Wireless access protocol with physical presence verification

Abstract

Methods and systems are disclosed for securely communicating with an access control system. The methods and systems establish a communication session between a first device and a second device and transmit a credential from the first device to the second device, the credential being associated with access to a resource protected by the second device. The methods and systems determine that the first device is physically proximate to the second device and, in response to determining that the first device is physically proximate to the second device, enable access to the resource protected by the second device based on the credential.

Description

WIRELESS ACCESS PROTOCOL WITH PHYSICAL PRESENCE VERIFICATIONBACKGROUND

[0001] Access control readers are widely used in various settings to control access to restricted areas. These readers are typically connected to a server that manages access control policies and configurations. In order to securely communicate with such readers, user devices employ various encryption protocols and exchange credentials.SUMMARY

[0002] In some aspects, the techniques described herein relate to a method including: establishing a communication session between a first device and a second device; transmitting a credential from the first device to the second device, the credential being associated with access to a resource protected by the second device; determining that the first device is physically proximate to the second device; and in response to determining that the first device is physically proximate to the second device, enabling access to the resource protected by the second device based on the credential.

[0003] In some aspects, the techniques described herein relate to a method, wherein the second device includes an access control reader, and wherein the first device includes a user device.

[0004] In some aspects, the techniques described herein relate to a method, including: verifying, by the second device, that the credential is authorized to access the resource; and in response to verifying, by the second device, that the credential is authorized to access the resource, enabling the access to the resource.

[0005] In some aspects, the techniques described herein relate to a method, wherein the resource includes a physical resource, and wherein the second device includes a physical access control system (PACS) reader.

[0006] In some aspects, the techniques described herein relate to a method, wherein the resource includes a logical resource, and wherein the second device includes a logical access control system (LACS) reader.

[0007] In some aspects, the techniques described herein relate to a method, wherein determining that the first device is physically proximate to the second device includes:presenting a stimulus by the second device; and receiving input at the second device that identifies the stimulus.

[0008] In some aspects, the techniques described herein relate to a method, further including: determining that the stimulus identified by the input matches the stimulus presented by the second device; and in response to determining that the stimulus identified by the input matches the stimulus presented by the second device, determining that the first device is physically proximate to the second device.

[0009] In some aspects, the techniques described herein relate to a method, wherein the stimulus includes an audible message or a visual prompt.

[0010] In some aspects, the techniques described herein relate to a method, wherein the audible message or visual prompt includes a specified pattern, the input that identifies the stimulus including the specified pattern.

[0011] In some aspects, the techniques described herein relate to a method, including: presenting a sequence of colors on a display of the second device; and receiving the input, via a keypad of the second device, that selects buttons that match the sequence of colors.

[0012] In some aspects, the techniques described herein relate to a method, including: presenting a sequence of colors on a display of the second device; and receiving, as the input by the second device, a communication from the first device that specifies the sequence of colors.

[0013] In some aspects, the techniques described herein relate to a method, wherein determining that the first device is physically proximate to the second device includes: presenting a stimulus by the first device; and receiving input at the second device that identifies the stimulus.

[0014] In some aspects, the techniques described herein relate to a method, further including: determining that the stimulus identified by the input matches the stimulus presented by the first device; and in response to determining that the stimulus identified by the input matches the stimulus presented by the first device, determining that the first device is physically proximate to the second device.

[0015] In some aspects, the techniques described herein relate to a method, wherein determining that the first device is physically proximate to the second device includes: presenting a quick reference (QR) code by a display of the second device; and scanningthe QR code by the first device to confirm that the first device is physically proximate to the second device.

[0016] In some aspects, the techniques described herein relate to a method, wherein determining that the first device is physically proximate to the second device includes: presenting, by the first device, a random or arbitrary number; receiving, by the second device, input including the random or arbitrary number; transmitting, by the second device to the first device, a message including the input; and verifying by the first device that the input in the message matches the random or arbitrary number to determine that the first device is physically proximate to the second device.

[0017] In some aspects, the techniques described herein relate to a method, wherein the first device includes an electronic access card.

[0018] In some aspects, the techniques described herein relate to a system including: one or more processors coupled to a memory including non-transitory computer instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including: establishing a communication session between a first device and a second device; transmitting a credential from the first device to the second device, the credential being associated with access to a resource protected by the second device; determining that the first device is physically proximate to the second device; and in response to determining that the first device is physically proximate to the second device, enabling access to the resource protected by the second device based on the credential.

[0019] In some aspects, the techniques described herein relate to a system, wherein the second device includes an access control reader, and wherein the first device includes a user device.

[0020] In some aspects, the techniques described herein relate to a system, the operations including: verifying, by the second device, that the credential is authorized to access the resource; and in response to verifying, by the second device, that the credential is authorized to access the resource, enabling the access to the resource.

[0021] In some aspects, the techniques described herein relate to a non-transitory computer readable medium including non-transitory computer-readable instructions that, when executed by one or more processors, configure the one or more processors to perform operations including: establishing a communication session between a firstdevice and a second device; transmitting a credential from the first device to the second device, the credential being associated with access to a resource protected by the second device; determining that the first device is physically proximate to the second device; and in response to determining that the first device is physically proximate to the second device, enabling access to the resource protected by the second device based on the credential.BRIEF DESCRIPTION OF THE DRAWINGS

[0022] FIG. l is a block diagram of an example access control system, according to some examples.

[0023] FIG. 2 illustrates an example diagram of an access control reader, according to some examples.

[0024] FIG. 3 is a flowchart illustrating example operations of the access control system, according to some examples.

[0025] FIG. 4 is a block diagram illustrating an example software architecture, which may be used in conjunction with various hardware architectures herein described.

[0026] FIG. 5 is a block diagram illustrating components of a machine, according to some examples.DETAILED DESCRIPTION

[0027] Example methods and systems for performing access control with presence verification are described. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the examples. It will be evident, however, to one of ordinary skill in the art that examples of the disclosure may be practiced without these specific details.

[0028] In the realm of physical access control systems, a significant security threat is posed by "man-in-the-middle" or "relay" attacks. These attacks occur when an unauthorized entity intercepts or relays communication between a legitimate user's access device (such as a key card or a mobile device) and the access control system itself, such as a card reader or door controller. The attacker effectively inserts themselves into the communication process to gain unauthorized access without the need to physically possess the access credentials. This type of security breach is particularlyinsidious because it can be executed discreetly, potentially allowing unauthorized access without immediate detection.

[0029] To combat these types of attacks, one common security measure implemented in access control systems is the measurement of the time it takes to communicate between the devices involved in the authentication process. Under normal operation, the communication between a user's device and the access control system occurs within a predefined time window. This time window is calculated based on the expected transmission times under normal conditions. If a relay attack is occurring, the communication time is likely to increase beyond this expected window due to the additional distance and processing involved in relaying the signal through the attacker's device. By monitoring and verifying that the communication occurs within the expected time frame, the system can detect anomalies that may indicate a relay attack, triggering alarms or denying access as a precautionary measure. This method of "timing analysis" is important for maintaining the integrity of such access control systems and safeguarding against unauthorized entries facilitated by relay attacks.

[0030] The transmission time approach, while effective in many scenarios, encounters significant challenges with certain communication protocols such as Bluetooth Low Energy (BLE). BLE and similar protocols are designed to be highly efficient with low energy consumption and latency, which complicates the detection of relay attacks using timing analysis. These protocols often have inherently quick and variable transmission times, making it difficult to establish a consistent baseline for normal communication durations. This variability can mask the delays introduced by a relay attack, allowing unauthorized access to go undetected. Moreover, BLE and other similar technologies are increasingly used in mobile devices and smart access controls, which are susceptible to sophisticated relay attacks that can emulate the expected transmission times. Attackers can use advanced relay devices that minimize delay, effectively bypassing systems that rely solely on transmission time analysis to detect intrusions. This presents a significant security loophole, as the current technology does not offer a reliable method to verify the physical presence of a person at the reader. The lack of a robust mechanism to confirm the physical presence of an individual trying to gain access poses a fundamental challenge. Without the ability to ensure that the credential being presented is not onlyvalid but also being presented by its rightful owner in the correct location, access control systems remain vulnerable to relay attacks.

[0031] The present disclosure provides a security mechanism to protect against such attacks. Specifically, the disclosed examples provide an intelligent solution, which can prevent relay attacks by verifying physical presence of the device that includes the credential being used to gain access to a protected resource. Specifically, the disclosed techniques establish a communication session between a first device and a second device and transmit a credential from the first device to the second device, the credential being associated with access to a resource protected by the second device. The disclosed techniques determine that the first device is physically proximate to the second device and / or, in response to determining that the first device is physically proximate to the second device, enable access to the resource protected by the second device based on the credential. As referred to herein, the phrase “physically proximate” means at a distance that is close enough to enable a user of a first device to see or perceive a second device and physically interact or touch the second device. For example, physically proximate can include an arms-reach distance between devices, such as less than three feet.

[0032] In some examples, to verify proximity of the user or to verify proximity between the first and second devices, a challenge-response approach is performed in a secure manner. Specifically, a first device of the two devices can generate and / or present a challenge and make or deliver that challenge to the second of the two devices, such as over a first channel (e.g., visually and / or audibly and / or electronically). The user, via the second device, can respond to the challenge over a second channel (e.g., visually, electronically, verbally, audibly, or through some other means different from or the same as the first channel). The response can be an answer or an action represented by the challenge. The response is delivered via the second channel (or the first channel) back to the first device within a specified time interval. Once the first device verifies accuracy of the response, the first device determines that the two devices are physically proximate to each other. The actions the user takes may involve both the first and the second devices which is proof that the user is in proximity of both devices and that the first and second devices are physically proximate to each other.

[0033] In some examples, the first device includes an access card containing a credential that is associated with one or more user devices. Upon presentment of theaccess card, the access control device receives the credential and opens a communication channel with the one or more associated user devices. In some examples, the access card is presented to an access control reader that is coupled to an access controller, and the access controller opens a communication channel with the user devices associated with the received credential.

[0034] FIG. 1 is a block diagram showing an example system 100, according to various examples. The system 100 can be an access control system that includes a client device 120 (e.g., a user device, such as a smartphone or electronic card containing one or more credentials), one or more access control devices 110 that control access to a protected asset, such as through a lockable door, or to a secure resource, such as an electronic file, and a server / controller 140 that are communicatively coupled over a network 130 (e.g., LAN, WAN such as the Internet, WiFi, BLE, ultra-wideband (UWB) communication protocol, telephony network, or other wired or wireless communication protocols).

[0035] The client device 120 and the access control devices 110 can be communicatively coupled via electronic messages (e.g., packets exchanged over the Internet, BLE, UWB, WiFi Direct, Near-Field Communication (NFC), or any other protocol). While FIG. 1 illustrates a single access control device 110 and a single client device 120, it is understood that a plurality of access control devices 110 and a plurality of client devices 120 can be included in the system 100 in other examples. As used herein, the term “client device” may refer to any machine that interfaces to a communications network (such as network 130) to exchange credentials with an access control device 110, the server / controller 140, another client device 120, or any other component to obtain access to the asset or resource protected by the access control device 110. In some examples, the client device 120 can additionally or alternatively communicate directly with, e.g., an access control device or another client device 120. The client device 120 can include or store one or more credentials which can be provided to the access control device 110 for obtaining access to a protected physical or logical asset or resource.

[0036] In some cases, some or all of the components and functionality of the server / controller 140 can be included in the client device 120 and / or the access control device 110. A client device 120 may be, but is not limited to, a mobile phone, desktop computer, laptop, portable digital assistant (PDA), smart phone, a wearable device (e.g.,a smart watch), tablet, ultrabook, netbook, laptop, multi-processor system, microprocessor-based or programmable consumer electronics, physical card, or any other communication device that a user may use to access a network.

[0037] The access control device 110 can include an access reader device (also referred to as an access control reader) connected to a secure / protected resource (e.g., a door locking mechanism or backend server) that controls the secure / protected resource (e.g., door locking mechanism). The resource associated with the access control device 110 can include a door lock, an ignition system for a vehicle, or any other device that grants or denies access to a physical component or that can be operated to grant or deny access to the physical component. For example, in the case of a door lock, the access control device 110 can deny access, in which case the door lock remains locked and the door cannot be opened; or can grant access, in which case the door lock becomes unlocked to allow the door to be opened. As another example, in the case of an ignition system, the access control device 110 can deny access, in which case the vehicle ignition system remains disabled and the vehicle cannot be started; or can grant access, in which case the vehicle ignition becomes enabled to allow the vehicle to be started.

[0038] Physical access control covers a range of systems and methods to govern access, for example by people, to secure areas or secure assets. Physical access control includes identification of authorized users or devices (e.g., vehicles, drones, etc.) and actuation of a gate, door, or other facility used to secure an area, or actuation of a control mechanism, e.g., a physical or electronic / software control mechanism, permitting access to a secure asset. The access control device 110 may form part of a physical access control system (PACS), which can include a reader (e.g., an online or offline reader) that may hold authorization data (also referred to access control information) and can be capable of determining whether credentials (e.g., from credential or key devices such as radio frequency identification (RFID) chips in cards, fobs, or personal electronic devices such as mobile phones) are authorized for an actuator or control mechanism (e.g., door lock, door opener, software control mechanism, turning off an alarm, etc.), or a PACS can include a host server to which readers and actuators are connected (e.g., via a controller) in a centrally managed configuration.

[0039] In centrally managed configurations, readers can obtain credentials from credential or key devices (e.g., from one or more client devices 120) and pass thosecredentials to the PACS host server or headend system. The readers can send the credentials over a wired or wireless link. The host server then determines whether the credentials authorize access to the secure area or secure asset (or resource) and commands the actuator or other control mechanism accordingly by sending an allow / deny message back to the reader again over the wired or wireless link. While examples in physical access control are used herein, the disclosure applies similarly to logical access control system (LACS) use cases (e.g., logical access to personal electronic devices, logical access to personal online or electronic accounts or documents, etc.).

[0040] In general, the access control device 110 can include one or more of a memory, a processor, one or more antennas, a communication module, a network interface device, a user interface, a display, and a power source or supply. The memory of the access control device 110 can be used in connection with the execution of application programming or instructions by the processor of the access control device 110, and for the temporary or long-term storage of program instructions or instruction sets and / or credential or authorization data, such as credential data, credential authorization data, or access control data or instructions. For example, the memory can contain executable instructions that are used by the processor to run other components of access control device 110 and / or to make access determinations based on credential or authorization data.

[0041] The memory of the access control device 110 can comprise a transitory or non- transitory computer-readable medium that can be any medium that can contain, store, communicate, or transport data, program code, or transitory or non-transitory instructions for use by or in connection with access control device 110. The computer- readable medium can be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device. More specific examples of suitable computer-readable medium include, but are not limited to, an electrical connection having one or more wires or a tangible storage medium such as a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), Dynamic RAM (DRAM), any solid-state storage device in general, a compact disc read-only memory (CD-ROM), or other optical or magnetic storage device.Computer-readable media includes, but is not to be confused with, computer-readable storage medium, which is intended to cover all physical, non-transitory, or similar examples of computer-readable media.

[0042] The processor of the access control device 110 can correspond to one or more computer processing devices or resources. For instance, the processor can be provided as silicon, as a Field Programmable Gate Array (FPGA), an Application-Specific Integrated Circuit (ASIC), any other type of Integrated Circuit (IC) chip, a collection of IC chips, or the like. As a more specific example, the processor can be provided as a microprocessor, Central Processing Unit (CPU), or plurality of microprocessors or CPUs that are configured to execute instructions sets stored in an internal memory and / or memory of the access control device 110.

[0043] The antenna of the access control device 110 can correspond to one or multiple antennas and can be configured to provide for wireless communications between access control device 110 and a credential or key device (e.g., client device 120). The antenna can be arranged to operate using one or more wireless communication protocols and operating frequencies including, but not limited to, the IEEE 802.15.1, Bluetooth, BLE, NFC, ZigBee, Global System for Mobile communications (GSM), Code Division Multiple Access (CDMA), Wi-Fi, RF, UWB, and the like. By way of example, the antenna(s) can be RF antenna(s), and as such, may transmit / receive RF signals through free-space to be received / transferred by a credential or key device having an RF transceiver.

[0044] A communication module or communication component of the access control device 110 can be configured to communicate according to any suitable communications protocol with one or more different systems or devices either remote or local to access control device 110, such as one or more client devices 120 and / or server / controller 140. In some cases, the communication module of the access control device 110 is configured to perform the disclosed authentication protocol securely.

[0045] In some cases, the communication module uses a same wired or wireless link between the access control device 110 and the server / controller 140 for all the communication modes. In some cases, the communication module uses one wired or wireless link between the access control device 110 and the server / controller 140 to communicate access control information and uses a different wired or wireless link tocommunicate or receive configuration information updates from the server / controller 140 over the IP communication mode.

[0046] The network interface device of the access control device 110 includes hardware to facilitate communications with other devices, such as a one or more client devices 120 and / or server / controller 140 (e.g., a PACS server), over a communication network, such as network 130, utilizing any one of a number of transfer protocols (e.g., frame relay, IP, transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.). Example communication networks can include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), mobile telephone networks (e.g., cellular networks), Plain Old Telephone (POTS) networks, wireless data networks (e.g., IEEE 802.11 family of standards known as WiFi, IEEE 802.16 family of standards known as WiMax), IEEE 802.15.4 family of standards, and peer-to-peer (P2P) networks, among others. In some examples, network interface device can include an Ethernet port or other physical jack, a Wi-Fi card, a Network Interface Card (NIC), a cellular interface (e.g., antenna, filters, and associated circuitry), or the like. In some examples, network interface device can include a plurality of antennas to wirelessly communicate using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) techniques.

[0047] A user interface of the access control device 110 can include one or more input devices and / or display devices. Examples of suitable user input devices that can be included in the user interface include, without limitation, one or more buttons, a keyboard or keypad, a mouse, a touch-sensitive surface, a stylus, a camera, a microphone, etc. Examples of suitable user output devices that can be included in the user interface include, without limitation, one or more LEDs, an LCD panel, a display screen, a touchscreen, one or more lights, a speaker, and so forth. It should be appreciated that the user interface can also include a combined user input and user output device, such as a touch-sensitive display or the like.

[0048] The network 130 may include, or operate in conjunction with, an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a LAN, a wireless network, a wireless LAN (WLAN), a WAN, a wireless WAN (WWAN), a metropolitan area network (MAN), BLE, UWB, the Internet, a portion of the Internet, a portion of thePublic Switched Telephone Network (PSTN), a POTS network, a cellular telephone network, a wireless network, a Wi-Fi® network, another type of network, or a combination of two or more such networks. For example, a network or a portion of a network may include a wireless or cellular network and the coupling may be a CDMA connection, a GSM connection, or other type of cellular or wireless coupling. In this example, the coupling may implement any of a variety of types of data transfer technology, such as Single Carrier Radio Transmission Technology (IxRTT), Evolution- Data Optimized (EVDO) technology, General Packet Radio Service (GPRS) technology, Enhanced Data rates for GSM Evolution (EDGE) technology, third Generation Partnership Project (3 GPP) including 3G, fourth generation wireless (4G) networks, fifth generation wireless (5G) networks, Universal Mobile Telecommunications System (UMTS), High Speed Packet Access (HSPA), Worldwide Interoperability for Microwave Access (WiMAX), Long Term Evolution (LTE) standard, others defined by various standard setting organizations, other short range or long range protocols, or other data transfer technology.

[0049] In an example, as the client device 120 approaches the access control device 110 (e.g., comes within range of a BLE communication protocol), the client device 120 transmits credentials of the client device 120 over the network 130. In some cases, the credentials can be selected from a plurality of credentials based on a current geographical location of the client device 120. For example, multiple credentials each associated with a different geographical location can be stored on the client device 120. When the client device 120 comes within a certain distance of a geographical location associated with one of the credentials (e.g., within 10 meters), the client device 120 retrieves the associated credentials from local memory.

[0050] In one example, the client device 120 provides the credentials directly to the access control device 110. In such cases, the access control device 110 communicates the credentials with the server / controller 140. The server / controller 140 in FIG. 1 includes an authorization system 142. The server / controller 140, client device 120, and / or the access control device 110 can further include elements described with respect to FIGS. 4 and 5, such as a processor and memory, having instructions stored thereon, that when executed by the processor, causes the processor to control the functions of the server / controller 140, client device 120, and / or the access control device 110.

[0051] The server / controller 140 searches a list of credentials stored in the authorization system 142 to determine whether the received credentials match credentials from the list of authorized credentials for accessing a secure asset or resource (e.g., door or secure area) protected by the access control device 110. In response to determining that the received credentials are authorized to access the access control device 110, the server / controller 140 instructs the access control device 110 to perform an operation granting access for the client device 120 (e.g., instructing the access control device 110 to unlock a lock of a door).

[0052] In some examples, prior to granting access to the resource protected by the access control device 110, the access control device 110 and / or the server / controller 140 can perform operations to verify that the client device 120 is physically proximate to the access control device 110. This can be performed before, substantially simultaneous with, and / or after verifying that the credentials received from the client device 120 are authorized to access the asset or resource.

[0053] In some cases, the access control device 110, in response to establishing a secure communication session with the client device 120 and / or in response to receiving the credential from the client device 120, can initiate a process to detect physical proximity of the client device 120. For example, as shown in FIG. 2, the access control device 110 can include an interface 200 for presenting a stimulus (visual and / or audible) to a user and receiving input confirming or identifying the stimulus. Specifically, in an example, the access control device 110 can present a visual prompt in a display 210. The visual prompt can be presented, for example, by activating different sequences of LEDs 212 and 214 each optionally having a different color.

[0054] For example, in response to the access control device 110 receiving the credential from the client device 120, the access control device 110 can select or generate a random pattern or sequence (e.g., four digit pattern or sequence). The access control device 110 can activate the LEDs 212 and 214 according to the generated pattern or sequence. The access control device 110 can initiate a timer (e.g., 60 seconds) after the access control device 110 presents the generated pattern or sequence on the display 210. The access control device 110 can present a message on the display 210 instructing a user associated with the client device 120 to provide input via a keypad 220 corresponding to the pattern or sequence presented on the display 210. In some cases, theaccess control device 110 receives input that selects physical buttons 222 and 224 corresponding to the generated pattern or sequence that was presented by the display 210. If the input is received after the timer expires, the access control device 110 prevents access to the resource. If the input is received before the timer expires, the access control device 110 proceeds to verify whether the input matches the pattern or sequence.

[0055] In some examples, each number in the keypad 220 can represent a different color of the one or more LEDs 212 and 214. The access control device 110 can receive input that selects the corresponding buttons 222 and 224 on the keypad 220 that match the LEDs 212 and 214 that were activated. The access control device 110 can compare the input that is received based on selection of the particular buttons 222 and 224 that match the sequence to the pattern or sequence that was generated. In response to determining that the input matches the pattern or sequence, the access control device 110 can determine that the client device 120 is physically proximate to the access control device 110 and can proceed with authorizing access to the resource based on the credentials.

[0056] In some examples, the access control device 110 presents a message visually (on the display 210) and / or audibly via one or more speakers of the interface 200. The message can specify a random or arbitrary sequence of characters that are generated by the access control device 110. The access control device 110 can receive input that selects buttons 222 and / or 224 on the keypad 220 corresponding to the random or arbitrary sequence of characters provided in the message. If the correct characters are selected using the buttons 222 and / or 224 on the keypad 220, the access control device 110 can determine that the client device 120 is physically proximate to the access control device 110 and can proceed with authorizing access to the resource based on the credentials.

[0057] In some examples, the access control device 110 presents a message visually (on the display 210). The message can specify a random or arbitrary sequence of pictures each associated with a different number that are generated by the access control device 110. The access control device 110 can receive input that selects buttons 222 and / or 224 on the keypad 220 corresponding to the numbers associated with the pictures that are presented. If the correct characters are selected using the buttons 222 and / or 224 on thekeypad 220, the access control device 110 can determine that the client device 120 is physically proximate to the access control device 110 and can proceed with authorizing access to the resource based on the credentials.

[0058] In some examples, the client device 120 can present a keypad on a touchscreen of the client device 120. The client device 120 can receive input that selects buttons on the keypad of the client device 120. The client device 120 can generate an electronic communication that represents the buttons selected on the keypad of the client device 120. The client device 120 transmits the communication to the access control device 110. The access control device 110 can then retrieve the pattern or sequence from the communication and verify whether the pattern or sequence included in the communication matches the randomly or arbitrarily selected pattern or sequence that was presented on the display 210 and / or speakers of the access control device 110. If the patterns match, the access control device 110 can determine that the client device 120 is physically proximate to the access control device 110 and can proceed with authorizing access to the resource based on the credentials.

[0059] For example, the access control device 110 can present some output pattern / sequence (e.g., a challenge) (e.g., over a first channel, such as visually) to the user and initiates a timer to cancel the transaction if the access control device 110 fails to receive the response (feedback) to the challenge within the timer period. A user of the client device 120 can detect the challenge presented by the access control device 110 (e.g., the user can see the challenge presented by seeing the pattern / sequence generated by the access control device 110). The user can insert a response representing the detected pattern on the client device 120 and the client device 120 can send the pattern to the access control device 110 over a second channel (e.g., electronically). The access control device 110 verifies if the response is correct and, if so, confirms that the access control device 110 and the client device 120 are in physical proximity of each other.

[0060] As another example, the access control device 110 can send the challenge over a secure channel (e.g., over BLE) to the client device 120. The client device 120 can then present the challenge to the user on a display of the client device 120. The user can then input the response to the challenge using a physical keypad attached or associated with the access control device 110.

[0061] In some examples, the client device 120 can present a randomly or arbitrarily generated sequence of characters and / or numbers in response to transmitting the credential to and / or setting up a secure channel with the access control device 110. The access control device 110 and / or client device 120 can present a message requesting that the user select buttons 222 and 224 on the keypad 220 corresponding to the randomly or arbitrarily generated sequence of characters and / or numbers presented on the screen of the client device 120. The access control device 110 can then generate an electronic communication that represents the buttons selected on the keypad 220 of the access control device 110. The access control device 110 transmits the communication to the client device 120. The client device 120 can then retrieve the pattern or sequence from the communication and verify whether the pattern or sequence included in the communication matches the randomly selected pattern or sequence that was presented on the display of the client device 120. If the patterns match, the client device 120 can indicate to the access control device 110 that the client device 120 is physically proximate to the access control device 110 and the access control device 110 can proceed with authorizing access to the resource based on the credentials.

[0062] In some examples, the display 210 can present a quick reference (QR) code that is associated with a temporary authorization token. The client device 120 can activate a camera and scan the QR code that is presented on the display 210. The access control device 110 can receive a communication from a server indicating that the QR code was scanned within a threshold period of time (e.g., corresponding to the timer of the access control device 110). In response to receiving the communication, the access control device 110 can determine that the client device 120 is physically proximate to the access control device 110 and can proceed with authorizing access to the resource based on the credentials.

[0063] In some examples, the display 210 can present a QR code (or emit an IR signal containing a code). The client device 120 can activate a camera and scan the QR code that is presented on the display 210 and / or activate an IR receiver to receive the IR signal. The client device 120 can then decode or obtain the code from a website associated with the QR code and / or from the IR signal. The client device 120 provides the obtained code to the access control device 110, which can then compare the code with the code associated with the QR code and / or code included in the IR signal. If thecodes match, the access control device 110 can determine that the client device 120 is physically proximate to the access control device 110 and can proceed with authorizing access to the resource based on the credentials.

[0064] In some examples, the display 210 can present a sequence of characters that is associated with a temporary authorization token. The client device 120 can activate a camera and scan the sequence of characters that is presented on the display 210 by capturing an image and performing optical character recognition (OCR) on the captured image to extract the sequence of characters. The access control device 110 can receive a communication from the client device 120 including the extracted sequence of characters within a threshold period of time (e.g., corresponding to the timer of the access control device 110). In response to receiving the communication, the access control device 110 can determine that the client device 120 is physically proximate to the access control device 110 and can proceed with authorizing access to the resource based on the credentials if the extracted sequence of characters received from the client device 120 matches the sequence of characters presented by the display 210. In some cases, the sequence of characters can be updated periodically while the access control device 110 verifies proximity to the client device 120.

[0065] In some examples, the display 210 can present a QR code (or emit an IR signal containing a code). The client device 120 can activate a camera and scan the QR code that is presented on the display 210 and / or activate an IR receiver to receive the IR signal. The client device 120 can then decode or obtain the code from a website associated with the QR code and / or from the IR signal. The client device 120 can solely decode the code value or the client device 120 can access a website to obtain the value. The client device 120 provides the obtained code to the access control device 110, which can then compare the code with the code associated with the QR code and / or code included in the IR signal. If the codes match, the access control device 110 can determine that the client device 120 is physically proximate to the access control device 110 and can proceed with authorizing access to the resource based on the credentials.

[0066] In some examples, a first test for proximity between the access control device 110 and the client device 120 can be performed in one direction followed by a second test for proximity performed in the other or reverse direction. For example, the access control device 110 can present a challenge for the client device 120 to generate a correctresponse (e.g., by scanning a QR code or inputting a sequence of characters matching those presented by the access control device 110). Then, after the access control device 110 verifies that the client device 120 correctly responded to the challenge, the client device 120 can present a challenge for the access control device 110 to generate a correct response.

[0067] In some examples, the access control device 110 can present / display a QR / IR code or other sequence of characters. The access control device 110 can establish a communication session with the client device 120 via a main channel (e.g., BLE) that can be a secure channel over which credentials may be exchanged. The client device 120 can scan or capture the QR / IR code or other sequence of characters presented by the access control device 110 over a secondary channel. The client device 120 can connect to a server (with authentication) to inform the server that the QR / IR code or other sequence of characters have been scanned. The client device 120 can communicate to the server an identifier of the client device 120 and a timestamp at which the QR / IR code or other sequence of characters were captured or scanned. The server can filter register entries related to the scanned QR / IR code or other sequence of characters and can create a service with a random URL (that can be deleted after a threshold period of time).

[0068] The client device 120 can transmit a notification to the access control device 110 over the main channel indicating that the QR / IR code or other sequence of characters has been captured or scanned and the corresponding entry that was registered on the server at the URL. The server can create the service using information received from the access control device 110 at a previous point in time and store the register entry in association with the URL. The access control device 110 can access the URL and verify that the entry registered on the URL is the expected entry for the device identifier of the client device 120. If the access control device 110 verifies that the entry is expected and matches the client device 120, the access control device 110 determines that the client device 120 is within the proximity of the access control device 110.

[0069] In some examples, the access control device 110 can register a random or arbitrary value on the server over a secondary channel (not a main channel) with a server. After the server positively authorizes the register entry for the random or arbitrary value of the access control device 110, the server creates a dedicated URL to the random or arbitrary value. This register entry can expire after a threshold period oftime. Then, the access control device 110 can establish a communication session with the client device 120 via a main channel (e.g., BLE) that can be a secure channel over which credentials may be exchanged. The access control device 110 can present a QR code with the URL associated with the register entry for the client device 120 to scan. The client device 120 can scan or capture the QR code to access the URL over a secondary channel.

[0070] The client device 120 can connect to a server (with authentication) to access the register value associated with the URL, such as using authorization by the server of the client device 120. The client device 120 can then send the register value obtained from the URL to the access control device 110 over the main channel optionally with the initially generated challenge (e.g., the QR code or URL). The access control device 110 can verify that the value of the register received from the client device 120 matches the random or arbitrary value that was initially registered to confirm that the devices are physically proximate to each other, such as by accessing the URL and verifying that the value stored at the URL matches that which was received from the client device 120.

[0071] Specifically, in some examples, the client device 120 can initiate a session on a main channel with the access control device 110. The client device 120 can send a challenge, footprint or some unique value to the access control device 110 over the main channel. The access control device 110 can also establish a random value on a server and store the random value at a random URL location. The access control device 110 can present a QR code associated with a random URL to the client device 120. The random URL may be established by a central server after authenticating or authorizing the access control device 110.

[0072] The client device 120 can scan the QR code to access the random URL to retrieve the random value and to provide the value retrieved from the URL to the access control device 110. The client device 120 can also store the challenge, footprint, or unique value at the random URL location on a central server associated with the access control device 110 after authenticating with the server. The access control device 110 can then verify if the challenge, footprint or unique value initially received from the client device 120 matches that which has been stored at the random URL by the client device 120. The access control device 110 can also receive from the client device 120 the value that the client device 120 retrieved from the URL and can verify if the valuereceived from the client device 120 matches the random value established by the access control device 110. After the access control device 110 verifies that the values match, the access control device 110 confirms that the two devices are physically proximate to each other.

[0073] In some examples, the access control device 110 presents on an LED, a sequence, number or picture or barcode. The client device 120 can decode the number coded inside the LED sequence or audio sequence or QR / IR code and notifies the user that the access control device 110 desires to access credentials stored by the client device 120. In some cases, the client device 120 can use a microphone, IR sensor, camera or other sensor to capture the LED sequence presented by the access control device 110. The user of the client device 120 can confirm access to the requested credential and unblocks communication on the main channel with the access control device 110. The client device 120 can initiate responding on the main channel and loops the challenge received from the access control device 110. The code presented by the LED can be dynamically changed periodically.

[0074] In some examples, the user of the client device 120 can trigger an access request for transmitting a credential to the access control device 110. In response, the client device 120 can generate a random number and present the number to the access control device 110 using an output interface, such as a QR code on a display. The access control device 110 can decode the number presented by the client device 120 and can unblock access over the main channel. The access control device 110 can initiate normal communication and can transmit the captured and decoded number back to the client device 120. After the client device 120 verifies that the number generated by the client device 120 matches that received from the access control device 110, the client device 120 confirms that the two devices are physically proximate to each other and can allow access to the credential by the access control device 110.

[0075] In some examples, the access control device or controller may request the current location data of the client device as part of determining proximity. The access control device or controller may establish a secondary communication channel with the client device to receive the current location data. In some examples, the current location data may comprise a combination of data such as GPS coordinates along with a unique device identifier for the client device and a date / time stamp. In some examples, therequested location data may be automatically requested from the access control device or controller and transmitted by the client device while the user responds to a different challenge-response challenge.

[0076] In some examples, the access control device or controller may be capable of providing a plurality of the challenge-response options discussed herein. Depending on the configuration of either the access control device or the client device, one or more challenge-response options may be supported. In some examples, the supported challenge-response options may be determined by the access control device or controller based on client device configuration data that is transmitted along with the credential. Alternatively, the access control device or controller may store client device configuration data in conjunction with the associated credential, either at the time of credential issuance or after, and in response to receiving a credential, the access control device or controller determines or retrieves the supported challenge-response options to apply to the current access request. For example, if a challenge-response option requires a particular type of input / output but the relevant device lacks the necessary hardware (e.g., a keypad, camera, speaker, etc.), the challenge-response option may be designated as unsupported by the access control device, either for the current access request or for all access requests. The challenge-response option may be excluded for all access requests for a particular configuration where, for example, the access control reader coupled to the access controller has only a subset of supporting hardware.

[0077] In some examples, an access controller may be coupled to a plurality of access control readers with varying configurations, and the supported challenge-response options may be configured and managed by the access controller for each access control reader based on the reader’s particular hardware configuration. In some examples, the access control device may issue a plurality of challenge-response challenges, which the user may respond to optionally in total or in part. The proximity of the client device may be verified by correctly responding to optionally all, some, or at least one of the issued challenge-response challenges, depending on configuration of the access control device. In some examples, the access control device may randomly select from the plurality of supported challenge-response options.

[0078] In some examples, a client device may also contain a biometric sensor. As part of providing a challenge-response answer, the client device may also validate that theinput provided is associated with an authorized user of the client device by further receiving one or more biometric inputs while the challenge-response answer is being input and comparing it with the stored biometric data for authorized users. Alternatively, the client device may utilize a non-biometric passcode to indicate authorization to use the client device. If the one or more of the biometric and nonbiometric client device authentication inputs is validated by the client device, the client device may additionally send a confirmatory signal to the access control device indicating that the user has also been authenticated by the client device. Additionally, if the authentication input is not validated, the client device may block or delay the transmission of the challenge-response answer until a validated authentication input is received. Alternatively, the client device may still transmit the challenge-response answer but either delay confirmatory signaling of user authentication until a validated authentication input is received within a permissible time or transmit a confirmatory signal indicating user authentication failed. The access control device may additionally decide to grant or deny access based on the confirmatory signal of authentication from the client device, or it may simply log the confirmatory signal status.

[0079] FIG. 3 is a flowchart illustrating an example process or method 300 of the access control system 100, according to some examples. The process or method 300 may be embodied in computer-readable instructions for execution by one or more processors such that the operations of the process or method 300 may be performed in part or in whole by the functional components of the system 100; accordingly, the process or method 300 is described below by way of example with reference thereto. However, in other examples, at least some of the operations of the process or method 300 may be deployed on various other hardware configurations. Some or all of the operations of process or method 300 can be in parallel, out of order, or entirely omitted.

[0080] At operation 301, the server / controller 140 (e.g., a PACS server), the access control device 110, and / or client device 120 establish a communication session, as discussed above.

[0081] At operation 302, the client device 120 transmits a credential to the access control device 110 and / or server / controller 140, the credential being associated with access to a resource protected by the access control device 110 and / or server / controller 140, as discussed above.

[0082] At operation 303, the server / controller 140, client device 120, and / or the access control device 110 determine that the access control device 110 and / or server / controller 140 is physically proximate to the client device 120, as discussed above.

[0083] At operation 304, the controller 140, the access control device 110 and / or server / controller 140 enables access to the resource protected by the access control device 110 and / or server / controller 140 based on the credential, as discussed above.

[0084] FIG. 4 is a block diagram illustrating an example software architecture 406, which may be used in conjunction with various hardware architectures herein described. FIG. 4 is a non-limiting example of a software architecture and it will be appreciated that many other architectures may be implemented to facilitate the functionality described herein. The software architecture 406 may execute on hardware such as machine 500 of FIG. 5 that includes, among other things, processors 504, memory 514, and I / O components 518. A representative hardware layer 452 is illustrated and can represent, for example, the machine 500 of FIG. 5. The representative hardware layer 452 includes a processing unit 454 having associated executable instructions 404. Executable instructions 404 represent the executable instructions of the software architecture 406, including implementation of the methods, components, and so forth described herein. The hardware layer 452 also includes memory and / or storage devices memory / storage 456, which also have executable instructions 404. The hardware layer 452 may also comprise other hardware 458. The software architecture 406 may be deployed in any one or more of the components shown in FIG. 1.

[0085] In the example architecture of FIG. 4, the software architecture 406 may be conceptualized as a stack of layers where each layer provides particular functionality. For example, the software architecture 406 may include layers such as an operating system 402, libraries 420, frameworks / middl eware 418, applications 416, and a presentation layer 414. Operationally, the applications 416 and / or other components within the layers may invoke API calls 408 through the software stack and receive messages 412 in response to the API calls 408. The layers illustrated are representative in nature and not all software architectures have all layers. For example, some mobile or special purpose operating systems may not provide a frameworks / middl eware 418, while others may provide such a layer. Other software architectures may include additional or different layers.

[0086] The operating system 402 may manage hardware resources and provide common services. The operating system 402 may include, for example, a kernel 422, services 424, and drivers 426. The kernel 422 may act as an abstraction layer between the hardware and the other software layers. For example, the kernel 422 may be responsible for memory management, processor management (e.g., scheduling), component management, networking, security settings, and so on. The services 424 may provide other common services for the other software layers. The drivers 426 are responsible for controlling or interfacing with the underlying hardware. For instance, the drivers 426 include display drivers, camera drivers, BLE drivers, UWB drivers, Bluetooth® drivers, flash memory drivers, serial communication drivers (e.g., Universal Serial Bus (USB) drivers), Wi-Fi® drivers, audio drivers, power management drivers, and so forth depending on the hardware configuration.

[0087] The libraries 420 provide a common infrastructure that is used by the applications 416 and / or other components and / or layers. The libraries 420 provide functionality that allows other software components to perform tasks in an easier fashion than to interface directly with the underlying operating system 402 functionality (e.g., kernel 422, services 424 and / or drivers 426). The libraries 420 may include system libraries 444 (e.g., C standard library) that may provide functions such as memory allocation functions, string manipulation functions, mathematical functions, and the like. In addition, the libraries 420 may include API libraries 446 such as media libraries (e.g., libraries to support presentation and manipulation of various media format such as MPREG4, H.264, MP3, AAC, AMR, JPG, PNG), graphics libraries (e.g, an OpenGL framework that may be used to render two-dimensional (2D) and three-dimensional (3D) in a graphic content on a display), database libraries (e.g., SQLite that may provide various relational database functions), web libraries (e.g., WebKit that may provide web browsing functionality), and the like. The libraries 420 may also include a wide variety of other libraries 448 to provide many other APIs to the applications 416 and other software components / devices.

[0088] The frameworks / middl eware 418 (also sometimes referred to as middleware) provide a higher-level common infrastructure that may be used by the applications 416 and / or other software components / devices. For example, the frameworks / middleware 418 may provide various graphic user interface functions, high-level resourcemanagement, high-level location services, and so forth. The frameworks / middl eware 418 may provide a broad spectrum of other APIs that may be utilized by the applications 416 and / or other software components / devices, some of which may be specific to a particular operating system 402 or platform.

[0089] The applications 416 include built-in applications 438 and / or third-party applications 440. Examples of representative built-in applications 438 may include, but are not limited to, a contacts application, a browser application, a book reader application, a location application, a media application, a messaging application, and / or a game application. Third-party applications 440 may include an application developed using the ANDROID™ or IOS™ software development kit (SDK) by an entity other than the vendor of the particular platform, and may be mobile software running on a mobile operating system such as IOS™, ANDROID™, WINDOWS® Phone, or other mobile operating systems. The third-party applications 440 may invoke the API calls 408 provided by the mobile operating system (such as operating system 402) to facilitate functionality described herein.

[0090] The applications 416 may use built-in operating system functions (e.g., kernel 422, services 424, and / or drivers 426), libraries 420, and frameworks / middl eware 418 to create UIs to interact with users of the system. Alternatively, or additionally, in some systems, interactions with a user may occur through a presentation layer, such as presentation layer 414. In these systems, the application / component "logic" can be separated from the aspects of the application / component that interact with a user.

[0091] FIG. 5 is a block diagram illustrating components of a machine 500, according to some examples, able to read instructions from a machine-readable medium (e.g., a machine-readable storage medium) and perform any one or more of the methodologies discussed herein. Specifically, FIG. 5 shows a diagrammatic representation of the machine 500 in the example form of a computer system, within which the instructions 510 (e.g., software, a program, an application, an applet, an app, or other executable code) for causing the machine 500 to perform any one or more of the methodologies discussed herein may be executed.

[0092] As such, the instructions 510 may be used to implement devices or components described herein. The instructions 510 transform the general, non-programmed machine 500 into a particular machine 500, such as the client device 120, access control device110, or server / controller 140, programmed to carry out the described and illustrated functions in the manner described. In alternative examples, the machine 500 operates as a standalone device or may be coupled (e.g., networked) to other machines. In a networked deployment, the machine 500 may operate in the capacity of a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine 500 may comprise, but not be limited to, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a personal digital assistant (PDA), an entertainment media system, a cellular telephone, a smart phone, a mobile device, a wearable device (e.g., a smart watch), a smart home device (e.g., a smart appliance), other smart devices, a web appliance, a network router, a network switch, a network bridge, or any machine capable of executing the instructions 510, sequentially or otherwise, that specify actions to be taken by machine 500. Further, while only a single machine 500 is illustrated, the term "machine" shall also be taken to include a collection of machines that individually or jointly execute the instructions 510 to perform any one or more of the methodologies discussed herein.

[0093] The machine 500 may include processors 504, memory / storage 506, and I / O components 518, which may be configured to communicate with each other such as via a bus 502. In an example, the processors 504 (e.g., a CPU, a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an ASIC, a radiofrequency integrated circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor 508 and a processor 512 that may execute the instructions 510. The term “processor” is intended to include multi-core processors 504 that may comprise two or more independent processors (sometimes referred to as “cores”) that may execute instructions 510 contemporaneously. Although FIG. 5 shows multiple processors 504, the machine 500 may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

[0094] The memory / storage 506 may include a memory 514, such as a main memory, or other memory storage, database, and a storage unit 516, both accessible to theprocessors 504 such as via the bus 502. The storage unit 516 and memory 514 store the instructions 510 embodying any one or more of the methodologies or functions described herein. The instructions 510 may also reside, completely or partially, within the memory 514, within the storage unit 516, within at least one of the processors 504 (e.g., within the processor’s cache memory), or any suitable combination thereof, during execution thereof by the machine 500. Accordingly, the memory 514, the storage unit 516, and the memory of processors 504 are examples of machine-readable media.

[0095] The I / O components 518 may include a wide variety of components to receive input, provide output, produce output, transmit information, exchange information, capture measurements, and so on. The specific I / O components 518 that are included in a particular machine 500 will depend on the type of machine. For example, portable machines such as mobile phones will likely include a touch input device or other such input mechanisms, while a headless server machine will likely not include such a touch input device. It will be appreciated that the I / O components 518 may include many other components that are not shown in FIG. 5. The I / O components 518 are grouped according to functionality merely for simplifying the following discussion and the grouping is in no way limiting. In various examples, the I / O components 518 may include output components 526 and input components 528. The output components 526 may include visual components (e.g., a display such as a plasma display panel (PDP), a LED display, a LCD, a projector, or a cathode ray tube (CRT)), acoustic components (e.g., speakers), haptic components (e.g., a vibratory motor, resistance mechanisms), other signal generators, and so forth. The input components 528 may include alphanumeric input components (e.g., a keyboard, a touch screen configured to receive alphanumeric input, a photo-optical keyboard, or other alphanumeric input components), point-based input components (e.g., a mouse, a touchpad, a trackball, a joystick, a motion sensor, or other pointing instrument), tactile input components (e.g., a physical button, a touch screen that provides location and / or force of touches or touch gestures, or other tactile input components), audio input components (e.g., a microphone), and the like.

[0096] In further examples, the I / O components 518 may include biometric components 539, motion components 534, environmental components 536, or position components 538 among a wide array of other components. For example, the biometric components539 may include components to detect expressions (e.g., hand expressions, facial expressions, vocal expressions, body gestures, or eye tracking), measure biosignals (e.g., blood pressure, heart rate, body temperature, perspiration, or brain waves), identify a person (e.g., voice identification, retinal identification, facial identification, fingerprint identification, or electroencephalogram based identification), and the like. The motion components 534 may include acceleration sensor components (e.g., accelerometer), gravitation sensor components, rotation sensor components (e.g., gyroscope), and so forth. The environmental components 536 may include, for example, illumination sensor components (e.g., photometer), temperature sensor components (e.g., one or more thermometer that detect ambient temperature), humidity sensor components, pressure sensor components (e.g., barometer), acoustic sensor components (e.g., one or more microphones that detect background noise), proximity sensor components (e.g., infrared sensors that detect nearby objects), gas sensors (e.g., gas detection sensors to detection concentrations of hazardous gases for safety or to measure pollutants in the atmosphere), or other components that may provide indications, measurements, or signals corresponding to a surrounding physical environment. The position components 538 may include location sensor components (e.g., a GPS receiver component), altitude sensor components (e.g., altimeters or barometers that detect air pressure from which altitude may be derived), orientation sensor components (e.g., magnetometers), and the like.

[0097] Communication may be implemented using a wide variety of technologies. The I / O components 518 may include communication components 540 operable to couple the machine 500 to a network 537 or devices 529 via coupling 524 and coupling 522, respectively. For example, the communication components 540 may include a network interface component or other suitable device to interface with the network 537. In further examples, communication components 540 may include wired communication components, wireless communication components, cellular communication components, NFC components, Bluetooth® components (e.g., Bluetooth® Low Energy), Wi-Fi® components, and other communication components to provide communication via other modalities. The devices 529 may be another machine or any of a wide variety of peripheral devices (e.g., a peripheral device coupled via a USB).

[0098] Moreover, the communication components 540 may detect identifiers or include components operable to detect identifiers. For example, the communication components540 may include RFID tag reader components, NFC smart tag detection components, optical reader components (e.g., an optical sensor to detect one-dimensional bar codes such as Universal Product Code (UPC) bar code, multi-dimensional bar codes such as Quick Response (QR) code, Aztec code, Data Matrix, Dataglyph, MaxiCode, PDF417, Ultra Code, UCC RSS-2D bar code, and other optical codes), or acoustic detection components (e.g., microphones to identify tagged audio signals). In addition, a variety of information may be derived via the communication components 540, such as location via Internet Protocol (IP) geo-location, location via Wi-Fi® signal triangulation, location via detecting a NFC beacon signal that may indicate a particular location, and so forth.Glossary:

[0099] " CLIENT DEVICE" in this context refers to any machine that interfaces to a communications network to obtain resources from one or more server systems or other client devices or that communicates directly with such other devices or server systems. A client device may be, but is not limited to, a mobile phone, desktop computer, laptop, PDA, smart phone, tablet, ultrabook, netbook, laptop, multi-processor system, microprocessor-based or programmable consumer electronics, game console, STB, or any other communication device that a user may use to access a network.

[0100] "COMMUNICATIONS NETWORK" in this context refers to one or more portions of a network that may be an ad hoc network, an intranet, an extranet, a VPN, a LAN, a BLE network, a UWB network, a WLAN, a WAN, a WWAN, a MAN, the Internet, a portion of the Internet, a portion of the PSTN, a POTS network, a cellular telephone network, a wireless network, a Wi-Fi® network, another type of network, or a combination of two or more such networks. For example, a network or a portion of a network may include a wireless or cellular network and the coupling may be a CDMA connection, a GSM connection, or other type of cellular or wireless coupling. In this example, the coupling may implement any of a variety of types of data transfer technology, such as IxRTT, EVDO technology, GPRS technology, EDGE technology, 3 GPP including 3G, 4G networks, UMTS, HSPA, WiMAX, LTE standard, others defined by various standard setting organizations, other long range protocols, or other data transfer technology.

[0101] "MACHINE-READABLE MEDIUM" in this context refers to a component, device, or other tangible media able to store instructions and data temporarily or permanently and may include, but is not limited to, RAM, ROM, buffer memory, flash memory, optical media, magnetic media, cache memory, other types of storage (e.g., Erasable Programmable Read-Only Memory (EEPROM)) and / or any suitable combination thereof. The term "machine-readable medium" should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, or associated caches and servers) able to store instructions. The term "machine-readable medium" shall also be taken to include any medium, or combination of multiple media, that is capable of storing instructions (e.g., code) for execution by a machine, such that the instructions, when executed by one or more processors of the machine, cause the machine to perform any one or more of the methodologies described herein. Accordingly, a "machine-readable medium" refers to a single storage apparatus or device, as well as "cloud-based" storage systems or storage networks that include multiple storage apparatus or devices. The term "machine-readable medium" excludes signals per se.

[0102] " COMPONENT" in this context refers to a device, physical entity, or logic having boundaries defined by function or subroutine calls, branch points, APIs, or other technologies that provide for the partitioning or modularization of particular processing or control functions. Components may be combined via their interfaces with other components to carry out a machine process. A component may be a packaged functional hardware unit designed for use with other components and a part of a program that usually performs a particular function of related functions. Components may constitute either software components (e.g., code embodied on a machine-readable medium) or hardware components. A "hardware component" is a tangible unit capable of performing certain operations and may be configured or arranged in a certain physical manner. In various examples, one or more computer systems (e.g., a standalone computer system, a client computer system, or a server computer system) or one or more hardware components of a computer system (e.g., a processor or a group of processors) may be configured by software (e.g., an application or application portion) as a hardware component that operates to perform certain operations as described herein.

[0103] A hardware component may also be implemented mechanically, electronically, or any suitable combination thereof. For example, a hardware component may include dedicated circuitry or logic that is permanently configured to perform certain operations. A hardware component may be a special-purpose processor, such as a FPGA or an ASIC. A hardware component may also include programmable logic or circuitry that is temporarily configured by software to perform certain operations. For example, a hardware component may include software executed by a general-purpose processor or other programmable processor. Once configured by such software, hardware components become specific machines (or specific components of a machine) uniquely tailored to perform the configured functions and are no longer general-purpose processors. It will be appreciated that the decision to implement a hardware component mechanically, in dedicated and permanently configured circuitry, or in temporarily configured circuitry (e.g., configured by software) may be driven by cost and time considerations. Accordingly, the phrase "hardware component"(or "hardware-implemented component") should be understood to encompass a tangible entity, be that an entity that is physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a certain manner or to perform certain operations described herein. Considering examples in which hardware components are temporarily configured (e.g., programmed), each of the hardware components need not be configured or instantiated at any one instance in time. For example, where a hardware component comprises a general-purpose processor configured by software to become a specialpurpose processor, the general-purpose processor may be configured as respectively different special-purpose processors (e.g., comprising different hardware components) at different times. Software accordingly configures a particular processor or processors, for example, to constitute a particular hardware component at one instance of time and to constitute a different hardware component at a different instance of time.

[0104] Hardware components can provide information to, and receive information from, other hardware components. Accordingly, the described hardware components may be regarded as being communicatively coupled. Where multiple hardware components exist contemporaneously, communications may be achieved through signal transmission (e.g., over appropriate circuits and buses) between or among two or more of the hardware components. In examples in which multiple hardware components are configured or instantiated at different times, communications between such hardwarecomponents may be achieved, for example, through the storage and retrieval of information in memory structures to which the multiple hardware components have access. For example, one hardware component may perform an operation and store the output of that operation in a memory device to which it is communicatively coupled. A further hardware component may then, at a later time, access the memory device to retrieve and process the stored output.

[0105] Hardware components may also initiate communications with input or output devices and can operate on a resource (e.g., a collection of information). The various operations of example methods described herein may be performed, at least partially, by one or more processors that are temporarily configured (e.g., by software) or permanently configured to perform the relevant operations. Whether temporarily or permanently configured, such processors may constitute processor-implemented components that operate to perform one or more operations or functions described herein. As used herein, "processor-implemented component" refers to a hardware component implemented using one or more processors. Similarly, the methods described herein may be at least partially processor-implemented, with a particular processor or processors being an example of hardware. For example, at least some of the operations of a method may be performed by one or more processors or processor-implemented components. Moreover, the one or more processors may also operate to support performance of the relevant operations in a "cloud computing" environment or as a "software as a service" (SaaS). For example, at least some of the operations may be performed by a group of computers (as examples of machines including processors), with these operations being accessible via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., an API). The performance of certain of the operations may be distributed among the processors, not only residing within a single machine, but deployed across a number of machines. In some examples, the processors or processor- implemented components may be located in a single geographic location (e.g., within a home environment, an office environment, or a server farm). In other examples, the processors or processor-implemented components may be distributed across a number of geographic locations.

[0106] " PROCESSOR" in this context refers to any circuit or virtual circuit (a physical circuit emulated by logic executing on an actual processor) that manipulates data valuesaccording to control signals (e.g., "commands," "op codes," "machine code," etc.) and which produces corresponding output signals that are applied to operate a machine. A processor may, for example, be a CPU, a RISC processor, a CISC processor, a GPU, a DSP, an ASIC, a RFIC, or any combination thereof. A processor may further be a multicore processor having two or more independent processors (sometimes referred to as "cores") that may execute instructions contemporaneously.ADDITIONAL DISCLOSURE AND EXAMPLES

[0107] Example 1 includes subject matter such as a method to operate an access control system, including: establishing a communication session between a first device and a second device; transmitting a credential associated with the first device to the second device, the credential being associated with access to a resource protected by the second device; determining that the first device is physically proximate to the second device, the determination being before, substantially simultaneous with, and / or after verifying that the credentials received are authorized; and in response to determining that the second device is authorized and physically proximate to the first device, enabling access to the resource protected by the second device based on the credential.

[0108] In Example 2, the subject matter of Example 1 optionally including: wherein the second device includes an access control reader, and wherein the first device includes a user device.

[0109] In Example 3, the subject matter of Example 2 optionally including: wherein the second device includes an access controller coupled to the access control reader.

[0110] In Example 4, the subject matter of one or any combination of Examples 1-3 optionally includes: verifying, by the second device, that the credential is authorized to access the resource; and in response to verifying, by the second device, that the credential is authorized to access the resource, enabling the access to the resource.[OHl] In Example 5, the subject matter of Example 4 optionally including: wherein the resource includes a physical resource, and wherein the second device includes a physical access control system (PACS) reader.

[0112] In Example 6, the subject matter of Example 4 optionally including: wherein the resource includes a logical resource, and wherein the second device includes a logical access control system (LACS) reader.

[0113] In Example 7, the subject matter of one or any combination of Examples 1-6 optionally including: wherein determining that the first device is physically proximate to the second device includes: presenting a stimulus by the second device; and receiving input at the second device that identifies the stimulus.

[0114] In Example 8, the subject matter of Example 7 optionally including: determining that the stimulus identified by the input matches the stimulus presented by the second device; and in response to determining that the stimulus identified by the input matches the stimulus presented by the second device, determining that the first device is physically proximate to the second device.

[0115] In Example 9, the subject matter of one or any combination of Examples 7-8 optionally including, wherein the stimulus includes an audible message or a visual prompt.

[0116] In Example 10, the subject matter of Example 9 optionally including, wherein the audible message or visual prompt includes a specified pattern, the input that identifies the stimulus including the specified pattern.

[0117] In Example 11, the subject matter of one or any combination of Examples 7-8 optionally including: presenting a sequence of colors on a display of the second device; and receiving the input, via a keypad of the second device, that selects buttons that match the sequence of colors.

[0118] In Example 12, the subject matter of one or any combination of Examples 7-8 optionally including: presenting a sequence of colors on a display of the second device; and receiving, as the input by the second device, a communication from the first device that specifies the sequence of colors.

[0119] In Example 13, the subject matter of one or any combination of Examples 1-6 optionally including wherein determining that the first device is physically proximate to the second device includes: presenting a stimulus by the first device; and receiving input at the second device that identifies the stimulus.

[0120] In Example 14, the subject matter of Example 13 optionally including: determining that the stimulus identified by the input matches the stimulus presented by the first device; and in response to determining that the stimulus identified by the input matches the stimulus presented by the first device, determining that the first device is physically proximate to the second device.

[0121] In Example 15, the subject matter of one or any combination of Examples 1-6 optionally including wherein determining that the first device is physically proximate to the second device includes: presenting an optical code, such as a bar code, quick reference (QR) code, etc., by a display of the second device; and scanning the optical code by the first device to confirm that the first device is physically proximate to the second device.

[0122] In Example 16, the subject matter of one or any combination of Examples 1-6 optionally including wherein determining that the first device is physically proximate to the second device includes: presenting, by the first device, a random or arbitrary number; receiving, by the second device, input including the random or arbitrary number; transmitting, by the second device to the first device, a message including the input; and verifying by the first device that the input in the message matches the random or arbitrary number to determine that the first device is physically proximate to the second device.

[0123] In Example 17, the subject matter of one or any combination of Examples 1-6 optionally including wherein determining that the first device is physically proximate to the second device includes: presenting, by the second device, a random or arbitrary number; receiving, by the first device, input including the random or arbitrary number; transmitting, by the first device to the second device, a message including the input; and verifying by the second device that the input in the message matches the random or arbitrary number to determine that the first device is physically proximate to the second device.

[0124] In Example 18, the subject matter of one or any combination of Examples 1-6 optionally including wherein determining that the first device is physically proximate to the second device further includes: transmitting, by the first device, the current location data of the first device, which may also include a unique device identifier and / or a date / time stamp; verifying the current location data of the first device is physically proximate to the stored location of the second device at the time of the access request.

[0125] In Example 19, the subject matter of one or any combination of Examples 7-18 optionally including wherein the access control device determines whether one or more of the foregoing examples of a challenge-response are supported for an access request based on the configurations of the access control device and / or the client device.

[0126] In Example 20, the subject matter of one or any combination of Examples 7-18 optionally including wherein the access control device receives or retrieves configuration information for the client device associated with the credential and determines which of the one or more challenge-response options are supported for the access request.

[0127] In Example 21, the subject matter of one or any combination of Examples 19-20 optionally including wherein at least one of the supported examples of a challengeresponse is selected at random.

[0128] In Example 22, the subject matter of one or any combination of Examples 7-21 optionally including wherein determining that the first device is physically proximate to the second device includes issuing a plurality of the foregoing examples of a challengeresponse and validating at least one of the challenge-response answers.

[0129] In Example 23, the subject matter of one or any combination of Example 16-17 optionally including, the techniques described herein relate to a method, wherein the first device includes an electronic access card containing the credential associated with the first device.

[0130] In Example 24, the subject matter of one or any combination of Examples 7-23 optionally includes opening a communication channel between the access control device and the first device associated with the credential, wherein the communication channel is separate from the channel used to transmit the credential.

[0131] In Example 25, the subject matter of Example 24 optionally including wherein the access control reader outputs at least one of the foregoing challenge-response challenges, and a challenge-response answer is received from the first device over the separate communication channel.

[0132] In Example 26, the subject matter of Example 24 optionally including wherein the access controller transmits at least one of the foregoing challenge-response challenges to the access control reader for output and also transmits the same challengeresponse challenge to the first device over the separate communication channel, and the access control reader receives the challenge-response answer and transmits the answer to the access controller for verification.

[0133] In Example 27, the subject matter of Example 24 optionally including wherein the access reader outputs at least one of the foregoing challenge-response challenges and also transmits the associated challenge information to the access controller forverification, and the access controller receives the challenge-response answer from the first device over the separate communication channel.

[0134] In Example 28, the subject matter of Example 24 optionally including wherein the client device outputs at least one of the foregoing challenge-response challenges and also transmits for verification the associated challenge information to the access controller over the separate communication channel, and the access controller receives the challenge-response answer from the access control reader.

[0135] In Example 29, the subject matter of one or any combination of Examples 24-28 optionally including wherein the first device and the second device each issue challengeresponse challenges that the other must validly answer.

[0136] In Example 30, the subject matter of one or any combination of Examples 16-17 optionally including, the techniques described herein relate to a method, wherein the first device includes at least one user device and an access card containing the credential associated with the one or more user devices.

[0137] In Example 31, the subject matter of Example 30 optionally including, wherein the transmission of the credential associated with the first device is by the access card; and wherein the access control device opens a separate communication channel with at least one of the user devices associated with the credential.

[0138] In Example 32, the subject matter of Example 31 optionally including, wherein the access card is presented to an access reader coupled to an access controller; the access controller opens the separate communication channel with at least one of the user devices associated with the credential.

[0139] In Example 33, the subject matter of Example 32 optionally including wherein the access control reader outputs at least one of the foregoing challenge-response challenges, and a challenge-response answer is received from the user device over the separate communication channel.

[0140] In Example 34, the subject matter of Example 32 optionally including wherein the access controller transmits at least one of the foregoing challenge-response challenges to the access control reader for output and also transmits the same challengeresponse challenge to the use device over the separate communication channel, and the access control reader receives the challenge-response answer and transmits the answer to the access controller for verification.

[0141] In Example 35, the subject matter of Example 32 optionally including wherein the access reader outputs at least one of the foregoing challenge-response challenges and also transmits the associated challenge information to the access controller for verification, and the access controller receives the challenge-response answer from the user device over the separate communication channel.

[0142] In Example 36, the subject matter of one or any combination of Examples 1-35 optionally including, wherein the client device authenticates the user by collecting authentication input from at least one of a biometric or non-biometric source from the user at or around the time of the challenge-response communication; and comparing the authentication input with stored data associated with authenticated users.

[0143] In Example 37, the subject matter of Example 36 optionally including wherein the client device may delay or block transmission of the challenge-response communication from the client device until the client device is able to validate a new authentication input within the time period permitted as configured on the client device.

[0144] In Example 38, the subject matter of one or any combination of Examples 36-37 optionally including wherein the access control device receives a signal from the client device indicating whether or not the user has been authenticated by the client device at or around the time of the challenge-response communication, and the access control device may further grant or deny access based as well upon the status of the authentication signal from the client device or may simply log the authentication signal status with the result of the access request grant or denial.

[0145] Example 39 includes subject matter such as an access control system, or can optionally be combined with one or any combination of Examples 1-38 and the hardware and software configurations disclosed with respect to Figures 4 and 5 to include such subject matter, including: one or more processors coupled to a memory including non- transitory computer instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including: establishing a communication session between a first device and a second device; transmitting a credential associated with the first device to the second device, the credential being associated with access to a resource protected by the second device; determining that the first device is physically proximate to the second device; and in response to determiningthat the first device is physically proximate to the second device, enabling access to the resource protected by the second device based on the credential.

[0146] Example 40, includes subject matter such as non-transitory computer-readable instructions in an access control system, or can optionally be combined with one or any combination of Examples 1-39 and the hardware and software configurations disclosed with respect to Figures 4 and 5 to include such subject matter, including instructions that, when executed by one or more processors, configure the one or more processors to perform operations including: establishing a communication session between a first device and a second device; transmitting a credential associated with the first device to the second device, the credential being associated with access to a resource protected by the second device; determining that the first device is physically proximate to the second device; and in response to determining that the first device is physically proximate to the second device, enabling access to the resource protected by the second device based on the credential.

[0147] The above non-limiting Examples can be combined in any permutation. In this document, the terms “a” or “an” are used, as is common in patent documents, to include one or more than one, independent of any other instances or usages of “at least one” or “one or more.” In this document, the term “or” is used to refer to a nonexclusive or, such that “A or B” includes “A but not B,”“B but not A,” and “A and B,” unless otherwise indicated. In this document, the terms “including” and “in which” are used as the plain- English equivalents of the respective terms “comprising” and “wherein.” Also, in the following claims, the terms “including” and “comprising” are open-ended, that is, a system, device, article, composition, formulation, or process that includes elements in addition to those listed after such a term in a claim are still deemed to fall within the scope of that claim. Moreover, in the following claims, the terms “first,” “second,” and “third,” etc. are used merely as labels, and are not intended to impose numerical requirements on their objects.

[0148] The above description is intended to be illustrative, and not restrictive. For example, the above-described examples (or one or more aspects thereof) may be used in combination with each other. Other embodiments can be used, such as by one of ordinary skill in the art upon reviewing the above description. The Abstract is provided to allow the reader to quickly ascertain the nature of the technical disclosure. It issubmitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In the above Detailed Description, various features may be grouped together to streamline the disclosure. This should not be interpreted as intending that an unclaimed disclosed feature is essential to any claim. Rather, the subject matter may lie in less than all features of a particular disclosed embodiment. Thus, the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate embodiment, and it is contemplated that such embodiments can be combined with each other in various combinations or permutations. The scope should be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.

[0149] Changes and modifications may be made to the disclosed examples without departing from the scope of the present disclosure. These and other changes or modifications are intended to be included within the scope of the present disclosure, as expressed in the following claims.

[0150] The Abstract of the Disclosure is provided to allow the reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the foregoing Detailed Description, it can be seen that various features are grouped together in a single example for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed examples require more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter may lie in less than all features of a single disclosed example. Thus, the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate example.

Claims

WHAT IS CLAIMED IS:

1. A method comprising: establishing a communication session between a first device and a second device; transmitting a credential from the first device to the second device, the credential being associated with access to a resource protected by the second device; determining that the first device is physically proximate to the second device; and in response to determining that the first device is physically proximate to the second device, enabling access to the resource protected by the second device based on the credential.

2. The method of claim 1, wherein the second device comprises an access control reader, and wherein the first device comprises a user device.

3. The method of claim 1, comprising: verifying, by the second device, that the credential is authorized to access the resource; and in response to verifying, by the second device, that the credential is authorized to access the resource, enabling the access to the resource.

4. The method of claim 1, wherein the resource comprises a physical resource, and wherein the second device comprises a physical access control system (PACS) reader.

5. The method of claim 1, wherein the resource comprises a logical resource, and wherein the second device comprises a logical access control system (LACS) reader.

6. The method of claim 1, wherein determining that the first device is physically proximate to the second device comprises: presenting a stimulus by the second device; and receiving input at the second device that identifies the stimulus.

7. The method of claim 6, further comprising: determining that the stimulus identified by the input matches the stimulus presented by the second device; andin response to determining that the stimulus identified by the input matches the stimulus presented by the second device, determining that the first device is physically proximate to the second device.

8. The method of claim 6, wherein the stimulus comprises an audible message or a visual prompt.

9. The method of claim 8, wherein the audible message or visual prompt comprises a specified pattern, the input that identifies the stimulus comprising the specified pattern.

10. The method of claim 6, comprising: presenting a sequence of colors on a display of the second device; and receiving the input, via a keypad of the second device, that selects buttons that match the sequence of colors.

11. The method of claim 6, comprising: presenting a sequence of colors on a display of the second device; and receiving, as the input by the second device, a communication from the first device that specifies the sequence of colors.

12. The method of claim 1, wherein determining that the first device is physically proximate to the second device comprises: presenting a stimulus by the first device; and receiving input at the second device that identifies the stimulus.

13. The method of claim 12, further comprising: determining that the stimulus identified by the input matches the stimulus presented by the first device; and in response to determining that the stimulus identified by the input matches the stimulus presented by the first device, determining that the first device is physically proximate to the second device.

14. The method of claim 1, wherein determining that the first device is physically proximate to the second device comprises: presenting an optical code by a display of the second device; and scanning the optical code by the first device to confirm that the first device is physically proximate to the second device.

15. The method of claim 1, wherein determining that the first device is physically proximate to the second device comprises: presenting, by the first device, a random or arbitrary number; receiving, by the second device, input comprising the random or arbitrary number; transmitting, by the second device to the first device, a message comprising the input; and verifying by the first device that the input in the message matches the random or arbitrary number to determine that the first device is physically proximate to the second device.

16. The method of claim 15, wherein the first device comprises an electronic access card.

17. A system comprising: one or more processors coupled to a memory comprising non-transitory computer instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: establishing a communication session between a first device and a second device; transmitting a credential from the first device to the second device, the credential being associated with access to a resource protected by the second device; determining that the first device is physically proximate to the second device; and in response to determining that the first device is physically proximate to the second device, enabling access to the resource protected by the second device based on the credential.

18. The system of claim 17, wherein the second device comprises an access control reader, and wherein the first device comprises a user device.

19. The system of claim 17, the operations comprising: verifying, by the second device, that the credential is authorized to access the resource; and in response to verifying, by the second device, that the credential is authorized to access the resource, enabling the access to the resource.

20. A non-transitory computer-readable medium comprising non-transitory computer- readable instructions that, when executed by one or more processors, configure the one or more processors to perform operations comprising: establishing a communication session between a first device and a second device; transmitting a credential from the first device to the second device, the credential being associated with access to a resource protected by the second device; determining that the first device is physically proximate to the second device; and in response to determining that the first device is physically proximate to the second device, enabling access to the resource protected by the second device based on the credential.

Images