transitory computer-readable storage media that include instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform a plurality of operations (which, in some embodiments, correspond, in other embodiments, to operations performed in method embodiments disclosed herein and / or by system embodiments disclosed herein). Still one or more other embodiments take the form of one or more non-transitory computer-readable storage media (CRM) that include instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform a plurality of operations (which, in some embodiments, correspond, in other embodiments, to operations performed in method embodiments disclosed herein and / or by system embodiments disclosed herein).

[0015] Furthermore, several variations and permutations of the embodiments are described herein, and it is expressly noted that any variation or permutation described in this disclosure may be implemented with respect to any type of embodiment. For example, a variation or permutation primarily described in this disclosure with respect to a method embodiment may also or alternatively be implemented with respect to a system embodiment and / or a CRM embodiment. Furthermore, this flexibility and interoperability of the embodiments exists despite any slightly different language (e.g., process, method, methodology, step, operation, function, etc.) used to describe and / or characterize such embodiments and / or any one or more elements thereof.

[0016] FIG. 1 illustrates an exemplary security device 100 that may be used in connection with at least some embodiments of the present disclosure. Generally, the examples provided in this disclosure primarily involve using a mobile station (including its web browser and Bluetooth interface) to access physical resources, such as a floor of a building. However, it should be understood that this is merely for clarity of explanation and by way of example. One or more various embodiments described herein may be applied in other contexts, such as in connection with accessing (and / or activating, etc.) one or more different physical and / or electronic (e.g., computing) resources, logical resources, etc. By way of example, one or more of the various embodiments of the present disclosure may be applied to an EACS, a logical access control system (LACS), and / or the like. Different types of wireless communications may be used with appropriate APIs. Furthermore, applications other than web browsers may also be used with appropriate APIs. Additional and / or different applications may occur to those skilled in the art having the benefit of this disclosure.

[0017] 1, in the exemplary security device 100, a door 102 is disposed in a wall 104 beyond which a protected resource may reside. In this example, the protected resource is a large portion of a floor of a given building (e.g., other than an elevator lobby). The door 102 has a handle 106 disposed thereon, which includes a locking mechanism (not explicitly shown) that is controlled, in this example, by a reader 108. In the illustrated scenario, the reader 108 is disposed proximate to the door 102, and in particular, proximate to the handle 106 of the door 102. The handle 106 may have at least a locked state and an unlocked state.

[0018] In an exemplary scenario, the handle 106 is in a locked state in its default operating mode, and the reader 108 is operable to selectively place the handle 106 in an unlocked state in response to presentation of authorized credentials, for example, by a portable device according to embodiments of the present disclosure. As noted above, the reader 108 may also interface with other types of secure devices, keypad input, and / or the like. In the example shown in FIG. 1 , the portable device 110 is shown in wireless communication with the reader 108. In the illustrated embodiment, the portable device 110 is a visitor's portable device, and the illustrated wireless connection 120 utilizes BLE communication.

[0019] In some configurations, the reader 108 itself may locally determine whether to grant access. In other configurations, the reader 108 may query the access server 114 (and / or other entities, devices, systems, etc.) via the communication link 112 when making the decision to grant or deny access. As used in this disclosure, unless otherwise specified, a given communication link may include one or more wired communication links and / or one or more wireless communication links, as deemed appropriate by those skilled in the art for a given implementation and / or in a given situation. The access server 114 may include one or more devices and, by way of example, may be part of (and / or reside on) the cloud system 116. In some cases, an on-site controller may be queried by the reader 108 as part of determining whether to grant or deny access to a given resource. Other configurations are possible.

[0020] 1 also shows that cloud system 116 includes registration portal 124 and web / BLE server 118, both of which are described further below. In some embodiments, mobile device 110 may communicate with web / BLE server 118 via communication link 122. The various dashed arrows in FIG. 1 are intended to indicate that various corresponding devices can communicate with one another, but do not necessarily do so. Additionally, there may be one or more communication links not explicitly shown in FIG. 1.

[0021] 2 illustrates an example method 200 that may be performed in accordance with at least one embodiment of the present disclosure. In this description, method 200 is described as being performed by a computing system referred to in this disclosure as a visitor-management system (VMS). In various different embodiments, the VMS may include one or more of the reader 108, the access server 114, the web / BLE server 118, and the registration portal 124. A given VMS may also include one or more other devices, systems, entities, and / or the like instead of, or in addition to, one or more of those listed devices.

[0022] In the example described below, the VMS referenced includes reader 108, access server 114, web / BLE server 118, and registration portal 124. Accordingly, while various operations may be described below as being performed by one of those listed devices (or systems, etc.), it should be understood that such descriptions are also descriptions of the VMS referenced as a whole performing method 200. In other embodiments, method 200 may be performed by any one or more computing devices, systems, and / or the like suitably equipped and programmed to perform the operations described herein.

[0023] Additionally, it should be noted that method 200 is described herein with reference to example information flow diagram 300 of Figure 3, example registration portal interface 400 of Figure 4, and example mobile device screenshot 500 of Figure 5A, screenshot 510 of Figure 5B, screenshot 530 of Figure 5C, screenshot 548 of Figure 5D, and screenshot 556 of Figure 5E. Accordingly, the following description will switch between these various figures as it steps through various operations of method 200.

[0024] In operation 202, the VMS receives an endpoint identifier associated with the visitor. This is represented in the example information flow diagram 300 of Figure 3 by the registration portal 124 performing a function referred to herein as receive registration data 302, whereby the registration portal 124 receives a mobile phone number, email address, or some other endpoint identifier associated with the prospective visitor. An example manner in which this may be performed is shown using the example registration portal interface 400 of Figure 4.

[0025] 4, registration portal interface 400 includes a visitor information section 402 for receiving information about future visitors. This visitor information may include one or more endpoint identifiers, may also include one or more data that identify the visitor themselves (e.g., name), and may include data indicating when the provided credentials will expire. In particular, for the embodiment shown in FIG. 4, visitor information section 402 includes a last name field 404, a first name field 406, and in various different embodiments, may include one or more other visitor information fields.

[0026] With respect to one or more endpoint identifiers, the visitor information section 402 includes a mobile number field 408 and an email address field 410. These two fields may be used to receive the mobile phone number associated with the visitor's mobile device 110 and the email address associated with the visitor's email account, respectively. In some embodiments, only one of these fields is present. In some embodiments where both fields are present, the registration portal 124 accepts submissions that include only one of these two types of endpoint identifiers, but not the other. One or more other types of endpoint identifiers may be used in addition to or instead of the two shown in FIG. 4 .

[0027] The exemplary visitor information section 402 shown in FIG. 4 also includes a field for receiving expiration information indicating when the credentials granted to the visitor will expire. In at least one embodiment, the VMS invalidates the visitor's credentials after the respective time period has elapsed. Specifically, with respect to the visitor information section 402, both an expiration date field 412 and an expiration time field 414 are shown. This is by way of example. In some embodiments, only the expiration date field is present, and the granted credentials will expire on or after that date, depending on the particular implementation. In other embodiments, only the expiration time field is present, and in those embodiments, the granted visitor credentials are assumed to always expire on the date they were granted. Of course, numerous other similar implementations can be utilized.

[0028] The final field shown in the exemplary visitor information section 402 of FIG. 4 is reader(s) field 416. This field is an example of a more general concept in which the person "inviting" or registering a visitor may enter data indicating the specific resource or resources the visitor is authorized to access. In this example, reader(s) field 416 is a drop-down menu with checkboxes or the like for each of multiple readers in the inviter's office. In this example, although not shown, the inviter checks only one checkbox, and that checkbox corresponds to reader 108.

[0029] Once one, some, or all of the fields have been completed to the invitee's satisfaction, the invitee may click or tap the submit button 418 shown in the lower right portion of the registration portal interface 400. In response, at operation 204, the registration portal 124 may generate a URL 304 and send the URL 304 to the visitor's mobile device 110. The registration portal 124 may send the URL 304 to the mobile device 110 using a text message. In this example, it is assumed that a mobile phone number has been entered using the mobile number field 408. Additionally or alternatively, if an email address has been provided, the registration portal 124 may also or alternatively transmit the URL 304 to an email account associated with the visitor.

[0030] In some embodiments, the registration portal 124 constructs the URL 304 such that it includes a pseudo-random identifier, such as a numeric code. This identifier is referred to herein as “pseudo-random” to indicate that the identifier may be indecipherable to an observer as conveying specific information. As an example, the pseudo-random identifier may be the result of a hash function whose inputs include the visitor's mobile phone number, a specified expiration time and / or date, a numeric representation of the visitor's last name, and the like. In some cases, the identifier may simply be a randomly selected alphanumeric or numeric identifier. In either case, in some embodiments, the registration portal 124 may transmit a copy of this identifier and / or the input to the hash function to the web / BLE server 118 so that the web / BLE server 118 can maintain a record of the data that can be used to generate corresponding credentials upon later receiving web requests from the visitor's mobile device 110. Of course, other implementations may be utilized as well.

[0031] In operation 206, the registration portal 124 sends the URL 304 to the endpoint associated with the endpoint identifier received in operation 202. As described above, the endpoint and endpoint identifier can be a mobile device and mobile number, an email account and email address, and / or the like. In this example, the visitor's mobile device 110 is used as an exemplary endpoint, and the mobile number (not shown) of the mobile device 110 is used as an exemplary endpoint identifier. Further to this example, the registration portal 124 sends the URL 304 to the mobile device 110 in a text message (e.g., a short message service (SMS) message).

[0032] In an exemplary scenario, upon arriving at the office building described above, the visitor opens an SMS messaging application 502 on the mobile device 110, as shown in exemplary mobile device screenshot 500 of Figure 5A. As shown in mobile device screenshot 500, in addition to displaying the message 504 itself, the SMS messaging application 502 may display the number 506 from which the message 504 was sent.

[0033] The example message 504 includes welcome text and instructions to click on the URL 304 that appears below the text when the visitor arrives at the host facility (e.g., the invitee's office building, the particular floor where the meeting will take place, etc.). As shown by tap 508, the visitor in this example has arrived at the office building and has selected the URL 304, as indicated by URL selection 306.

[0034] The above-described URL selection 306, in at least one embodiment, results in a web request 308 being sent from the mobile device 110 to the web / BLE server 118. In at least one embodiment, the domain listed in the URL 304 corresponds to the web / BLE server 118, although various different implementations may use redirects, proxies, and / or the like.

[0035] In operation 208, the web / BLE server 118 then receives a web request 308 from the mobile device 110 for a web / BLE web page corresponding to the URL 304. As shown in FIG. 3 , the web / BLE server 118 may responsively perform registration-verification messaging 310 with the registration portal 124 to verify that the web request 308 is valid. Upon successful completion of registration-verification messaging 310, the web / BLE server 118 may then perform a process referred to herein as web / BLE web page loading 312.

[0036] In operation 210, as at least part of the web / BLE web page loading 312 described above, the web / BLE server 118 generates the requested web / BLE web page 314. In at least one embodiment, the generated web / BLE web page 314 includes valid credentials 322 for access to the secured resource, in this case the door 102 (or at least what resides behind the door). The credentials 322 may be generated by either the registration portal 124 or the web / BLE server 118, among other possibilities. The credentials 322 may include information about the visitor (e.g., first and last name), expiration information for the credentials 322, and / or one or more other values ​​deemed appropriate by those skilled in the art for a given implementation. In some examples, the credentials 322 may be or be included in what is often referred to as PACS data.

[0037] In operation 212, the web / BLE server 118 transmits the web / BLE web page 314 to the visitor's mobile device 110. Prior to receiving the web / BLE web page 314 from the web / BLE server 118, the mobile device 110 may launch a web browser 512 in response to the URL selection 306 described above. The web browser 512 is shown and described in connection with at least FIGS. 5B through 5E . The web browser 512 may be what is known in the art as a “webBLE browser,” which may sometimes be referred to as a browser that implements the “webBluetooth API,” or by other names. Some exemplary web browsers that may be used include the “Bluefy BLE Web Browser” from PNN Soft, Inc. of Kiev, Ukraine, newer versions of Google Chrome for iOS and Android, and / or one or more other browsers known to those skilled in the art.

[0038] In at least one embodiment, as described further herein, the web / BLE web page 314 further includes executable code (e.g., JavaScript) that includes at least one call to at least one function of the Web / BLE API. Two examples of what a visitor might see displayed on the mobile device 110 as a result of the JavaScript executing are shown in the exemplary mobile device screenshot 510 of FIG. 5B. These two examples are described in the next two paragraphs (note that other types of executable code can be utilized, and JavaScript is used merely as an example in this description).

[0039] In at least some embodiments, the JavaScript included in the web / BLE web page 314 includes instructions for determining whether the Bluetooth functionality of the visitor's mobile device 110 is enabled, and, if not, displaying a prompt to enable the Bluetooth functionality of the visitor's mobile device. This prompt is shown in FIG. 5B as a Bluetooth enablement dialog box 514 having a <Yes> button 516 and a <No> button 518. In the example of FIG. 5B, at tap 520, the visitor can be seen selecting the <Yes> button 516 to enable the Bluetooth functionality (i.e., the Bluetooth interface) of the mobile device 110.

[0040] Similarly, in at least some embodiments, the JavaScript included in the web / BLE web page 314 includes instructions for determining whether location functionality is enabled on the visitor's mobile device 110 and, if not, displaying a prompt to enable location functionality. This prompt is shown in FIG. 5B as a location enablement dialog box 522 having a <Yes> button 524 and a <No> button 526. In the example of FIG. 5B, at tap 528, the visitor can be seen selecting the <Yes> button 524 to enable location functionality (e.g., location services, GPS, etc.) on the mobile device 110.

[0041] As described above, the web / BLE web page 314 may include JavaScript code for at least one web BLE API function to trigger at least one action through the Bluetooth functionality of the visitor's mobile device 110. One or more such Bluetooth actions may be executed in response to receiving at least one user interface command via the web browser 512 while the web browser 512 is displaying the web / BLE web page 314 on the mobile device 110. The Bluetooth enablement dialog box 514 and the location enablement dialog box 522 described above are two examples. Further examples are described below in connection with displaying available Bluetooth devices and transmitting credentials 322 to the reader 108, among other examples.

[0042] Among other functions, the web / BLE API embedded in the web / BLE web page 314 handles communication between the web / BLE web page 314 and the reader 108 via the Bluetooth interface of the mobile device 110. As a generalized example, this communication may include operations such as identifying nearby BLE devices, connecting to BLE devices, reading and / or writing Bluetooth characteristics, detecting when a Bluetooth device has disconnected, and reading and writing Bluetooth descriptors. Another function the web / BLE API may perform is receiving Generic Attribute Profile (GATT) notifications. As known in the art, GATT is a protocol by which two BLE devices transfer data back and forth using concepts called "services" and "characteristics."

[0043] Continuing with the description of the exemplary embodiment, operation proceeds from exemplary mobile device screenshot 510 of Figure 5B to exemplary mobile device screenshot 530 of Figure 5C. Note also that if both Bluetooth and location functionality of mobile device 110 are already currently enabled, Bluetooth enable dialog box 514 and location enable dialog box 522 may not be displayed at all. In such a case, operation may proceed from mobile device screenshot 500 of Figure 5A to exemplary mobile device screenshot 530 of Figure 5C.

[0044] With respect to further Bluetooth-related functionality performed by the web / BLE APIs incorporated into the web / BLE web page 314, mobile device screenshot 530 of FIG. 5C shows a Bluetooth device list 532, which is a list of detected, available Bluetooth (e.g., BLE) devices currently in proximity to mobile device 110. Bluetooth device list 532 includes (i) an entry 534 for reader 001, corresponding to an arbitrarily named "reader 001" (not shown) and having an associated pair button 536, (ii) an entry 538 for reader 002, corresponding to an arbitrarily named "reader 002" (also not shown) and having an associated pair button 540, and (iii) an entry 542 for reader 108, corresponding to reader 108 and having an associated pair button 544. As indicated by tap 546 in FIG. 5C, the visitor in this example selects the entry 542 for the reader 108 to enable communication between the web / BLE web page 314 and the reader 108.

[0045] Note that in some embodiments, the web / BLE web page 314 instructs the Bluetooth interface of the mobile device 110 to scan for any Bluetooth devices advertising a particular specified service. Thus, for example, the reader 108 may advertise a service called "Reader_108_Service." In that case, the only entry in the Bluetooth device list 532 may be the entry 542 for the reader 108. The reader 108 may advertise a named service solely for visitors to further simplify the user experience. In some cases, the advertised service may be referenced by an identifier, such as, for example, a universally unique identifier (UUID). Other implementations may be used as well and will occur to those skilled in the art given the benefit of this disclosure.

[0046] Following the visitor's selection of the entry 542 for the reader 108 and thus the pair button 544 associated with the reader 108, the web browser 512 may then display a screen such as the exemplary mobile device screenshot 548 of FIG. 5D . A status message 550 and a send credentials button 552 can be seen displayed on this screenshot. The status message 550 in this example indicates successful pairing with the reader 108. In some embodiments, pairing involves an exchange of a challenge 318 and a response 320 between the web / BLE web page 314 and the reader 108, as shown by way of example in FIG. 3 . Further, following pairing, the visitor can be seen to activate the send credentials button 552 at tap 554, which, in at least one embodiment, causes the web / BLE web page 314 to transmit the credentials 322 (and possibly additional PACS data) to the reader 108 using BLE communications.

[0047] The above-described screens and actions taken in connection with Figures 5C and 5D correspond to the access request reception 316 shown in Figure 3. The access request reception 316 involves or includes receiving, via a user interface presented by a web browser 512 on the mobile device 110, a request from a visitor to access a secured resource protected by the reader 108 and an associated locking mechanism on the door 102. In some embodiments, the aspects shown in and described in connection with the mobile device screenshot 530 of Figure 5C are automated and occur "behind the scenes" from the visitor's perspective. In one example, pairing with the reader 108 can be performed automatically based on proximity to the reader 108 (e.g., as inferred from its signal strength). Transmission of the credentials 322 to the reader 108 can also be performed programmatically in response to proximity, location, and / or one or more other trigger conditions.

[0048] In operation 214, the reader 108 receives credentials 322 from the mobile device 110 via BLE communication directed by a web / BLE web page 314 using an embedded web / BLE API. The reader 108 may then respond to the web / BLE web page 314 with a communication status 324, as shown in FIG. 3. As described above, the reader 108 may then exchange validation messaging with a device, such as the access server 114, to validate the credentials 322. In some embodiments, the credentials 322 are encrypted using one or more encryption keys.

[0049] In operation 216, the VMS verifies the credentials and, in response to the verification, grants access to the secured resource, in this case, entry through door 102. This is represented in FIG. 3 as access grant 326. As shown in mobile device screenshot 556 of FIG. 5E, a status message 558 may be displayed by web browser 512. The exemplary status message 558 shown in FIG. 5E reads, "Access Granted!"

[0050] Additionally, the reader 108 may store a copy of a master key that may be specific to the door 102 (i.e., to the reader 108) or may be generally associated with multiple readers. The reader 108 may maintain a copy of the master key stored in what is known in the art as a secure element, which the reader 108 may use to store sensitive data, perform specific encryption methods (e.g., operations), and / or the like. In an exemplary embodiment, the credential 322 may be or include a diversified key derived from the above-mentioned master key stored in the reader 108. This master key may also be stored in another entity of the associated encryption system, such as, for example, a hardware security module.

[0051] The web / BLE web page 314 may send this diversified key, along with what is known as a diversification value (or “diversifier”), to the reader 108. The reader 108 may then dynamically use its copy of the master key and the diversification value received from the web / BLE web page 314 to calculate its own diversified key (using an appropriate key derivation function (KDF) known to those skilled in the art), and the reader 108 may then compare this diversified key with the diversified key it received from the web / BLE web page 314. If there is a match, access may be granted. If there is no match, the reader 108 may simply do nothing, issue a follow-up message to the web / BLE web page 314 to give the web / BLE web page 314 further opportunities, or issue some other response (or no response) deemed appropriate by those skilled in the art for the given implementation. In some scenarios, the reader 108 may maintain a stored table of diversification values ​​associated with corresponding diversified keys, although this is considered less secure than the above-described "on-the-fly" calculation of diversified keys by the reader 108.

[0052] 6 illustrates an exemplary computer system 600 that may be utilized to implement and / or perform at least one embodiment, within which instructions 612 (e.g., software, programs, applications, applets, apps, and / or other executable code) may be executed to cause the computer system 600 to perform any one or more of the methods described herein. For example, execution of the instructions 612 may cause the computer system 600 to perform any one or more of the methods described herein. The instructions 612 transform a general, unprogrammed computer system 600 into a specific computer system 600 that is programmed to perform the functions described and illustrated in the manner described. The computer system 600 may operate as a standalone device or may be coupled (e.g., networked) to other machines. In a networked deployment, the computer system 600 may operate as a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment.

[0053] Computer system 600 may be or include, without limitation, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a personal digital assistant (PDA), an entertainment media system, a cellular telephone, a smartphone, a mobile device, a wearable device (e.g., a smart watch), a smart home device (e.g., a smart appliance), other smart devices, a web appliance, a network router, a network switch, a network bridge, and / or other machine capable of sequentially or otherwise executing instructions 612 that specify operations performed by computer system 600. Additionally, while only a single computer system 600 is illustrated, the term "machine" shall be taken to include a collection of machines that individually or jointly execute instructions 612 to perform one or more of the methodologies described herein.

[0054] Computer system 600 may include a processor 602, memory 604, and I / O components 606, which may be configured to communicate with each other via a bus 644. In an exemplary embodiment, processor 602 (e.g., a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), another processor, and / or any suitable combination thereof) may include, for example, processor 608 and processor 610 that execute instructions 612. The term "processor" is intended to include a multi-core processor that may include two or more independent processors (sometimes referred to as "cores") that may execute instructions simultaneously. While multiple processors 602 are shown in FIG. 6, computer system 600 may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

[0055] Memory 604 includes main memory 614, static memory 616, and storage unit 618, each of which is accessible to processor 602 via bus 644. Memory 604, static memory 616, and / or storage unit 618 may store executable instructions 612 for performing one or more of the methods or functions described herein. Instructions 612 may additionally or alternatively reside, completely or partially, within main memory 614, static memory 616, machine-readable medium 620 in storage unit 618, within at least one of processors 602 (e.g., within a cache memory of a given one of processors 602), and / or any suitable combination thereof while being executed by computer system 600. Machine-readable medium 620 is one or more non-transitory computer-readable storage media.

[0056] I / O components 606 may include a wide variety of components for receiving input, generating and / or providing output, transmitting information, exchanging information, capturing measurements, etc. The particular I / O components 606 included in a particular instance of computer system 600 will vary depending on the type of machine. For example, a portable machine such as a mobile phone may include a touch input device or other such input mechanism, while a headless server machine may not include such a touch input device. It will be understood that I / O components 606 may include many other components not shown in FIG. 6 .

[0057] In various exemplary embodiments, I / O components 606 may include output components 632 and input components 630. Output components 632 may include visual components (e.g., displays such as plasma display panels (PDPs), light-emitting diode (LED) displays, liquid crystal displays (LCDs), projectors, and / or cathode ray tubes (CRTs)), acoustic components (e.g., speakers), haptic components (e.g., vibration motors, resistance mechanisms), other signal generators, etc. Input component 630 may include an alphanumeric input component (e.g., a keyboard, a touchscreen configured to receive alphanumeric input, an optical keyboard, and / or other alphanumeric input component), a point-based input component (e.g., a mouse, a touchpad, a trackball, a joystick, a motion sensor, and / or one or more other pointing devices), a tactile input component (e.g., a physical button, a touchscreen that responds to the position and / or force of a touch or touch gesture, and / or one or more other tactile input components), an audio input component (e.g., a microphone), and / or the like.

[0058] In further exemplary embodiments, I / O component 606 may include a biometric component 634, a motion component 636, an environmental component 638, and / or a position component 640, among a wide range of other components. Biometric component 634 may include components for detecting facial expressions (e.g., hand expressions, facial expressions, vocal expressions, body gestures, eye tracking, etc.), measuring biometric signals (e.g., blood pressure, heart rate, body temperature, sweat, brain waves, etc.), and identifying people (e.g., via voice identification, retinal identification, facial identification, fingerprint identification, and / or brainwave-based identification). Motion component 636 may include an acceleration sensing component (e.g., an accelerometer), a gravity sensing component, a rotation sensing component (e.g., a gyroscope), etc.

[0059] The environmental components 638 may include, for example, a light sensing component (e.g., a light meter), a temperature sensing component (e.g., one or more thermometers), a humidity sensing component, a pressure sensing component (e.g., a barometer), an acoustic sensing component (e.g., one or more microphones), a proximity sensing component (e.g., an infrared sensor that detects nearby objects), a gas sensing component (e.g., a gas detection sensor for detecting concentrations of harmful gases for safety purposes and / or for measuring pollutants in the air), and / or other components that may provide indications, measurements, signals, etc. corresponding to the surrounding physical environment. The location component 640 may include a location sensing component (e.g., a global positioning system (GPS) receiver), an altitude sensing component (e.g., an altimeter and / or a barometer that detects air pressure from which altitude can be derived), an orientation sensing component (e.g., a magnetometer), and / or the like.

[0060] Communications may be implemented using a wide variety of technologies. I / O component 606 may further include a communications component 642 operable to communicatively couple computer system 600 to network 622 and / or device 624 via coupling 626 and / or coupling 628, respectively. For example, communications component 642 may include a network interface component or another suitable device for interfacing with network 622. In further examples, communications component 642 may include a wired communications component, a wireless communications component, a cellular communications component, a near-field communications (NFC) component, a Bluetooth (e.g., Bluetooth low energy) component, a Wi-Fi component, and / or other communications component for communicating via one or more other modalities. Device 624 may include one or more other machines and / or any of a wide variety of peripherals (e.g., peripherals coupled via a universal serial bus (USB) connection).

[0061] Further, the communications component 642 may detect an identifier or may include a component operable to detect an identifier. For example, the communications component 642 may include a radio frequency identification (RFID) tag reader component, an NFC smart tag detection component, an optical reader component (e.g., an optical sensor for detecting one-dimensional barcodes such as Universal Product Code (UPC) barcodes, multidimensional barcodes such as Quick Response (QR) codes, Aztec Code, Data Matrix, Data Glyph, MaxiCode, PDF417, UltraCode, UCC RSS-2D barcodes, and / or other optical codes), and / or an acoustic sensing component (e.g., a microphone for identifying tagged audio signals). Additionally, various information may be derived by the communications component 642, such as location information via Internet Protocol (IP) geolocation, location information via Wi-Fi signal triangulation, location information via detection of NFC beacon signals that may indicate a particular location, and / or the like.

[0062] One or more of the various memories (e.g., memory 604, main memory 614, static memory 616, and / or one or more (e.g., cache) memories of processors 602) and / or storage unit 618 may store one or more sets of instructions (e.g., software) and / or data structures that embody or are used by one or more of the methods or functions described herein. These instructions (e.g., instructions 612), when executed by one or more of processors 602, cause various operations to implement various embodiments of the present disclosure.

[0063] The instructions 612 may be transmitted or received over the network 622 using any one of several well-known transfer protocols (e.g., Session Initiation Protocol (SIP), Hypertext Transfer Protocol (HTTP), and / or the like) via a network interface device (e.g., a network interface component included in the communications component 642) using a transmission medium. Similarly, the instructions 612 may be transmitted or received via a coupling 628 (e.g., a peer-to-peer coupling) to the device 624 using a transmission medium.

[0064] FIG. 7 illustrates an example software architecture 702 that may execute on the example computer system 600 of FIG. 6 , according to at least one embodiment. The illustrated example software architecture 702 may be installed on one or more of the devices described herein. For example, the software architecture 702 may be installed on any device or system configured similarly to the computer system 600 of FIG. 6 . The software architecture 702 is supported by hardware, such as a machine 704 that includes a processor 706, memory 708, and I / O components 710. In this example, the software architecture 702 may be conceptualized as a stack of layers, with each layer providing specific functionality. The software architecture 702 includes layers such as an operating system 712, libraries 714, frameworks 716, and applications 718. In operation, the applications 718 use one or more application programming interfaces (APIs) to invoke API calls 720 through the software stack and receive messages 722 in response to the API calls 720.

[0065] Operating system 712 manages hardware resources and provides common services. Operating system 712 includes, for example, a kernel 724, services 726, and drivers 728. Kernel 724 serves as an abstraction layer between the hardware layer and other software layers. For example, kernel 724 may provide memory management, processor management (e.g., scheduling), component management, networking, and / or security configuration, among other functions in some cases. Services 726 may provide other common services for other software layers. Drivers 728 are responsible for controlling or interfacing with underlying hardware. For example, drivers 728 may include a display driver, a camera driver, a Bluetooth or Bluetooth Low Energy driver, a flash memory driver, a serial communications driver (e.g., a USB driver), a Wi-Fi driver, an audio driver, a power management driver, and / or the like.

[0066] Libraries 714 provide low-level common infrastructure used by applications 718. Libraries 714 may include system libraries 730 (e.g., standard C libraries) that provide functions such as memory allocation functions, string manipulation functions, mathematical functions, etc. Additionally, libraries 714 may include API libraries 732 such as a media library (e.g., a library for supporting the presentation and / or manipulation of various media formats such as Moving Picture Experts Group-4 (MPEG4), Advanced Video Coding (H.264 or AVC), Moving Picture Experts Group Layer-3 (MP3), Advanced Audio Coding (AAC), Adaptive Multi-Rate (AMR) audio codec, Joint Photographic Experts Group (JPEG or JPG), Portable Network Graphics (PNG), etc.), a graphics library (e.g., an OpenGL framework used for rendering graphical content on a display in two dimensions (2D) and three dimensions (3D)), a database library (e.g., SQLite for providing various relational database functions), and a web library (e.g., WebKit for providing web browsing functions). The library 714 may also include a wide variety of other libraries 734 to provide many other APIs to the application 718 .

[0067] Framework 716 may provide a high-level common infrastructure used by applications 718. For example, framework 716 may provide various graphical user interface (GUI) functionality, high-level resource management, high-level location services, etc. Framework 716 may provide a wide range of other APIs that may be used by applications 718, some of which may be specific to a particular operating system or platform.

[0068] By way of purely representative example, applications 718 may include a home application 736, a contacts application 738, a browser application 740, a book reader application 742, a location application 744, a media application 746, a messaging application 748, a games application 750, and / or a wide assortment of other applications generally represented in Figure 7 as third party applications 752. Applications 718 are programs that perform program-defined functions. Various programming languages ​​structured in various ways, such as object-oriented programming languages ​​(e.g., Objective-C, Java, C++, etc.), procedural programming languages ​​(e.g., C, assembly language, etc.), and / or the like, may be employed to create one or more applications 718. In a particular example, third-party application 752 (e.g., an application developed using the ANDROID® or IOS® Software Development Kit (SDK) by an entity other than the vendor of a particular platform) may be mobile software running on a mobile operating system such as IOS®, ANDROID®, WINDOWS® Phone, and / or the like. In this example, third-party application 752 can invoke API calls 720 provided by operating system 712 to enable the functionality described herein.

[0069] In view of the above disclosure, a list of various example embodiments is set forth below. It should be noted that one or more features of the examples, either alone or in combination, may be considered to be within the disclosure of the present application.

[0070] Example 1 is a method performed by a computing system executing instructions on at least one hardware processor, the method including: receiving an endpoint identifier associated with a visitor, generating a URL associated with the endpoint identifier, sending the URL to an endpoint associated with the endpoint identifier, receiving a request for a Web / BLE web page corresponding to the URL from a mobile device associated with the visitor, generating the requested Web / BLE web page, the Web / BLE web page including valid credentials for access to a secured resource, the Web / BLE web page further including executable code including at least one call to at least one function of a Web / BLE API, sending the Web / BLE web page to the visitor's mobile device, receiving the credentials from the visitor's mobile device via BLE communication, and validating the credentials and granting access to the secured resource in response to the validation.

[0071] Example 2 is the method of example 1, in which generating a URL associated with the endpoint identifier includes, at the computing system, including in the URL a pseudo-random identifier uniquely associated with the endpoint identifier associated with the user.

[0072] Example 3 is the method of example 1 or example 2, wherein the endpoint identifier includes a mobile phone number associated with the visitor's mobile device, and wherein sending the URL to the endpoint associated with the endpoint identifier includes sending the URL to the visitor's mobile device.

[0073] Example 4 is the method of example 3, wherein sending the URL to the visitor's mobile device includes sending the URL to the visitor's mobile device in a text message. Example 5 is the method of any of Examples 1-4, wherein the endpoint identifier includes an email address associated with the visitor's email account, and wherein sending the URL to the endpoint associated with the endpoint identifier includes sending the URL in an email message to the visitor's email account.

[0074] Example 6 is the method of any of Examples 1-5, wherein the web / BLE web page further includes executable code for determining whether the Bluetooth functionality of the visitor's mobile device is enabled, and, if not, displaying a prompt to enable the Bluetooth functionality of the visitor's mobile device.

[0075] Example 7 is the method of any of Examples 1-6, wherein the web / BLE web page further includes executable code for determining whether location functionality is enabled on the visitor's mobile device, and, if not, displaying a prompt to enable location functionality on the visitor's mobile device.

[0076] Example 8 is the method of any of Examples 1-7, wherein the at least one function of the Web / BLE API includes instructions for triggering at least one action by a Bluetooth function of the visitor's mobile device in response to receiving at least one user interface command via a web browser displaying a Web / BLE web page on the mobile device.

[0077] Example 9 is the method of any of Examples 1-8, further comprising receiving information about the visitor, wherein the credentials include the received information about the visitor. Example 10 is the method of any of Examples 1-9, further including receiving revocation information indicating when the credentials will expire, and invalidating the credentials after a period based on the revocation information.

[0078] Example 11 is a computing system including at least one hardware processor and one or more non-transitory computer-readable storage media including instructions that, when executed by the at least one hardware processor, cause the computing system to perform operations including receiving an endpoint identifier associated with a visitor; generating a URL associated with the endpoint identifier; sending the URL to an endpoint associated with the endpoint identifier; receiving a request for a web / BLE web page corresponding to the URL from a mobile device associated with the visitor; generating the requested web / BLE web page, the web / BLE web page including valid credentials for access to a secured resource, the web / BLE web page further including executable code including at least one call to at least one function of a Web / BLE API; sending the web / BLE web page to the visitor's mobile device; receiving the credentials from the visitor's mobile device via BLE communications; and validating the credentials and granting access to the secured resource in response to the verification.

[0079] Example 12 is the computing system of example 11, wherein generating the URL associated with the endpoint identifier includes including in the URL a pseudo-random identifier uniquely associated with the endpoint identifier associated with the user at the computing system.

[0080] Example 13 is the computing system of example 11 or example 12, wherein the endpoint identifier includes a mobile phone number associated with the visitor's mobile device, and wherein sending the URL to the endpoint associated with the endpoint identifier includes sending the URL to the visitor's mobile device.

[0081] Example 14 is the computing system of example 13, in which sending the URL to the visitor's mobile device includes sending the URL to the visitor's mobile device in a text message.

[0082] Example 15 is the computing system of any of Examples 11-14, wherein the endpoint identifier includes an email address associated with the visitor's email account, and wherein sending the URL to the endpoint associated with the endpoint identifier includes sending the URL in an email message to the visitor's email account.

[0083] Example 16 is the computing system of any of Examples 11-15, wherein the web / BLE web page further includes executable code for determining whether the Bluetooth functionality of the visitor's mobile device is enabled, and, if not, displaying a prompt to enable the Bluetooth functionality of the visitor's mobile device.

[0084] Example 17 is the computing system of any of Examples 11-16, wherein the web / BLE web page further includes executable code for determining whether location functionality of the visitor's mobile device is enabled, and, if not, displaying a prompt to enable location functionality of the visitor's mobile device.

[0085] Example 18 is the computing system of any of Examples 11-17, wherein the at least one function of the web / BLE API includes instructions for triggering at least one action by a Bluetooth function of the visitor's mobile device in response to receiving at least one user interface command via a web browser that displays a web / BLE web page on the mobile device.

[0086] Example 19 is the computing system of any of Examples 11-18, wherein the operations further include receiving information about the visitor, and the credentials include the received information about the visitor.

[0087] Example 20 is the computing system of any of Examples 11-19, wherein the operations further include receiving revocation information indicating when the credentials will expire and invalidating the credentials after a period based on the revocation information.

[0088] Example 21 is one or more non-transitory computer-readable storage media including instructions that, when executed by at least one hardware processor, cause a computing system to perform operations including receiving an endpoint identifier associated with a visitor; generating a URL associated with the endpoint identifier; sending the URL to an endpoint associated with the endpoint identifier; receiving a request for a web / BLE web page corresponding to the URL from a mobile device associated with the visitor; generating the requested web / BLE web page, the web / BLE web page including valid credentials for access to a secured resource, the web / BLE web page further including executable code including at least one call to at least one function of a Web / BLE API; sending the web / BLE web page to the visitor's mobile device; receiving the credentials from the visitor's mobile device via BLE communications; and validating the credentials and granting access to the secured resource in response to the verification.

[0089] Example 22 is the one or more non-transitory computer-readable storage media of Example 21, wherein generating a URL associated with the endpoint identifier includes, at the computing system, including in the URL a pseudo-random identifier uniquely associated with the endpoint identifier associated with the user.

[0090] Example 23 is the one or more non-transitory computer-readable storage media of Example 21 or Example 22, wherein the endpoint identifier includes a mobile phone number associated with the visitor's mobile device, and wherein sending the URL to the endpoint associated with the endpoint identifier includes sending the URL to the visitor's mobile device.

[0091] Example 24 is the one or more non-transitory computer-readable storage media of Example 23, wherein sending the URL to the visitor's mobile device includes sending the URL to the visitor's mobile device in a text message.

[0092] Example 25 is the non-transitory computer-readable storage medium of any one or more of Examples 21-24, wherein the endpoint identifier includes an email address associated with a visitor's email account, and wherein sending the URL to the endpoint associated with the endpoint identifier includes sending the URL in an email message to the visitor's email account.

[0093] Example 26 is the non-transitory computer-readable storage medium of any one or more of Examples 21-25, wherein the web / BLE web page further includes executable code for determining whether Bluetooth functionality on the visitor's mobile device is enabled, and, if not, displaying a prompt to enable Bluetooth functionality on the visitor's mobile device.

[0094] Example 27 is the non-transitory computer-readable storage medium of any one or more of Examples 21-26, wherein the web / BLE web page further includes executable code for determining whether location functionality of the visitor's mobile device is enabled, and, if not, displaying a prompt to enable location functionality of the visitor's mobile device.

[0095] Example 28 is the non-transitory computer-readable storage medium of any one or more of Examples 21-27, wherein at least one function of the web / BLE API includes instructions for triggering at least one action by a Bluetooth function of the visitor's mobile device in response to receiving at least one user interface command via a web browser displaying a web / BLE web page on the mobile device.

[0096] Example 29 is the non-transitory computer-readable storage medium of any one or more of Examples 21-28, wherein the operations further include receiving information about the visitor, and the credentials include the received information about the visitor.

[0097] Example 30 is the non-transitory computer-readable storage medium of any one or more of Examples 21 to 29, wherein the operations further include receiving revocation information indicating when the credentials will expire and invalidating the credentials after a period based on the revocation information.

[0098] Additionally, in this disclosure, in one or more embodiments, examples, and / or the like, one or more components of one or more devices, systems, and / or the like may be referred to as modules that perform various functions (e.g., perform, execute, and the like). For purposes of such usage in this disclosure, a module includes both hardware and instructions. Hardware may include one or more processors, one or more microprocessors, one or more microcontrollers, one or more microchips, one or more application-specific integrated circuits (ASICs), one or more field-programmable gate arrays (FPGAs), one or more graphics processing units (GPUs), one or more tensor processing units (TPUs), and / or one or more other types of devices and / or components deemed appropriate by those skilled in the art for a given implementation.

[0099] In at least one embodiment, instructions for a given module can be executable by hardware to perform one or more functions of the module described herein and can include hardware (e.g., hardwired) instructions, firmware instructions, software instructions, and / or the like stored on one or more non-transitory computer-readable storage media as deemed appropriate by those skilled in the art for a given implementation. Each such non-transitory computer-readable storage medium can be or include memory (e.g., random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM, also known as E2PROM), flash memory, and / or one or more other types of memory) and / or one or more other types of non-transitory computer-readable storage media. A module can be implemented as a single component or distributed across multiple components. In some cases, a module can be referred to as a unit.

[0100] Furthermore, consistent with the fact that the components and configurations described herein, as well as those illustrated in connection with the drawings, are presented by way of example and not by way of limitation, any statements or other indications as to what a particular drawing "shows," or what a particular element or component in a particular drawing or referenced in this disclosure "is" or "has," and any similar statements that are not expressly self-limiting by a phrase such as "in at least one embodiment," and which, therefore, when read alone out of context, could be construed as absolute, i.e., as a limitation on all embodiments, can properly be construed only as constructively limited by that phrase. This implied limiting phrase has not been repeated multiple times in this disclosure for reasons similar to brevity and clarity of description.

Claims

1. 1. A method performed by a computing system executing instructions on at least one hardware processor, comprising: receiving an endpoint identifier associated with the visitor; generating a uniform resource locator (hereinafter referred to as a URL) associated with the endpoint identifier; sending the URL to an endpoint associated with the endpoint identifier; receiving a request for a web / Bluetooth Low Energy (BLE) web page corresponding to the URL from a mobile device associated with the visitor; generating a requested web / BLE web page, the web / BLE web page including valid credentials for accessing a secured resource, the web / BLE web page further including executable code including at least one call to at least one function of a Web / BLE application programming interface (hereinafter API); transmitting the web / BLE web page to the visitor's mobile device; receiving the credentials from the visitor's mobile device via BLE communication; validating the credentials and granting access to the secured resource in response to the validation.

2. 2. The method of claim 1, wherein generating the URL associated with the endpoint identifier comprises including in the URL, at the computing system, a pseudo-random identifier that is uniquely associated with the endpoint identifier associated with a user.

3. the endpoint identifier includes a mobile phone number associated with the visitor's mobile device; The method of claim 1 , wherein transmitting the URL to the endpoint associated with the endpoint identifier comprises transmitting the URL to the mobile device of the visitor.

4. The method of claim 3 , wherein sending the URL to the visitor's mobile device comprises sending the URL to the visitor's mobile device in a text message.

5. the endpoint identifier includes an email address associated with the visitor's email account; The method of claim 1 , wherein sending the URL to the endpoint associated with the endpoint identifier comprises sending the URL in an email message to the email account of the visitor.

6. 10. The method of claim 1, wherein the web / BLE web page further comprises executable code for determining whether a Bluetooth feature on the visitor's mobile device is enabled, and, if not, displaying a prompt to enable the Bluetooth feature on the visitor's mobile device.

7. 10. The method of claim 1, wherein the web / BLE web page further comprises executable code for determining whether location functionality on the visitor's mobile device is enabled, and, if not, displaying a prompt to enable the location functionality on the visitor's mobile device.

8. 10. The method of claim 1, wherein the at least one function of the Web / BLE API includes instructions for triggering at least one action by a Bluetooth function of the visitor's mobile device in response to receiving at least one user interface command via a web browser displaying the Web / BLE web page on the mobile device.

9. The method of claim 1 , further comprising receiving information about a visitor, wherein the credentials include the received information about the visitor.

10. receiving revocation information indicating when the credentials will expire; and revoking the credential after a period based on the revocation information.

11. 1. A computing system comprising: at least one hardware processor; and one or more non-transitory computer-readable storage media containing instructions that, when executed by at least one hardware processor, cause the computing system to: receiving an endpoint identifier associated with the visitor; generating a uniform resource locator (hereinafter referred to as a URL) associated with the endpoint identifier; sending the URL to an endpoint associated with the endpoint identifier; receiving a request for a Web / Bluetooth (hereinafter referred to as BLE) web page corresponding to the URL from a mobile device associated with the visitor; generating a requested web / BLE web page, the web / BLE web page including valid credentials for accessing a secured resource, the web / BLE web page further including executable code including at least one call to at least one function of a Web / BLE application programming interface (hereinafter API); transmitting the web / BLE web page to the visitor's mobile device; receiving the credentials from the visitor's mobile device via BLE communication; validating the credentials and granting access to the secured resource in response to the validation.

12. 12. The computing system of claim 11, wherein generating the URL associated with the endpoint identifier comprises including in the URL a pseudo-random identifier that is uniquely associated with the endpoint identifier associated with a user at the computing system.

13. the endpoint identifier includes a mobile phone number associated with the visitor's mobile device; The computing system of claim 11 , wherein transmitting the URL to the endpoint associated with the endpoint identifier comprises transmitting the URL to the mobile device of the visitor.

14. 14. The computing system of claim 13, wherein sending the URL to the visitor's mobile device comprises sending the URL to the visitor's mobile device in a text message.

15. the endpoint identifier includes an email address associated with the visitor's email account; 12. The computing system of claim 11, wherein sending the URL to the endpoint associated with the endpoint identifier comprises sending the URL in an email message to the email account of the visitor.

16. 12. The computing system of claim 11, wherein the web / BLE web page further comprises executable code for determining whether a Bluetooth feature on the visitor's mobile device is enabled, and, if not, displaying a prompt to enable the Bluetooth feature on the visitor's mobile device.

17. 12. The computing system of claim 11, wherein the web / BLE web page further comprises executable code for determining whether location functionality on the visitor's mobile device is enabled, and if not, displaying a prompt to enable the location functionality on the visitor's mobile device.

18. 12. The computing system of claim 11, wherein the at least one function of the Web / BLE API includes instructions for triggering at least one action by a Bluetooth function of the visitor's mobile device in response to receiving at least one user interface command via a web browser displaying the Web / BLE web page on the mobile device.

19. The computing system of claim 11 , wherein the actions further include receiving information about a visitor, and the credentials include the received information about the visitor.

20. The operation is receiving revocation information indicating when the credentials will expire; and invalidating the credential after a period based on the revocation information.

21. One or more non-transitory computer-readable storage media containing instructions that, when executed by at least one hardware processor of a computing system, cause the computing system to: receiving an endpoint identifier associated with the visitor; generating a uniform resource locator (hereinafter referred to as a URL) associated with the endpoint identifier; sending the URL to an endpoint associated with the endpoint identifier; receiving a request for a web / Bluetooth Low Energy (BLE) web page corresponding to the URL from a mobile device associated with the visitor; generating a requested web / BLE web page, the web / BLE web page including valid credentials for accessing a secured resource, the web / BLE web page further including executable code including at least one call to at least one function of a Web / BLE application programming interface (hereinafter API); transmitting the web / BLE web page to the visitor's mobile device; receiving the credentials from the visitor's mobile device via BLE communication; and (b) validating the credentials and granting access to the secured resource in response to the validation.

22. 22. The one or more non-transitory computer-readable storage media of claim 21, wherein generating the URL associated with the endpoint identifier comprises including, at the computing system, in the URL a pseudo-random identifier that is uniquely associated with the endpoint identifier associated with a user.

23. the endpoint identifier includes a mobile phone number associated with the visitor's mobile device; 22. The one or more non-transitory computer-readable storage media of claim 21 , wherein sending the URL to the endpoint associated with the endpoint identifier comprises sending the URL to the mobile device of the visitor.

24. 24. The one or more non-transitory computer-readable storage media of claim 23, wherein sending the URL to the visitor's mobile device comprises sending the URL in a text message to the visitor's mobile device.

25. the endpoint identifier includes an email address associated with the visitor's email account; 22. The one or more non-transitory computer-readable storage media of claim 21 , wherein sending the URL to the endpoint associated with the endpoint identifier comprises sending the URL in an email message to the email account of the visitor.

26. 22. The one or more non-transitory computer-readable storage media of claim 21, wherein the web / BLE web page further comprises executable code for determining whether a Bluetooth feature on the visitor's mobile device is enabled, and, if not, displaying a prompt to enable the Bluetooth feature on the visitor's mobile device.

27. 22. The one or more non-transitory computer-readable storage media of claim 21 , wherein the web / BLE web page further comprises executable code for determining whether location functionality of the visitor's mobile device is enabled, and, if not, displaying a prompt to enable the location functionality of the visitor's mobile device.

28. 22. The one or more non-transitory computer-readable storage media of claim 21 , wherein the at least one function of the Web / BLE API includes instructions for triggering at least one action by a Bluetooth function of the visitor's mobile device in response to receiving at least one user interface command via a web browser displaying the Web / BLE web page on the mobile device.

29. 12. The one or more non-transitory computer-readable storage media of claim 11, wherein the operations further comprise receiving information about a visitor, and the credentials include the received information about the visitor.

30. The operation is receiving revocation information indicating when the credentials will expire; and invalidating the credential after a period based on the revocation information.

Images