Wi-fi enabled credential enrollment reader and credential management system for access control

1. A method comprising:

reading, by a reader device, a unique credential identifier of a passive credential device;

transmitting, by the reader device, the unique credential identifier to a credential management system over a secure wireless connection;

receiving, by the reader device, credential device data from the credential management system over the secure wireless connection; and

transmitting, by the reader device, the received credential device data to the passive credential device; and further comprising authenticating the reader device to the credential management system, wherein authenticating the reader device to the credential management system comprises:

receiving, by the credential management system, an authentication message from the reader device, wherein receiving the authentication message comprises receiving a serial number, a current revision of a security subsystem of the reader device, and an encrypted payload including the serial number and a timestamp;

retrieving, by the credential management system, a stored site key based on the authentication message, wherein retrieving the stored site key comprises retrieving the stored site key based on the serial number; and

verifying, by the credential management system, the authentication message, wherein verifying the authentication message comprises decrypting and verifying the encrypted payload including the serial number and the timestamp.

2. The method of claim 1 , further comprising establishing, by the reader device, the secure wireless connection with the credential management system.

3. The method of claim 2 , wherein establishing the secure wireless connection comprises establishing a secure Wi-Fi connection between the reader device and the credential management server.

4. The method of claim 3 , wherein establishing the secure wireless connection comprises configuring a plurality of parameters for the reader device.

5. The method of claim 4 , wherein configuring the plurality of parameters comprises:

configuring access data for a wireless access point associated with the secure Wi-Fi connection;

configuring a locator for the credential management system.

6. The method of claim 5 , wherein the access data comprises a Service Set Identifier (SSID) and a password for the wireless access point; and

wherein the locator comprises a Uniform Resource Locator (URL) of the credential management system.

7. The method of claim 1 , wherein the credential device data comprises a set of instructions for transmittal to an access control device.

8. The method of claim 1 , wherein the passive credential device is a smartcard.

9. The method of claim 1 , wherein authenticating the reader device to the credential management system further comprises using, by the credential management system, a certificate based on a hard-coded root certificate of the reader device to authenticate the credential management system.

10. The method of claim 1 , wherein the encrypted payload is encrypted using a site key associated with a site of the reader device.

11. The method of claim 1 , wherein the credential device data comprises a set of no-tour data, and further comprising:

receiving, by an access control device and from the passive credential device, the no-tour data at a user's next presentation of the passive credential device to the access control device; and

updating, by the access control device, access permissions of the passive credential device to a physical area secured by the access control device based on the no-tour data.

12. The method of claim 1 , wherein receiving the authentication message by the credential management system and from the reader device comprises directly communicating, by the reader device, with an access control point for secure Wi-Fi communication with the credential management system.

13. A credential reader device, comprising:

a processor; and

a memory comprising a plurality of instructions stored thereon that, in response to execution by the processor, causes the credential reader device to:

read a unique credential identifier of a passive credential device exclusively powered by wireless signals transmitted by one or more external devices;

autonomously transmit the unique credential identifier to a credential management system over a secure wireless connection;

receive credential device data from the credential management system over the secure wireless connection; and

transmit the received credential device data to the passive credential device,

wherein the credential device data comprises a set of no-tour data for transmittal to an access control device at a user's next presentation of the passive credential device to the access control device; and

wherein the transmitted no-tour data causes the access control device to update access permissions of the passive credential device to a physical area secured by the access control device.

14. The credential reader device of claim 13 , wherein the passive credential device is a smartcard.

15. The credential reader device of claim 13 , wherein the plurality of instructions further causes the credential reader device to establish a secure Wi-Fi connection between the credential reader device and the credential management system.

16. The credential reader device of claim 15 , wherein to establish the secure Wi-Fi connection comprises to:

configure a Service Set Identifier (SSID) and a password of a wireless access point associated with the secure Wi-Fi connection; and

configure a Uniform Resource Locator (URL) of the credential management system.

17. An access control system comprising:

a credential management system;

a passive credential device exclusively powered by wireless signals transmitted by one or more external devices; and

a credential reader device configured to (i) read a unique credential identifier of the passive credential device, (ii) transmit the unique credential identifier to the credential management system over a secure wireless connection, (iii) receive credential device data from the credential management system over the secure wireless connection, and (iv) transmit the received credential device data to the passive credential device;

wherein the credential reader device is a credential enrollment reader configured to (i) autonomously communicate with the credential management system over a secure Wi-Fi connection established between the credential enrollment reader and the credential management system without being physically connected to another computing device and (ii) transmit the received credential device data to the passive credential device to update the passive credential device with access control rights associated with the access control system;

further comprising a wireless access point; and

wherein the credential enrollment reader directly communicates with the access control point for secure Wi-Fi communication with the credential management system.

18. The access control system of claim 17 , wherein the credential device data comprises a set of instructions for transmittal to an access control device.

19. The access control system of claim 17 , wherein the passive credential device is a smartcard.

20. The access control system of claim 17 , wherein the credential enrollment reader communicates with the access control point over only the secure Wi-Fi communication.