Distributed Access Tokens for Time-Limited Smart Lock Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems require updates to the access control database to change credentials, often necessitating a factory reset of the access control device, limiting flexibility and efficiency.
Innovation Solution
An access control system utilizing flexible distributed tokens, such as macaroons, that leverage a cloud server to manage access control lists, allowing for secure, time-limited, and permission-limited access without the need for local storage on the lock device, enabling remote management and guest access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If access control database is updated to change credentials, then access control permissions are modified, but the access control device requires factory reset or physical update
Solution Approach 1:
The patent introduces a cloud server as an intermediary between users and the access control device. The cloud server stores the access control database and handles credential updates, allowing remote modification of permissions without physically updating the lock device. The lock device only needs to communicate with the cloud server to retrieve updated credentials, eliminating the need for factory resets or physical device updates.
Solution Approach 2:
The patent moves the access control database from the local lock device to a remote cloud server, transitioning from a one-dimensional local storage model to a multi-dimensional distributed model. This allows credentials to be updated in the cloud dimension while the lock device simply retrieves updates, resolving the contradiction between flexibility and operational complexity.
2Speed
If access control database is stored locally on the access control device, then quick access is enabled, but remote management and updates are limited
Solution Approach 1:
The patent segments the access control system into two parts: the cloud server stores and manages the complete access control database, while the lock device holds only a cryptographic key. This segmentation allows the cloud server to handle remote management and updates, while the lock device maintains fast local verification capabilities through its cryptographic key.
Solution Approach 2:
The cloud server acts as an intermediary that bridges remote management capabilities with local fast access. When credential updates are needed, the cloud server securely transmits updated credentials to the lock device, which then has both the updated credentials and maintains fast local verification through its cryptographic key.
3Ease of operation
If multiple users are granted access to the lock device, then usability is improved, but local storage limitations are exceeded
Solution Approach 1:
The patent extracts the access control database from the lock device and stores it in the cloud. This allows an unlimited number of user credentials to be managed remotely without consuming local storage on the lock device. The lock device only stores a cryptographic key, while all user credential data resides in the cloud, eliminating local storage limitations for multi-user access.
4Reliability
If cryptographic bearer tokens are used for secure access, then security is enhanced, but system complexity increases
Solution Approach 1:
The cloud server acts as an intermediary that manages the complexity of cryptographic bearer token generation, distribution, and validation. The lock device receives pre-configured cryptographic keys from the cloud server and uses them for secure verification. This intermediary approach maintains high security through cryptographic tokens while reducing device complexity by centralizing token management in the cloud.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method according to one embodiment includes determining whether a guest associated with a guest device is authorized to control an access control device based on an access control list, generating a caveated cryptographic bearer token in response to determining the guest is authorized to control the access control device, the caveated cryptographic bearer token including a time-based caveat defining a time limit for control of the access control device, transmitting the caveated cryptographic bearer token to the guest device in response to generating the caveated cryptographic bearer token, transmitting, in response to receiving the caveated cryptographic bearer token, a request including the caveated cryptographic bearer token to control the access control device to the access control device, and authenticating the request based on the received caveated cryptographic bearer token, a base cryptographic bearer token stored on the access control device, and a real-time clock of the access control device.