Distributed Temporal Credentials for Copy-Resistant Physical Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing physical access control systems using cipher locks, card keys, and mobile devices are vulnerable to copying and reuse, and non-repeating key pairs require compute-intensive infrastructure that does not scale well.
Innovation Solution
A decentralized physical access control system generates unpredictable temporal credentials using mobile application devices, where each request is unique and verified based on elapsed time between predecessor and successor requests, with forward verification of one-time-use codes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If non-repeating key pairs are used for physical access control, then security against copying and reuse is improved, but compute intensity and infrastructure complexity increase
Solution Approach 1:
The patent extracts the cryptographic computation burden from the access control infrastructure and relocates it to the mobile device. The server only needs to verify signatures, while the mobile device generates key pairs and performs compute-intensive operations locally, eliminating the need for complex centralized cryptographic infrastructure.
Solution Approach 2:
The mobile device autonomously generates its own cryptographic key pairs and manages its own authentication credentials without requiring complex centralized key management infrastructure. Each device independently handles its security, eliminating the need for centralized secret distribution systems.
2Reliability
If non-repeating key pairs are used for physical access control, then security against copying and reuse is improved, but scalability deteriorates
Solution Approach 1:
The patent extracts the key generation and management responsibilities from the centralized server and assigns them to individual mobile devices. This distribution of cryptographic functions enables linear scaling as each device operates independently with its own key pair, without burdening the central infrastructure.
Solution Approach 2:
The system segments the authentication process into independent per-device operations. Each mobile device maintains its own cryptographic materials and authentication state, allowing the system to scale by simply adding more independently operating devices without increasing centralized management complexity.
3Ease of operation
If shared secrets are distributed for access control, then authentication is simplified, but vulnerability to interception and duplication increases
Solution Approach 1:
The patent uses digital signatures where the private key never leaves the mobile device. The server receives and verifies signature copies without ever possessing the secret key, eliminating interception risks while maintaining authentication simplicity through public key infrastructure.
Solution Approach 2:
The patent introduces public keys as intermediaries between the mobile device and server. The private key remains confined to the mobile device while public keys and signatures mediate the authentication communication, preventing exposure of secret materials during transmission.
4Ease of operation
If temporal credentials are generated decentralized on mobile devices, then mobility and ease of operation are improved, but verification complexity increases
Solution Approach 1:
The patent implements feedback through timestamp verification and sequence number checking. The server verifies temporal credentials by checking timestamps against expected time windows and ensuring sequence numbers increment properly, providing simple verification rules that maintain low complexity despite decentralized generation.
Data Source
AI summary
A physical access control system enables acceptable portal entry codes upon receiving each physical access request by operating on the elapsed time from a previous physical access request to generate a temporal credential. The controller receives a plurality of physical access requests from a plurality of mobile application devices. Upon authenticating the first access request, the controller eliminates repetition from the space of acceptable successor requests from each mobile application device. Monotonic nonces advance the range of temporal code matches. Entry code generation is decentralized to distributed application devices and is inherently unknowable until a successor access request is initiated by the same application device.