Credential Provider Local Storage for Offline Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic access control systems for physical spaces, such as hotels and care homes, fail to provide credentials when the network connection to the central server is unavailable, compromising security and accessibility.
Innovation Solution
A credential provider preloads multiple credential sets with validity times onto a local storage, allowing access even without a network connection by using short-range wireless communication to deliver the credential sets to key cards or personal devices like smartphones, ensuring secure storage of private keys on the server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If credentials are generated at a central server using a private key, then private key security is improved, but the ability to provide credentials when network connection is unavailable deteriorates
Solution Approach 1:
The system preloads credential sets from the central server into local memory before network connection is needed. This preliminary action ensures that credentials are already available locally when the network connection becomes unavailable, resolving the contradiction between maintaining central server security and ensuring local credential availability.
2Ease of operation
If a local server is installed at each site for credential generation, then credential availability is improved, but device complexity and security risk deteriorate
Solution Approach 1:
The invention extracts the private key from the local credential provider and keeps it only at the central server. The local credential provider stores only public keys and credential sets in memory, removing the security risk and complexity of storing private keys locally while maintaining the ability to provide credentials when needed.
3Ease of operation
If credential sets are preloaded into local memory, then credential availability when network is down is improved, but the risk of unauthorized access deteriorates
Solution Approach 1:
The system dynamically manages credential sets in memory with automatic expiration and validation. Credential sets are loaded only when needed, stored temporarily in volatile memory, and automatically invalidated after use or expiration. This dynamic approach ensures credentials are available when needed while minimizing the window of vulnerability to unauthorized access.
Solution Approach 2:
The system implements validation feedback mechanisms where credential sets are verified against the public key and expiration criteria before being used. This feedback loop ensures that only valid, non-expired credential sets are accepted, preventing unauthorized access while maintaining availability for legitimate users.
Data Source
Figure 1~2
Figure 3~5
AI summary
It is provided a method for providing a credential set to a credential carrier for gaining access to a physical space. The method is performed in a credential provider and comprises the steps of: preloading a plurality of credential sets from a server into a local memory, each credential set being usable to gain access to a physical space and each credential set comprising a first validity time; wherein, when a network connection between the credential provider and the server is unavailable, performing the following steps: obtaining a request to provide a credential set for a physical space; retrieving a credential set from the local memory, the credential set being usable to gain access to the physical space indicated in the request; and providing, as long as the first validity time of the credential set has not expired, the retrieved credential set to a credential carrier.