Secure resource control using object recognition

Abstract

A system for combining augmented reality (AR), machine learning (ML), and Light Detection and Ranging (LiDAR) technologies to create an efficient and accurate access to secure resources. An AR component is used with an integrated ML model trained to detect physical access control (PAC) or PAC system (PACS) readers or devices. When a user opens the application and points their mobile device camera at a reader, the ML model identifies the reader, triggering BLE communication and, in some cases, without relying on RSSI measurements to obtain access to the secure resource.

Description

SECURE RESOURCE CONTROL USING OBJECT RECOGNITIONPRIORITY APPLICATION(S)

[0001] This application claims priority to Indian Provisional Patent Application No. 202411079405, filed October 18, 2024, the disclosure of which is incorporated by reference herein in its entirety.BACKGROUND

[0002] Smartphones often exhibit limitations in accurately measuring signal strength. This inaccuracy can lead to delays or premature communication between devices and control systems, resulting in a suboptimal user experience. The reliance on signal strength for triggering transactions poses challenges, particularly in environments where external factors affect signal strength.BRIEF SUMMARY

[0003] In some aspects, the techniques described herein relate to a system including: one or more hardware processors; and at least one machine-storage medium for storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations including: accessing one or more images from a camera of a mobile device; identifying an object depicted in the one or more images; determining that the object identified in the one or more images corresponds to a physical access control (PAC) device; and in response to determining that the object identified in the one or more images corresponds to the PAC device, transmitting a credential from the mobile device to the PAC device to obtain access to a resource protected by the PAC device.

[0004] In some aspects, the techniques described herein relate to a system, wherein the operations include: in response to determining that the object identified in the one or more images corresponds to the PAC device, computing a distance between the mobile device and the PAC device; determining that the distance satisfies a distance threshold; and in response to determining that the distance satisfies the distance threshold, establishing a communication session with the PAC device to transmit the credential.

[0005] In some aspects, the techniques described herein relate to a system, wherein the communication session includes a Bluetooth Low Energy (BLE) communication session.

[0006] In some aspects, the techniques described herein relate to a system, wherein the operations include: obtaining a distance measurement from a Light Detection and Ranging (LiDAR) device of the mobile device, the distance measurement being associated with the PAC device; and computing the distance based on the distance measurement from a LiDAR device.

[0007] In some aspects, the techniques described herein relate to a system, wherein the operations for determining that the distance satisfies the distance threshold include determining that the distance is less than a predetermined distance.

[0008] In some aspects, the techniques described herein relate to a system, wherein the operations include: receiving input by the mobile device requesting launch of an application associated with the PAC device; and in response to receiving the input, launching the application and initiating capture of the one or more images using the camera of the mobile device.

[0009] In some aspects, the techniques described herein relate to a system, wherein the operations include: processing the one or more images using an augmented reality component of the mobile device; and detecting the object using the augmented reality component of the mobile device.

[0010] In some aspects, the techniques described herein relate to a system, wherein the operations include: applying the one or more images to a machine learning model of the augmented reality component, the machine learning model trained to output a prediction of whether the object depicted in the one or more images corresponds to the PAC device.

[0011] In some aspects, the techniques described herein relate to a system, wherein the operations include performing a set of training operations to train the machine learning model: accessing training data including training images that depict a set of training objects and ground truth data indicating whether a training image depicts one or more PAC devices; processing an individual training image of the training data by the machine learning model; predicting by the machine learning model whether the individual training image depicts the one or more PAC devices; computing a deviation based on comparing the prediction of the machine learning model with the ground truth data indicating whether the individual training image depicts the one or more PAC devices; and updating one or more parameters of the machine learning model based on the computed deviation.

[0012] In some aspects, the techniques described herein relate to a system, wherein the operations include: obtaining a segmentation of the object based on an output of the augmented reality component; comparing the segmentation of the object with a set of predetermined segmentations of different PAC devices; determining that the segmentation of the object matches one of the predetermined segmentations; and in response to determining that the segmentation of the object matches one of the predetermined segmentations, determining that the object corresponds to the PAC device.

[0013] In some aspects, the techniques described herein relate to a system, wherein the operations include: obtaining a measurement by the mobile device using a received signal strength indicator (RSSI); and computing the distance based on the measurement obtained using the RSSI.

[0014] In some aspects, the techniques described herein relate to a system, wherein the operations include: determining that the distance satisfies the distance threshold in response to determining that the RSSI is above a specified RSSI value.

[0015] In some aspects, the techniques described herein relate to a system, wherein the operations include: storing a table that associates different RSSI values with respective distances; retrieving an individual distance from the table that corresponds to the measurement obtained using the RSSI; computing a LiDAR distance measurement between the mobile device and the PAC device using a LiDAR component of the mobile device; and comparing the LiDAR distance measurement with the individual distance retrieved from the table.

[0016] In some aspects, the techniques described herein relate to a system, wherein the operations include: applying an offset to the RSSI in response to comparing the LiDAR distance measurement with the individual distance retrieved from the table.

[0017] In some aspects, the techniques described herein relate to a system, wherein the operations include: determining that the LiDAR distance measurement fails to correspond to the individual distance retrieved from the table that corresponds to the measurement obtained using the RSSI; and in response to determining that the LiDAR distance measurement fails to correspond to the individual distance retrieved from the table that corresponds to the measurement obtained using the RSSI, identifying an individual RSSI value in the table that corresponds to the computed LiDAR distance measurement.

[0018] In some aspects, the techniques described herein relate to a system, wherein the operations include: computing a difference between the individual RSSI value that corresponds to the computed LiDAR distance measurement and the RSSI measured by the mobile device; and applying the difference as the offset to the RSSI to determine whether the distance between the mobile device and the PAC device satisfies the threshold.

[0019] In some aspects, the techniques described herein relate to a system, wherein the operations include: storing the offset in a memory; and using the offset to compute subsequent distances using the RSSI to determine whether the distance between the mobile device and the PAC device satisfies the threshold.

[0020] In some aspects, the techniques described herein relate to a method including: accessing one or more images from a camera of a mobile device; identifying an object depicted in the one or more images; determining that the object identified in the one or more images corresponds to a physical access control (PAC) device; and in response to determining that the object identified in the one or more images corresponds to the PAC device, transmitting a credential from the mobile device to the PAC device to obtain access to a resource protected by the PAC device.

[0021] In some aspects, the techniques described herein relate to a method, further including: in response to determining that the object identified in the one or more images corresponds to the PAC device, computing a distance between the mobile device and the PAC device; determining that the distance satisfies a distance threshold; and in response to determining that the distance satisfies the distance threshold, establishing a communication session with the PAC device to transmit the credential.

[0022] In some aspects, the techniques described herein relate to a machine-storage medium for storing instructions that, when executed by one or more hardware processors, cause the one or more hardware processors to perform operations including: accessing one or more images from a camera of a mobile device; identifying an object depicted in the one or more images; determining that the object identified in the one or more images corresponds to a physical access control (PAC) device; and in response to determining that the object identified in the one or more images corresponds to the PAC device, transmitting a credential from the mobile device to the PAC device to obtain access to a resource protected by the PAC device.BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

[0023] To easily identify the discussion of any particular element or act, the most significant digit or digits in a reference number refer to the figure number in which that element is first introduced.

[0024] FIG. 1 is a diagrammatic representation of a networked environment in which the present disclosure may be deployed, in accordance with some examples.

[0025] FIG. 2 illustrates a diagram of an environment for accessing a secure resource, in accordance with some examples.

[0026] FIG. 3 illustrates a diagram of a sequence of operations for accessing a secure resource, in accordance with some examples.

[0027] FIG. 4 illustrates a diagram of a sequence of operations for accessing a secure resource, in accordance with some examples.

[0028] FIG. 5 illustrates an example RS SI table, in accordance with some examples.

[0029] FIG. 6 illustrates a routine for accessing a secure resource, in accordance with some examples.

[0030] FIG. 7 is a block diagram illustrating a representative software architecture, which may be used in conjunction with various hardware architectures herein described, in accordance with some examples.

[0031] FIG. 8 is a diagrammatic representation of a machine in the form of a computer system within which a set of instructions may be executed for causing the machine to perform any one or more of the methodologies discussed herein, in accordance with some examples.DETAILED DESCRIPTION

[0032] Example methods and systems for an access control system are described. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the disclosed examples. It will be evident, however, to one of ordinary skill in the art that examples of the disclosure may be practiced without these specific details.

[0033] Conventional techniques for initiating communication between mobile devices and readers, such as those used in access control systems, often rely on Received Signal Strength Indicator (RSSI) measurements from Bluetooth Low Energy (BLE) signals.This approach, while functional, is fraught with inefficiencies and potential waste of resources. The primary issue stems from the variability in BLE module quality across different mobile devices. Some phones possess more robust BLE hardware than others, leading to inconsistencies in RSSI value accuracy. This variability can result in delayed or failed connections, even when a user is within the intended range of a reader. For instance, a phone might report an RSSI value of -45 dBm when the actual value is -40 dBm, causing unnecessary delays in establishing communication despite the user being within the threshold distance.

[0034] Furthermore, conventional approaches rely heavily on continuous BLE packet advertising by the reader and constant monitoring by the mobile device, which can be power-intensive for both devices. The mobile application may constantly wait for RSSI callbacks from the operating system, consuming processing power and battery life even when the user is not actively attempting to use the system. These inefficiencies not only impact user experience by potentially causing delays or failed access attempts but also lead to increased power consumption on both the mobile device and the reader. This results in shorter battery life for mobile devices and higher energy costs for fixed reader installations. Additionally, the reliance on RSSI measurements alone fails to account for environmental factors that can affect signal strength, potentially compromising the security and reliability of the access control system.

[0035] The disclosed examples provide an intelligent solution that addresses the above technical problems and challenges. Particularly, the disclosed technical solution combines augmented reality (AR), machine learning (ML), and Light Detection and Ranging (LiDAR) technologies to create a more efficient and accurate system. The disclosed technique uses an AR component with an integrated ML model trained to detect physical access control (PAC) or PAC system (PACS) readers or devices. When a user opens the application and points their mobile device camera at a reader, the ML model identifies the reader, triggering BLE communication and, in some cases, without relying on RSSI measurements. This approach eliminates the need for continuous BLE packet advertising and constant RSSI monitoring, reducing power consumption and improving reliability.

[0036] To address potential security concerns, such as premature unlocking from a distance, the system incorporates LiDAR technology as a secondary authentication metric. LiDAR ensures that BLE communication is only initiated when the user is withina predetermined range of the reader, such as 20cm. This dual-layer approach enhances security while maintaining user convenience.

[0037] Furthermore, the system employs a sophisticated calibration method that combines RSSI measurements with LiDAR distance data. A lookup table maps expected RSSI values to specific distances. When discrepancies are detected between the measured RSSI and the expected value based on the LiDAR-measured distance, the system applies an offset to correct the RSSI measurement. This calibration process significantly improves the accuracy of distance estimation and connection initiation, addressing the variability issues found in conventional RSSI-only methods.

[0038] FIG. 1 is a block diagram showing an example access control system 100, according to various examples. The access control system 100 can include a client device 120 (e.g., mobile device) and PAC devices 110 that can be used to determine a location of one or more objects. The client device 120 and the PAC devices 110 are communicatively coupled over a network 130 (e.g., Internet, BLE, ultra-wideband (UWB) communication protocol, Near Field Communication (NFC), and / or telephony network). While the disclosed techniques are discussed in the context of PAC devices, similar techniques are applicable to any other type of access control device, such as a logical access control (LAC) device.

[0039] As used herein, the term “client device” may refer to any machine that interfaces to a communications network (such as network 130) to exchange credentials with an access control device, such as the PAC devices 110, a server / controller associated with the access control device, another client device 120, or any other component to obtain access to a logical or physical asset or resource protected by the access control device. In some examples, the client device 120 can additionally or alternatively communicate directly with, for example, an access control device or another client device 120. The client device 120 can include or store one or more credentials, which can be provided to the access control device 110 for obtaining access to a protected physical or logical asset or resource.

[0040] A client device 120 may be, but is not limited to, a mobile phone, desktop computer, laptop, portable digital assistant (PDA), smart phone, a wearable device (e.g., a smart watch), tablet, ultrabook, netbook, multi-processor system, microprocessor-based or programmable consumer electronics, physical card, or any other communication device that a user may use to access a network.

[0041] The access control device (e.g., the PAC devices 110) can include an access reader device (also referred to as an access control reader) connected to a secure / protected resource (e.g., a door locking mechanism or backend server) that controls the secure / protected resource (e.g., door locking mechanism). The resource associated with the access control device can include a door lock, an ignition system for a vehicle, or any other device that grants or denies access to a physical component or that can be operated to grant or deny access to the physical component. For example, in the case of a door lock, the access control device can deny access, in which case the door lock remains locked and the door cannot be opened; or can grant access, in which case the door lock becomes unlocked to allow the door to be opened. As another example, in the case of an ignition system, the access control device can deny access, in which case the vehicle ignition system remains disabled and the vehicle cannot be started; or can grant access, in which case the vehicle ignition becomes enabled to allow the vehicle to be started.

[0042] Physical access control (PAC) covers a range of systems and methods to govern access, for example by people, to secure areas or secure assets. Physical access control includes identification of authorized users or devices (e.g., vehicles, drones, etc.) and actuation of a gate, door, or other facility used to secure an area, or actuation of a control mechanism, e.g., a physical or electronic / software control mechanism, permitting access to a secure asset. The access control device may form part of a physical access control system (PACS), which can include a reader (e.g., an online or offline reader) that may hold authorization data (also referred to access control information) and can be capable of determining whether credentials (e.g., from credential or key devices such as radio frequency identification (RFID) chips in cards, fobs, or personal electronic devices such as mobile phones) are authorized for an actuator or control mechanism (e.g., door lock, door opener, software control mechanism, turning off an alarm, etc.), or a PACS can include a host server to which readers and actuators are connected (e.g., via a controller) in a centrally managed configuration.

[0043] In centrally managed configurations, readers can obtain credentials from credential or key devices (e.g., from one or more client devices 120) and pass those credentials to the PACS host server or headend system. The readers can send the credentials over a wired or wireless link, such as network 130. The host server then determines whether the credentials authorize access to the secure area or secure asset (orresource) and commands the actuator or other control mechanism of the PAC devices 110 accordingly by sending an allow / deny message back to the reader again over the wired or wireless link. While examples in physical access control are used herein, the disclosure applies similarly to logical access control system (LACS) use cases (e.g., logical access to personal electronic devices, logical access to personal online or electronic accounts or documents, etc.).

[0044] In general, the access control device can include one or more of a memory, a processor, one or more antennas, a communication module, a network interface device, a user interface, a display, and a power source or supply. The memory of the access control device can be used in connection with the execution of application programming or instructions by the processor of the access control device, and for the temporary or long-term storage of program instructions or instruction sets and / or credential or authorization data, such as credential data, credential authorization data, or access control data or instructions. For example, the memory can contain executable instructions that are used by the processor to run other components of access control device and / or to make access determinations based on credential or authorization data.

[0045] The memory of the access control device (e.g., PAC devices 110 and / or client device 120) can include a transitory or non-transitory computer-readable medium. The computer-readable medium can be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device. More specific examples of suitable computer-readable medium include, but are not limited to, an electrical connection having one or more wires or a tangible storage medium such as a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), Dynamic RAM (DRAM), any solid-state storage device in general, a compact disc read-only memory (CD-ROM), or other optical or magnetic storage device. Computer-readable media includes, but is not to be confused with, computer-readable storage medium, which is intended to cover all physical, non- transitory, or similar examples of computer-readable media.

[0046] The processor of the access control device can correspond to one or more computer processing devices or resources. For instance, the processor can be provided as silicon, as a Field Programmable Gate Array (FPGA), an Application-Specific Integrated Circuit (ASIC), any other type of Integrated Circuit (IC) chip, a collection of IC chips, orthe like. As a more specific example, the processor can be provided as a microprocessor, Central Processing Unit (CPU), or plurality of microprocessors or CPUs that are configured to execute instructions sets stored in an internal memory and / or memory of the access control device.

[0047] The antenna of the access control device can correspond to one or multiple antennas and can be configured to provide for wireless communications between access control device and a credential or key device (e.g., client device 120). The antenna can be arranged to operate using one or more wireless communication protocols and operating frequencies including, but not limited to, the IEEE 802.15.1, Bluetooth, BLE, NFC, ZigBee, Global System for Mobile communications (GSM), Code Division Multiple Access (CDMA), Wi-Fi, RF, UWB, and the like. By way of example, the antenna(s) can be RF antenna(s), and as such, may transmit / receive RF signals through free-space to be received / transferred by a credential or key device having an RF transceiver.

[0048] A communication module or communication component of the access control device can be configured to communicate according to any suitable communications protocol with one or more different systems or devices either remote or local to access control device, such as one or more client devices 120 and / or server / controllers. In some cases, the communication module of the access control device is configured to perform the disclosed authentication protocol securely.

[0049] In some cases, the communication module uses a same wired or wireless link between the access control device and the server / controller for all the communication modes. In some cases, the communication module uses one wired or wireless link between the access control device and the server / controller to communicate access control information and uses a different wired or wireless link to communicate or receive configuration information updates from the server / controller over the Internet Protocol (IP) communication mode.

[0050] The network interface device of the access control device includes hardware to facilitate communications with other devices, such as a one or more client devices 120 and / or server / controller (e.g., a PACS server), over a communication network, such as network 130, utilizing any one of a number of transfer protocols (e.g., frame relay, IP, transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.). Example communication networks can include a local areanetwork (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), mobile telephone networks (e.g., cellular networks), Plain Old Telephone (POTS) networks, wireless data networks (e.g., IEEE 802.11 family of standards known as WiFi, IEEE 802.16 family of standards known as WiMax), IEEE 802.15.4 family of standards, and peer-to-peer (P2P) networks, among others. In some examples, network interface device can include an Ethernet port or other physical jack, a Wi-Fi card, a Network Interface Card (NIC), a cellular interface (e.g., antenna, filters, and associated circuitry), or the like. In some examples, network interface device can include a plurality of antennas to wirelessly communicate using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) techniques.

[0051] A user interface of the access control device can include one or more input devices and / or display devices. Examples of suitable user input devices that can be included in the user interface include, without limitation, one or more buttons, a keyboard or keypad, a mouse, a touch-sensitive surface, a stylus, a camera, a microphone, etc. Examples of suitable user output devices that can be included in the user interface include, without limitation, one or more LEDs, an LCD panel, a display screen, a touchscreen, one or more lights, a speaker, and so forth. It should be appreciated that the user interface can also include a combined user input and user output device, such as a touch-sensitive display or the like. Any reference to operations performed by the access control device apply to the PAC devices 110, shown in FIG. 1.

[0052] The network 130 may include, or operate in conjunction with, an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a LAN, a wireless network, a wireless LAN (WLAN), a WAN, a wireless WAN (WWAN), a metropolitan area network (MAN), BLE, UWB, the Internet, a portion of the Internet, a portion of the Public Switched Telephone Network (PSTN), a POTS network, a cellular telephone network, a wireless network, a Wi-Fi® network, another type of network, or a combination of two or more such networks. For example, a network or a portion of a network may include a wireless or cellular network and the coupling may be a CDMA connection, a GSM connection, or other type of cellular or wireless coupling. In this example, the coupling may implement any of a variety of types of data transfer technology, such as Single Carrier Radio Transmission Technology (IxRTT), Evolution- Data Optimized (EVDO) technology, General Packet Radio Service (GPRS) technology,Enhanced Data rates for GSM Evolution (EDGE) technology, third Generation Partnership Project (3 GPP) including 3G, fourth generation wireless (4G) networks, fifth generation wireless (5G) networks, Universal Mobile Telecommunications System (UMTS), High Speed Packet Access (HSPA), Worldwide Interoperability for Microwave Access (WiMAX), Long Term Evolution (LTE) standard, others defined by various standard setting organizations, other short range or long range protocols, or other data transfer technology.

[0053] In an example, as the client device 120 approaches the PAC devices 110 (e.g., comes within range of a BLE communication protocol), the client device 120 transmits credentials of the client device 120 over the network 130. In one example, the client device 120 provides the credentials directly to the PAC devices 110. In such cases, the PAC devices 110 communicates the credentials with the server / controller. The server / controller (not shown) includes an authorization system (not shown). The server / controller, client device 120, and / or the PAC devices 110 can further include elements described with respect to FIG. 7 and FIG. 8, such as a processor and memory, having instructions stored thereon, that when executed by the processor, causes the processor to control the functions of the server / controller, client device 120, and / or the PAC devices 110.

[0054] The server / controller searches a list of credentials stored in the authorization system to determine whether the received credentials match credentials from the list of authorized credentials for accessing a secure asset or resource (e.g., door or secure area) protected by the PAC devices 110. In response to determining that the received credentials are authorized to access the PAC devices 110, the server / controller instructs the PAC devices 110 to perform an operation granting access for the client device 120 (e.g., instructing the PAC devices 110 to unlock a lock of a door).

[0055] In some examples, prior to granting access to the resource protected by the PAC devices 110, the PAC devices 110 and / or the server / controller, and / or the client device 120 can perform operations to verify that the client device 120 is within a specified distance of the client device 120. This can be performed before, substantially simultaneous with, and / or after verifying that the credentials received from the client device 120 are authorized to access the asset or resource.

[0056] In some examples, the client device 120 is equipped with an augmented reality (AR) component or module. The AR component or module is configured to detect andidentify real -world objects in images captured by one or more cameras (e.g., front-facing cameras or rear-facing cameras) of the client device 120. The AR component can include machine learning models trained to detect the PAC devices 110, initiating communication upon detection to ensure seamless interaction.

[0057] In some examples, a user of the client device 120 can select an option to launch an application to obtain access to the resource protected by the PAC devices 110. In response to the client device 120 receiving input to launch the application, the client device 120 launches the application. The client device 120 can also initiate or activate the one or more cameras of the client device 120.

[0058] As shown in diagram 202 of FIG. 2, the client device 120 (e.g., the mobile device 208) can begin capturing images 204 of the real-world environment of the client device 120. The images 204 can depict or include a depiction of the PAC device 206. The mobile device 208 can process the image 204 to determine whether any object depicted in the images 204 correspond to a PAC device, such as the PAC devices 110. For example, the mobile device 208 can perform object identification on one or more objects 210 depicted in the image 204, such as using the AR component of the mobile device 208.

[0059] In some examples, the AR component can output a segmentation (representing a border or outline) of each object that is detected in the images 204. The AR component can then retrieve from a memory of the mobile device 208 a list of segmentations of different types of access control devices, such as different types of PAC devices 110.The mobile device 208 compares the segmentation of each object depicted in the images 204 with the list of segmentations. In response to determining that an individual object segmentation in the list of segmentations matches one of the segmentations generated by the AR component, the mobile device 208 can determine that the object identified in the one or more images corresponds to a PAC device. In such cases, the mobile device 208 can perform operations to authenticate a user of the application with the PAC devices 110 to obtain access to the resource protected by the PAC devices 110. In some examples, the mobile device 208 and / or the PAC devices 110 can perform one or more secondary authentication processes prior to obtaining access to the protected resource in response to determining that the object identified in the one or more images corresponds to a PAC device.

[0060] In some examples, the AR component can implement one or more machine learning (ML) models that have been previously trained to predict or estimate whether a PAC device is depicted in the images 204. Specifically, the one or more ML models can process the images 204. The one or more ML models can output a prediction or indication of whether the images 204 depict a PAC device, such as PAC devices 110. In response to receiving the indication from the ML models indicating that the PAC devices 110 are being depicted in the images 204, the mobile device 208 can determine that the object identified in the one or more images corresponds to a PAC device. In such cases, the mobile device 208 can perform operations to authenticate a user of the application with the PAC devices 110 to obtain access to the resource protected by the PAC devices 110. In some examples, the mobile device 208 and / or the PAC devices 110 can perform one or more secondary authentication processes prior to obtaining access to the protected resource in response to determining that the object identified in the one or more images corresponds to a PAC device.

[0061] In some examples, the ML models can be trained using training data to predict whether a set of images depict a PAC device. In such cases, the ML models can access training data. The training data can include a set of training images that depict a set of training objects and ground truth data indicating whether a training image depicts one or more PAC devices. The ML model can process an individual training image of the training data and predict whether the individual training image depicts the one or more PAC devices. To compute a deviation, the prediction generated by the ML model can be compared with the ground truth data indicating whether the individual training image depicts the one or more PAC devices. Based on the deviation, loss can be established and used to update one or more parameters of the ML model. This process is repeated for multiple batches of training images until a stopping criterion is reached. At that point, the ML model with the trained or updated parameters is stored in the application on the mobile device 208. The ML model can then be used to detect whether an object depicted in an image captured by the mobile device 208 corresponds to a PAC device.

[0062] FIG. 3 illustrates a diagram 302 of a sequence of operations for accessing a secure resource, in accordance with some examples. Specifically, as shown in diagram 302, the mobile device 306 can receive input from a user to activate an application to communicate with a PAC device 304 to obtain access to a protected resource. In response, the mobile device 306 launches the application and activates a camera of themobile device 306. The mobile device 306 processes images captured by the camera and performs a sequence of operations 308. Namely, the mobile device 306 detects whether an object depicted in the images corresponds to the PAC device 304 using an AR component. The mobile device 306 can then immediately initiate communication with the PAC device 304 to transmit a credential to obtain access to the protected resource. For example, the mobile device 306 can perform authentication operations 310 to establish a protected and secure communication session with the PAC device 304 to obtain access to the protected resource.

[0063] In some examples, rather than immediately initiating the communication with the PAC device 304, the mobile device 306 can measure a distance between the mobile device 306 and the PAC device 304 in response to detecting the PAC device 304 in the images captured by the mobile device 306. The mobile device 306 can condition establishing the communication session with the PAC device 304 based on whether the distance between the PAC device 304 and the mobile device 306 satisfies a distance threshold. For example, the mobile device 306 can establish the communication session with the PAC device 304 in response to determining that a distance between the two devices is less than a specified amount (e.g., less than a maximum distance).

[0064] In some cases, to measure the distance between the PAC device 304 and the mobile device 306, the mobile device 306 can activate a LiDAR component of the mobile device 306. The mobile device 306 can measure a distance based on a measurement provided by the LiDAR component. The mobile device 306 compares the distance obtained by the LiDAR component to a threshold distance and if that threshold distance fails to be transgressed by the LiDAR distance measurement, the mobile device 306 continues to establish the communication session with the PAC device 304 (e.g., to exchange the credential).

[0065] In some examples, in addition or as an alternative to using LiDAR, the mobile device 306 can utilize a RSSI measurement that is provided by a BLE component of the mobile device 306. In such cases, the mobile device 306 can measure a dBM (as an RSSI value) and compare that measured dBM value to a dBM threshold. If the mobile device 306 determines that the measured RSSI dBM value is greater than the dBM threshold, the mobile device 306 determines that the mobile device 306 is within a threshold distance of the PAC device 304. In such cases, the mobile device 306 enables theestablishment of the communication session with the PAC device 304 and / or allows the credentials to be exchanged to obtain access to the protected resource.

[0066] FIG. 4 illustrates a diagram 404 of a sequence of operations for accessing a secure resource, in accordance with some examples. Specifically, in cases where the distance between a mobile device 406 and a PAC device 402 is being measured using RS SI, the mobile device 406 can employ a sequence of operations 408 to apply correction or offsets to the RS SI. Namely, because certain devices have different capabilities in computing the RSSI and compute such RSSI with different levels of accuracy, the disclosed techniques can compute a correction factor or offset to ensure that the RSSI is accurate when performing the above and below operations to condition the exchange of the credentials. Namely, the mobile device 406 can maintain an RSSI table 504 (shown in FIG. 5). The RSSI table 504 can store different RSSI values 508 with respective distances 510. For example, a first RSSI value 508 can be associated with a first distance 510 and a second RSSI value 508 can be associated with a second distance 510.

[0067] The mobile device 406 can calculate or obtain an RSSI measurement. The mobile device 406 can search the RSSI table 504 based on the obtained RSSI measurement to retrieve the corresponding distance from the RSSI table 504. The mobile device 406 can also measure the actual distance between the mobile device 406 and the PAC device 402 using the LiDAR component of the mobile device 406. The mobile device 406 can then compare the actual distance (e.g., the LiDAR measured distance) with the distance retrieved from the RSSI table 504 based on the measured RSSI. The mobile device 406 can determine whether the actual distance is within a threshold amount of the distance retrieved from the RSSI table 504 (e.g., if the two distances are within 1% of each other).

[0068] In response to determining that the distance retrieved from the RSSI table 504 based on the RSSI is more than the threshold amount of the actual distance computed using the LiDAR, the mobile device 406 can perform operations to compute an offset or correction. In such cases, the mobile device 406 can search the RSSI table 504 based on the actual distance computed using the LiDAR to obtain the corresponding RSSI value. The mobile device 406 can then compare the RSSI value that corresponds to the actual distance with the RSSI that has been measured by the mobile device 406. The mobile device 406 computes a difference between the two RSSI values and uses that differenceas the offset or correction. Specifically, the mobile device 406 can apply the offset or correction to the RS SI measured by the mobile device 406 to modify the measured RS SI. The mobile device 406 can then determine whether the modified RS SI corresponds to a minimum RSSI value or threshold to determine whether the mobile device 406 is within a threshold proximity to the PAC device 402. In response to determining that the mobile device 406 is within the threshold proximity to the PAC device 402 using the adjusted or modified RSSI, the mobile device 406 can enable the exchange of the credential and the establishment of the communication session with the PAC device 402.

[0069] While the sequence of operations 408 are shown as being performed after establishing the connection between the PAC device 402 and the mobile device 406 and prior to exchanging the credential, the sequence of operations 408 can be performed at any other time, such as prior to establishing the connection. For example, the sequence of operations 408 can be performed as part of the sequence of operations 308 to condition establishing the connection with the PAC device 304.

[0070] In some examples, the offset or correction can be computed according to the sequence of operations 408 as an initial configuration of the client device 120. In such cases, the offset or correction can be stored on the application. For example, the client device 120 can compute an RSSI by receiving a BLE signal from the PAC devices 110. The client device 120 can apply the offset to the computed RSSI to generate a modified RSSI. The client device 120 can then determine whether the modified RSSI corresponds to a minimum RSSI threshold. If so, the client device 120 can enable the client device 120 to communicate and exchange a credential with the PAC devices 110. In some cases, the client device 120 can also determine whether the PAC device 110 is depicted in one or more images captured by the client device 120 after or before determining whether the modified RSSI corresponds to the minimum RSSI threshold. Namely, the client device 120 can condition activating the camera of the client device 120 to determine whether the PAC device 110 is depicted in images on the determination of whether the modified RSSI corresponds to the minimum RSSI threshold. The client device 120 can activate the camera in response to determining that the modified RSSI corresponds to the minimum RSSI threshold and if the PAC device 110 is depicted in the camera images, the client device 120 can communicate with and / or exchange a credential with the PAC device 110.

[0071] In some cases, the client device 120 can activate the camera of the client device 120 to determine whether the PAC device 110 is depicted in the images captured by the camera. In response to detecting the PAC device 110 being depicted in the images, the client device 120 can then compute an RS SI by receiving a BLE signal from the PAC device 110. The client device 120 can then apply the previously determined offset to the computed RS SI to generate a modified RS SI. The client device 120 can then determine whether the modified RS SI corresponds to a minimum RS SI threshold. If so, the client device 120 can enable the client device 120 to communicate and exchange a credential with the PAC device 110.

[0072] FIG. 6 illustrates a routine 600 (e.g., method or process) in accordance with some examples. The operations discussed in connection with FIG. 6 can be performed sequentially, in parallel, and in any suitable order. The operations discussed in FIG. 6 can be performed by the access control system 100.

[0073] In operation 602, the client device 120 accesses one or more images from a camera of a mobile device, as discussed above.

[0074] In operation 604, the client device 120 identifies an object depicted in the one or more images, as discussed above.

[0075] In operation 606, the client device 120 determines that the object identified in the one or more images corresponds to a physical access control (PAC) device, as discussed above.

[0076] In operation 608, the client device 120, in response to determining that the object identified in the one or more images corresponds to the PAC device, transmits a credential from the mobile device to the PAC device to obtain access to a resource protected by the PAC device, as discussed above.

[0077] FIG. 7 is a block diagram illustrating an example of a software architecture 702 that may be installed on a machine, according to some examples. FIG. 7 is merely a nonlimiting example of a software architecture, and it will be appreciated that many other architectures may be implemented to facilitate the functionality described herein. The software architecture 702 may be executing on hardware such as a machine 800 of FIG. 8 that includes, among other things, processors 810, memory 804, and I / O components 842. A representative hardware layer 744 is illustrated and can represent, for example, the machine 800 of FIG. 8. The representative hardware layer 744 comprises one or more processing units 746 having associated executable instructions 748. The executableinstructions 748 represent the executable instructions of the software architecture 702. The hardware layer 744 also includes memory 804, which also have the executable instructions 748. The hardware layer 744 may also comprise other hardware 752, which represents any other hardware of the hardware layer 744, such as the other hardware illustrated as part of the machine 800.

[0078] The instructions 748 may be transmitted or received over the network using a transmission medium via a network interface device (e.g., a network interface component included in the communication components 840) and utilizing any one of a number of well-known transfer protocols (e.g., hypertext transfer protocol (HTTP)). Similarly, the instructions 748 may be transmitted or received using a transmission medium via the coupling (e.g., a peer-to-peer coupling) to the devices. The terms “transmission medium” and “signal medium” mean the same thing and may be used interchangeably in this disclosure. The terms “transmission medium” and “signal medium” shall be taken to include any intangible medium that is capable of storing, encoding, or carrying the instructions 748 for execution by the machine 800, and include digital or analog communications signals or other intangible media to facilitate communication of such software. Hence, the terms “transmission medium” and “signal medium” shall be taken to include any form of modulated data signal, carrier wave, and so forth. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.

[0079] The terms “machine-readable medium,” “computer-readable medium,” and “device-readable medium” mean the same thing and may be used interchangeably in this disclosure. The terms are defined to include both machine-storage media and transmission media. Thus, the terms include both storage devices / media and carrier waves / modulated data signals.

[0080] As used herein, the terms “machine-storage medium,” “device-storage medium,” and “computer-storage medium” mean the same thing and may be used interchangeably in this disclosure. The terms refer to a single or multiple storage devices and / or media (e.g., a centralized or distributed database, and / or associated caches and servers) that store executable instructions and / or data. The terms shall accordingly be taken to include, but not be limited to, solid-state memories, and optical and magnetic media, including memory internal or external to processors. Specific examples of machinestorage media, computer-storage media, and / or device-storage media include non-volatile memory, including by way of example semiconductor memory devices, e.g., erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), field-programmable gate arrays (FPGAs), and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The terms “machinestorage medium,” “computer-storage medium,” and “device-storage medium” are non- transitory computer-readable media and specifically exclude carrier waves, modulated data signals, and other such media, at least some of which are covered under the term “signal medium.”

[0081] In the example architecture of FIG. 7, the software architecture 702 may be conceptualized as a stack of layers, where each layer provides particular functionality. For example, the software architecture 702 may include layers such as an operating system 736, libraries 728, framework / middl eware 722, applications 716, and a presentation layer 714. Operationally, the applications 716 or other components within the layers may invoke API calls API calls 724 through the software stack and receive a response, returned values, and so forth (illustrated as messages 726) in response to the API calls 724. The layers illustrated are representative in nature, and not all software architectures have all layers. For example, some mobile or special-purpose operating systems may not provide a framework / middleware 722 layer, while others may provide such a layer. Other software architectures may include additional or different layers.

[0082] The operating system 736 may manage hardware resources and provide common services. The operating system 736 may include, for example, a kernel 738, services 740, and drivers 742. The kernel 738 may act as an abstraction layer between the hardware and the other software layers. For example, the kernel 738 may be responsible for memory management, processor management (e.g., scheduling), component management, networking, security settings, and so on. The services 740 may provide other common services for the other software layers. The drivers 742 may be responsible for controlling or interfacing with the underlying hardware. For instance, the drivers 742 may include display drivers, camera drivers, Bluetooth® drivers, flash memory drivers, serial communication drivers (e.g., Universal Serial Bus (USB) drivers), Wi-Fi® drivers, audio drivers, power management drivers, and so forth depending on the hardware configuration.

[0083] The libraries 728 may provide a common infrastructure that may be utilized by the applications 716 and / or other components and / or layers. The libraries 728 typicallyprovide functionality that allows other software modules to perform tasks in an easier fashion than by interfacing directly with the underlying operating system 736 functionality (e.g., kernel 738, services 740, or drivers 742). The libraries 728 may include system libraries 730 (e.g., C standard library) that may provide functions such as memory allocation functions, string manipulation functions, mathematic functions, and the like. In addition, the libraries 728 may include API libraries 732 such as media libraries (e.g., libraries to support presentation and manipulation of various media formats such as MPEG4, H.264, MP3, AAC, AMR, JPG, and PNG), graphics libraries (e.g., an OpenGL framework that may be used to render 2D and 3D graphic content on a display), database libraries (e.g., SQLite that may provide various relational database functions), web libraries (e.g., WebKit that may provide web browsing functionality), and the like. The libraries 728 may also include a wide variety of other libraries 734 to provide many other APIs to the applications 716 and other software components / modules.

[0084] The frameworks / middleware 722 (also sometimes referred to as middleware) may provide a higher-level common infrastructure that may be utilized by the applications 716 or other software components / modules. For example, the frameworks / middleware 722 may provide various graphical user interface functions, high-level resource management, high-level location services, and so forth. The frameworks / middleware 722 may provide a broad spectrum of other APIs that may be utilized by the applications 716 and / or other software components / modules, some of which may be specific to a particular operating system or platform.

[0085] The applications 716 include built-in applications 718 and / or third-party applications 720. Examples of representative built-in applications 718 may include, but are not limited to, a home application, a contacts application, a browser application, a book reader application, a location application, a media application, a messaging application, or a game application.

[0086] The third-party applications 720 may include any of the built-in applications 718, as well as a broad assortment of other applications. In a specific example, the third-party applications 720 (e.g., an application developed using the Android™ or iOS™ software development kit (SDK) by an entity other than the vendor of the particular platform) may be mobile software running on a mobile operating system such as iOS™, Android™, or other mobile operating systems. In this example, the third-party applications 720 mayinvoke the API calls 724 provided by the mobile operating system such as the operating system 736 to facilitate functionality described herein.

[0087] The applications 716 may utilize built-in operating system functions (e.g., kernel 738, services 740, or drivers 742), libraries (e.g., system libraries 730, API libraries 732, and other libraries 734), or framework / middleware 722 to create user interfaces to interact with users of the system. Alternatively, or additionally, in some systems, interactions with a user may occur through a presentation layer, such as the presentation layer 714. In these systems, the application / module “logic” can be separated from the aspects of the application / module that interact with the user.

[0088] Some software architectures utilize virtual machines. In the example of FIG. 7, this is illustrated by a virtual machine 704. The virtual machine 704 creates a software environment where applications / modules can execute as if they were executing on a hardware machine (e.g., the machine 800 of FIG. 8). The virtual machine 704 is hosted by a host operating system (e.g., the operating system 736) and typically, although not always, has a virtual machine monitor, which manages the operation of the virtual machine 704 as well as the interface with the host operating system (e.g., the operating system 736). A software architecture executes within the virtual machine 704, such as an operating system 712, libraries 710, frameworks 708, applications 716, or a presentation layer 706. These layers of software architecture executing within the virtual machine 704 can be the same as corresponding layers previously described or may be different.

[0089] FIG. 8 is a diagrammatic representation of the machine 800 within which instructions 808 (e.g., software, a program, an application, an applet, an app, or other executable code) for causing the machine 800 to perform any one or more of the methodologies discussed herein may be executed. For example, the instructions 808 may cause the machine 800 to execute any one or more of the methods described herein. The instructions 808 transform the general, non-programmed machine 800 into a particular machine 800 programmed to carry out the described and illustrated functions in the manner described. The machine 800 may operate as a standalone device or may be coupled (e.g., networked) to other machines. In a networked deployment, the machine 800 may operate in the capacity of a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine 800 may comprise, but not be limited to, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, anetbook, a set-top box (STB), a PDA, an entertainment media system, a cellular telephone, a smart phone, a mobile device, a wearable device (e.g., a smart watch), a smart home device (e.g., a smart appliance), other smart devices, a web appliance, a network router, a network switch, a network bridge, or any machine capable of executing the instructions 808, sequentially or otherwise, that specify actions to be taken by the machine 800. Further, while only a single machine 800 is illustrated, the term “machine” shall also be taken to include a collection of machines that individually or jointly execute the instructions 808 to perform any one or more of the methodologies discussed herein.

[0090] The machine 800 may include processors 802, memory 804, and I / O components 842, which may be configured to communicate with each other via a bus 844. In an example, the processors 802 (e.g., a Central Processing Unit (CPU), a Reduced Instruction Set Computing (RISC) processor, a Complex Instruction Set Computing (CISC) processor, a Graphics Processing Unit (GPU), a Digital Signal Processor (DSP), an ASIC, a Radio-Frequency Integrated Circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor 806 and a processor 810 that execute the instructions 808. The term “processor” is intended to include multi-core processors that may comprise two or more independent processors (sometimes referred to as “cores”) that may execute instructions contemporaneously. Although FIG. 8 shows multiple processors 802, the machine 800 may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiples cores, or any combination thereof.

[0091] The memory 804 includes a main memory 812, a static memory 814, and a storage unit 816, both accessible to the processors 802 via the bus 844. The main memory 804, the static memory 814, and storage unit 816 store the instructions 808 embodying any one or more of the methodologies or functions described herein. The instructions 808 may also reside, completely or partially, within the main memory 812, within the static memory 814, within machine-readable medium 818 within the storage unit 816, within at least one of the processors 802 (e.g., within the processor’s cache memory), or any suitable combination thereof, during execution thereof by the machine 800.

[0092] The I / O components 842 may include a wide variety of components to receive input, provide output, produce output, transmit information, exchange information,capture measurements, and so on. The specific I / O components 842 that are included in a particular machine will depend on the type of machine. For example, portable machines such as mobile phones may include a touch input device or other such input mechanisms, while a headless server machine will likely not include such a touch input device. It will be appreciated that the I / O components 842 may include many other components that are not shown in FIG. 8. In various examples, the I / O components 842 may include output components 828 and input components 830. The output components 828 may include visual components (e.g., a display such as a plasma display panel (PDP), a light emitting diode (LED) display, a liquid crystal display (LCD), a projector, or a cathode ray tube (CRT)), acoustic components (e.g., speakers), haptic components (e.g., a vibratory motor, resistance mechanisms), other signal generators, and so forth. The input components 830 may include alphanumeric input components (e.g., a keyboard, a touch screen configured to receive alphanumeric input, a photo-optical keyboard, or other alphanumeric input components), point-based input components (e.g., a mouse, a touchpad, a trackball, a joystick, a motion sensor, or another pointing instrument), tactile input components (e.g., a physical button, a touch screen that provides location and / or force of touches or touch gestures, or other tactile input components), audio input components (e.g., a microphone), and the like.

[0093] In further examples, the I / O components 842 may include biometric components 832, motion components 834, environmental components 836, or position components 838, among a wide array of other components. For example, the biometric components 832 include components to detect expressions (e.g., hand expressions, facial expressions, vocal expressions, body gestures, or eye tracking), measure biosignals (e.g., blood pressure, heart rate, body temperature, perspiration, or brain waves), identify a person (e.g., voice identification, retinal identification, facial identification, fingerprint identification, or electroencephalogram-based identification), and the like. The motion components 834 include acceleration sensor components (e.g., accelerometer), gravitation sensor components, rotation sensor components (e.g., gyroscope), and so forth. The environmental components 836 include, for example, illumination sensor components (e.g., photometer), temperature sensor components (e.g., one or more thermometers that detect ambient temperature), humidity sensor components, pressure sensor components (e.g., barometer), acoustic sensor components (e.g., one or more microphones that detect background noise), proximity sensor components (e.g., infraredsensors that detect nearby objects), gas sensors (e.g., gas detection sensors to detection concentrations of hazardous gases for safety or to measure pollutants in the atmosphere), or other components that may provide indications, measurements, or signals corresponding to a surrounding physical environment. The position components 838 include location sensor components (e.g., a GPS receiver component), altitude sensor components (e.g., altimeters or barometers that detect air pressure from which altitude may be derived), orientation sensor components (e.g., magnetometers), and the like.

[0094] Communication may be implemented using a wide variety of technologies. The I / O components 842 further include communication components 840 operable to couple the machine 800 to a network 820 or devices 822 via a coupling 824 and a coupling 826, respectively. For example, the communication components 840 may include a network interface component or another suitable device to interface with the network 820. In further examples, the communication components 840 may include wired communication components, wireless communication components, cellular communication components, Near Field Communication (NFC) components, Bluetooth® components (e.g., Bluetooth® Low Energy), Wi-Fi® components, and other communication components to provide communication via other modalities. The devices 822 may be another machine or any of a wide variety of peripheral devices (e.g., a peripheral device coupled via a USB).

[0095] Moreover, the communication components 840 may detect identifiers or include components operable to detect identifiers. For example, the communication components 840 may include Radio Frequency Identification (RFID) tag reader components, NFC smart tag detection components, optical reader components (e.g., an optical sensor to detect one-dimensional bar codes such as Universal Product Code (UPC) bar code, multi-dimensional bar codes such as Quick Response (QR) code, Aztec code, Data Matrix, Dataglyph, MaxiCode, PDF417, Ultra Code, UCC RSS-2D bar code, and other optical codes), or acoustic detection components (e.g., microphones to identify tagged audio signals). In addition, a variety of information may be derived via the communication components 840, such as location via Internet Protocol (IP) geolocation, location via Wi-Fi® signal triangulation, location via detecting an NFC beacon signal that may indicate a particular location, and so forth.

[0096] The various memories (e.g., memory 804, main memory 812, static memory 814, and / or memory of the processors 802) and / or storage unit 816 may store one or more sets of instructions and data structures (e.g., software) embodying or used by any one or more of the methodologies or functions described herein. These instructions (e.g., the instructions 808), when executed by processors 802, cause various operations to implement the disclosed examples.

[0097] The instructions 808 may be transmitted or received over the network 820, using a transmission medium, via a network interface device (e.g., a network interface component included in the communication components 840) and using any one of a number of well-known transfer protocols (e.g., hypertext transfer protocol (HTTP)). Similarly, the instructions 808 may be transmitted or received using a transmission medium via the coupling 826 (e.g., a peer-to-peer coupling) to the devices 822.

[0098] Although examples have been described, it will be evident that various modifications and changes may be made to these examples without departing from the broader scope of the present disclosure. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense. The accompanying drawings that form a part hereof, show by way of illustration, and not of limitation, specific examples in which the subject matter may be practiced. The examples illustrated are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other examples may be utilized and derived therefrom, such that structural and logical substitutions and changes may be made without departing from the scope of this disclosure. This Detailed Description, therefore, is not to be taken in a limiting sense, and the scope of various examples is defined only by the appended claims, along with the full range of equivalents to which such claims are entitled.

[0099] Such examples of the inventive subject matter may be referred to herein, individually and / or collectively, by the term "invention" merely for convenience and without intending to voluntarily limit the scope of this application to any single invention or inventive concept if more than one is in fact disclosed. Thus, although specific examples have been illustrated and described herein, it should be appreciated that any arrangement calculated to achieve the same purpose may be substituted for the specific examples shown. This disclosure is intended to cover any and all adaptations or variations of various examples. Combinations of the above examples, and otherexamples not specifically described herein, will be apparent to those of skill in the art upon reviewing the above description.

[0100] The Abstract of the Disclosure is provided to allow the reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the foregoing Detailed Description, it can be seen that various features are grouped together in a single example for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed examples require more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed example. Thus the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate example.

[0101] In view of the disclosure above, various examples are set forth below. It should be noted that one or more features of an example, taken in isolation or combination, should be considered within the disclosure of this application.

[0102] Example 1. A system comprising: one or more hardware processors; and at least one machine-storage medium for storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising: accessing one or more images from a camera of a mobile device; identifying an object depicted in the one or more images; determining that the object identified in the one or more images corresponds to a physical access control (PAC) device; and in response to determining that the object identified in the one or more images corresponds to the PAC device, transmitting a credential from the mobile device to the PAC device to obtain access to a resource protected by the PAC device.

[0103] Example 2. The system of Example 1, wherein the operations comprise: in response to determining that the object identified in the one or more images corresponds to the PAC device, computing a distance between the mobile device and the PAC device; determining that the distance satisfies a distance threshold; and in response to determining that the distance satisfies the distance threshold, establishing a communication session with the PAC device to transmit the credential.

[0104] Example 3. The system of any of Examples 1-2, wherein the communication session comprises a Bluetooth Low Energy (BLE) communication session.

[0105] Example 4. The system of any of Examples 1-3, wherein the operations comprise: obtaining a distance measurement from a LiDAR device of the mobile device, the distance measurement being associated with the PAC device; and computing the distance based on the distance measurement from a LiDAR device.

[0106] Example 5. The system of any of Examples 1-4, wherein the operations for determining that the distance satisfies the distance threshold comprise determining that the distance is less than a predetermined distance.

[0107] Example 6. The system of any of Examples 1-5, wherein the operations comprise: receiving input by the mobile device requesting launch of an application associated with the PAC device; and in response to receiving the input, launching the application and initiating capture of the one or more images using the camera of the mobile device.

[0108] Example 7. The system of any of Examples 1-6, wherein the operations comprise: processing the one or more images using an augmented reality component of the mobile device; and detecting the object using the augmented reality component of the mobile device.

[0109] Example 8. The system of any of Examples 1-7, wherein the operations comprise: applying the one or more images to a machine learning model of the augmented reality component, the machine learning model trained to output a prediction of whether the object depicted in the one or more images corresponds to the PAC device.

[0110] Example 9. The system of any of Examples 1-8, wherein the operations comprise performing a set of training operations to train the machine learning model: accessing training data comprising training images that depict a set of training objects and ground truth data indicating whether a training image depicts one or more PAC devices; processing an individual training image of the training data by the machine learning model; predicting by the machine learning model whether the individual training image depicts the one or more PAC devices; computing a deviation based on comparing the prediction of the machine learning model with the ground truth data indicating whether the individual training image depicts the one or more PAC devices; and updating one or more parameters of the machine learning model based on the computed deviation.

[0111] Example 10. The system of any of Examples 1-9, wherein the operations comprise: obtaining a segmentation of the object based on an output of the augmentedreality component; comparing the segmentation of the object with a set of predetermined segmentations of different PAC devices; determining that the segmentation of the object matches one of the predetermined segmentations; and in response to determining that the segmentation of the object matches one of the predetermined segmentations, determining that the object corresponds to the PAC device.

[0112] Example 11. The system of any of Examples 1-10, wherein the operations comprise: obtaining a measurement by the mobile device using a received signal strength indicator (RSSI); and computing the distance based on the measurement obtained using the RSSI.

[0113] Example 12. The system of any of Examples 1-11, wherein the operations comprise: determining that the distance satisfies the distance threshold in response to determining that the RSSI is above a specified RSSI value.

[0114] Example 13. The system of any of Examples 1-12, wherein the operations comprise: storing a table that associates different RSSI values with respective distances; retrieving an individual distance from the table that corresponds to the measurement obtained using the RSSI; computing a LiDAR distance measurement between the mobile device and the PAC device using a LiDAR component of the mobile device; and comparing the LiDAR distance measurement with the individual distance retrieved from the table.

[0115] Example 14. The system of any of Examples 1-13, wherein the operations comprise: applying an offset to the RSSI in response to comparing the LiDAR distance measurement with the individual distance retrieved from the table.

[0116] Example 15. The system of any of Examples 1-14, wherein the operations comprise: determining that the LiDAR distance measurement fails to correspond to the individual distance retrieved from the table that corresponds to the measurement obtained using the RSSI; and in response to determining that the LiDAR distance measurement fails to correspond to the individual distance retrieved from the table that corresponds to the measurement obtained using the RSSI, identifying an individual RSSI value in the table that corresponds to the computed LiDAR distance measurement.

[0117] Example 16. The system of any of Examples 1-15, wherein the operations comprise: computing a difference between the individual RSSI value that corresponds to the computed LiDAR distance measurement and the RSSI measured by the mobiledevice; and applying the difference as the offset to the RS SI to determine whether the distance between the mobile device and the PAC device satisfies the threshold.

[0118] Example 17. The system of any of Examples 1-16, wherein the operations comprise: storing the offset in a memory; and using the offset to compute subsequent distances using the RSSI to determine whether the distance between the mobile device and the PAC device satisfies the threshold.

[0119] Example 18. A method comprising: accessing one or more images from a camera of a mobile device; identifying an object depicted in the one or more images; determining that the object identified in the one or more images corresponds to a physical access control (PAC) device; and in response to determining that the object identified in the one or more images corresponds to the PAC device, transmitting a credential from the mobile device to the PAC device to obtain access to a resource protected by the PAC device.

[0120] Example 19. The method of Example 18, further comprising: in response to determining that the object identified in the one or more images corresponds to the PAC device, computing a distance between the mobile device and the PAC device; determining that the distance satisfies a distance threshold; and in response to determining that the distance satisfies the distance threshold, establishing a communication session with the PAC device to transmit the credential.

[0121] Example 20. A machine-storage medium for storing instructions that, when executed by one or more hardware processors, cause the one or more hardware processors to perform operations comprising: accessing one or more images from a camera of a mobile device; identifying an object depicted in the one or more images; determining that the object identified in the one or more images corresponds to a physical access control (PAC) device; and in response to determining that the object identified in the one or more images corresponds to the PAC device, transmitting a credential from the mobile device to the PAC device to obtain access to a resource protected by the PAC device.

Claims

CLAIMSWhat is claimed is:

1. A system comprising: one or more hardware processors; and at least one machine-storage medium for storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising: accessing one or more images from a camera of a mobile device; identifying an object depicted in the one or more images; determining that the object identified in the one or more images corresponds to a physical access control (PAC) device; and in response to determining that the object identified in the one or more images corresponds to the PAC device, transmitting a credential from the mobile device to the PAC device to obtain access to a resource protected by the PAC device.

2. The system of claim 1, wherein the operations comprise: in response to determining that the object identified in the one or more images corresponds to the PAC device, computing a distance between the mobile device and the PAC device; determining that the distance satisfies a distance threshold; and in response to determining that the distance satisfies the distance threshold, establishing a communication session with the PAC device to transmit the credential.

3. The system of claim 2, wherein the communication session comprises a Bluetooth Low Energy (BLE) communication session.

4. The system of claim 2, wherein the operations comprise: obtaining a distance measurement from a LiDAR device of the mobile device, the distance measurement being associated with the PAC device; and computing the distance based on the distance measurement from a LiDAR device.

5. The system of claim 2, wherein the operations for determining that the distance satisfies the distance threshold comprise determining that the distance is less than a predetermined distance.

6. The system of claim 1, wherein the operations comprise: receiving input by the mobile device requesting launch of an application associated with the PAC device; and in response to receiving the input, launching the application and initiating capture of the one or more images using the camera of the mobile device.

7. The system of claim 1, wherein the operations comprise: processing the one or more images using an augmented reality component of the mobile device; and detecting the object using the augmented reality component of the mobile device.

8. The system of claim 7, wherein the operations comprise: applying the one or more images to a machine learning model of the augmented reality component, the machine learning model trained to output a prediction of whether the object depicted in the one or more images corresponds to the PAC device.

9. The system of claim 8, wherein the operations comprise performing a set of training operations to train the machine learning model: accessing training data comprising training images that depict a set of training objects and ground truth data indicating whether a training image depicts one or more PAC devices; processing an individual training image of the training data by the machine learning model; predicting by the machine learning model whether the individual training image depicts the one or more PAC devices; computing a deviation based on comparing the prediction of the machine learning model with the ground truth data indicating whether the individual training image depicts the one or more PAC devices; and updating one or more parameters of the machine learning model based on the computed deviation.

10. The system of claim 7, wherein the operations comprise: obtaining a segmentation of the object based on an output of the augmented reality component;comparing the segmentation of the object with a set of predetermined segmentations of different PAC devices; determining that the segmentation of the object matches one of the predetermined segmentations; and in response to determining that the segmentation of the object matches one of the predetermined segmentations, determining that the object corresponds to the PAC device.

11. The system of claim 2, wherein the operations comprise: obtaining a measurement by the mobile device using a received signal strength indicator (RS SI); and computing the distance based on the measurement obtained using the RSSI.

12. The system of claim 11, wherein the operations comprise: determining that the distance satisfies the distance threshold in response to determining that the RSSI is above a specified RSSI value.

13. The system of claim 12, wherein the operations comprise: storing a table that associates different RSSI values with respective distances; retrieving an individual distance from the table that corresponds to the measurement obtained using the RSSI; computing a LiDAR distance measurement between the mobile device and the PAC device using a LiDAR component of the mobile device; and comparing the LiDAR distance measurement with the individual distance retrieved from the table.

14. The system of claim 13, wherein the operations comprise: applying an offset to the RSSI in response to comparing the LiDAR distance measurement with the individual distance retrieved from the table.

15. The system of claim 14, wherein the operations comprise: determining that the LiDAR distance measurement fails to correspond to the individual distance retrieved from the table that corresponds to the measurement obtained using the RSSI; and in response to determining that the LiDAR distance measurement fails to correspond to the individual distance retrieved from the table that corresponds to themeasurement obtained using the RS SI, identifying an individual RS SI value in the table that corresponds to the computed LiDAR distance measurement.

16. The system of claim 15, wherein the operations comprise: computing a difference between the individual RS SI value that corresponds to the computed LiDAR distance measurement and the RSSI measured by the mobile device; and applying the difference as the offset to the RSSI to determine whether the distance between the mobile device and the PAC device satisfies the threshold.

17. The system of claim 16, wherein the operations comprise: storing the offset in a memory; and using the offset to compute subsequent distances using the RSSI to determine whether the distance between the mobile device and the PAC device satisfies the threshold.

18. A method comprising: accessing one or more images from a camera of a mobile device; identifying an object depicted in the one or more images; determining that the object identified in the one or more images corresponds to a physical access control (PAC) device; and in response to determining that the object identified in the one or more images corresponds to the PAC device, transmitting a credential from the mobile device to the PAC device to obtain access to a resource protected by the PAC device.

19. The method of claim 18, further comprising: in response to determining that the object identified in the one or more images corresponds to the PAC device, computing a distance between the mobile device and the PAC device; determining that the distance satisfies a distance threshold; and in response to determining that the distance satisfies the distance threshold, establishing a communication session with the PAC device to transmit the credential.

20. A machine-storage medium for storing instructions that, when executed by one or more hardware processors, cause the one or more hardware processors to perform operations comprising:accessing one or more images from a camera of a mobile device; identifying an object depicted in the one or more images; determining that the object identified in the one or more images corresponds to a physical access control (PAC) device; and in response to determining that the object identified in the one or more images corresponds to the PAC device, transmitting a credential from the mobile device to the PAC device to obtain access to a resource protected by the PAC device.

Images