Credential Cache for Offline Access Control

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Access control devices face challenges when unable to communicate with the access control server, leading to disruptions in managing access rights for electronic keys.

Innovation Solution

Implementing a credential cache within the access control device that allows for local lookup and updating of access rights, using both pull and push mechanisms to ensure continuous access management, even during communication failures.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If access control device communicates with access control server to manage access rights, then centralized access management is improved, but system reliability deteriorates when communication fails

Engineering Contradiction:
Improvecentralized access managementVSAvoidaccess control availability
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent segments the access control system into two parts: a centralized access control server for managing access rights and a local credential cache in the access control device for offline verification. This segmentation allows the system to maintain centralized management capabilities while also providing local fallback functionality when communication fails, thus resolving the contradiction between centralized management and system reliability.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements preliminary action by pre-loading access rights into a credential cache in the access control device before communication failure occurs. The cache is populated with access rights data in advance, allowing the device to perform offline verification without real-time server communication, thereby maintaining system reliability during communication outages.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If credential cache is populated automatically through pull mechanism, then access control continuity is improved, but data freshness may deteriorate

Engineering Contradiction:
Improveaccess control continuityVSAvoidaccess right data freshness
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The patent implements a feedback mechanism where the access control device periodically communicates with the access control server to check for updates to access rights data. When updates are detected, the device retrieves the latest data and updates its credential cache. This feedback loop ensures that the local cache maintains data freshness while still providing offline capability, resolving the contradiction between access control continuity and data freshness.

Inventive Principle:
Principle #23Feedback

3Reliability

If access control device uses local credential cache, then offline access control is improved, but device complexity increases

Engineering Contradiction:
Improveoffline access controlVSAvoidaccess control device structure
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent uses copying by creating a local credential cache that contains copies of access rights data from the central server. Instead of implementing a full-blown access control system locally, the device maintains simplified copies of the necessary authentication data, enabling offline verification while keeping the device structure relatively simple.

Inventive Principle:
Principle #26Copying

Solution Approach 2:

The patent extracts only the essential access rights verification functionality from the centralized system and places it in the local credential cache. By taking out only the critical authentication data and verification logic needed for offline operation, the device achieves offline access control capability without the complexity of a complete access control system.

Inventive Principle:
Principle #2Taking out (Extraction)

Data Source

PatentEP3308532B1Credential cache
Publication Date: 2019.05.01 ASSA ABLOY AB
  • EP3308532B1 patent drawingFigure 1~2A
  • EP3308532B1 patent drawingFigure 2B~4

AI summary

It is presented a method performed for controlling access to a physical space. The method is performed in an access control device and comprises the steps of: communicating with an electronic key to authenticate the electronic key; performing a lookup of an access right using an identity of the electronic key in a credential cache when the access control device is unable to communicate with an access control server; and sending an unlock signal when the access right indicates that the electronic key should be granted access; retrieving, from the access control server, an access right indicating whether the electronic key should have access or not, when the access control device is able to communicate with the access control server; and updating the credential cache with the access right retrieved from the access control server.