Access Control Architecture for Credential Copy Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Access control systems fail to detect when secure data, such as credentials, are copied from one device to another, allowing malicious devices to gain unauthorized access without detection.

Innovation Solution

An access control architecture that generates diversified keys based on master keys and key diversification inputs, enabling mutual authentication and validation of credentials to ensure data integrity and prevent unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional access control systems use standard credential verification, then the system is simple to operate, but the system cannot detect when credentials are copied to unauthorized devices

Engineering Contradiction:

Improvedetection of credential copyingVSAvoidaccess control architecture

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The credential is segmented into multiple components: a credential blob containing encrypted credential data and a portion of key diversification input, and diversified keys generated through key derivation functions. This segmentation allows the system to verify credentials while detecting copying, as the credential blob alone is insufficient without the corresponding diversified key that can only be generated by the authorized device

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary actions by generating authentication diversified keys and encryption diversified keys before credential verification. The credential system generates the credential blob with embedded key diversification input, and the reader device pre-generates diversified keys using the same key derivation process, enabling detection of credential copying during the authentication process

Inventive Principle:

Principle #10Preliminary action

2Reliability

If the access control system implements diversified key generation and validation, then credential copying is detected, but the authentication process requires additional computational steps

Engineering Contradiction:

Improvecredential validation accuracyVSAvoidauthentication process

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The credential blob acts as an intermediary that carries embedded key diversification input from the credential system to the reader device. This intermediary enables the reader device to generate the encryption diversified key and validate the credential without requiring complex communication protocols or additional trusted parties

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system uses cryptographic copying techniques where the credential blob is encrypted using the encryption diversified key. The encrypted credential blob can be copied to multiple devices, but only the authorized device that possesses the correct key diversification input can generate the matching encryption diversified key to decrypt and validate the credential, thus detecting unauthorized copying

Inventive Principle:

Principle #26Copying

3Reliability

If mutual authentication with diversified keys is implemented, then unauthorized access is prevented, but the authentication time increases

Engineering Contradiction:

Improveaccess control securityVSAvoidauthentication time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs partial authentication actions by using the embedded portion of key diversification input in the credential blob to generate only the necessary encryption diversified key for validation, rather than requiring full re-authentication of all system credentials. This partial action maintains security while reducing authentication time

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS12430965B2Access control architecture for detecting secure data copied between devices

Publication Date: 2025.09.30 SCHLAGE LOCK CO LLC

AI summary

A method for leveraging an access control architecture for detecting secure data copied between devices according to an embodiment includes, by a credential system, generating an authentication diversified key based on a master key and a first key diversification input, generating an encryption diversified key based on the master key and a second key diversification input, generating a credential blob including an encrypted credential for a mobile device and a portion of the second key diversification input, and transmitting the credential blob to the mobile device, and by a reader device, receiving credential data from the mobile device including an encrypted version of the credential blob, generating the encryption diversified key based on the master key and the second key diversification input, validating the credential data based on the encryption diversified key, and extracting the credential for use in an access control decision.