Methods and apparatus for enabling digital identity support on legacy access control systems
An identity reader is coupled to a card reader that is coupled to a peripheral device, and includes a transceiver for scanning ephemeral ID signals including a first ephemeral ID signal from a user smart-device, wherein the first ephemeral ID signal is not permanently associated with the user, for outputting a reader identifier and a second ephemeral ID signal not permanently associated with a reader device to the smart device, and for receiving an authorization server token from the smart device, a processor coupled to the transceiver for determining whether the authorization server token is valid, and for determining card emulation data from a payload portion of the authorization server token, a radio frequency (rf) transmitter coupled to the processor for transmitting the card emulation data to the card reader device via rf signals, and wherein the reader device is for directing the peripheral device to perform a user-perceptible action.
1. An identity reader device coupled to a card reader device, wherein the card reader device is coupled to peripheral device and an access control system, the identity reader device comprising:
a short-range transceiver configured to scan for a plurality of first ephemeral ID signals within a geographic region proximate to the identity reader device, wherein the short-range transceiver is configured to detect an first ephemeral ID signal from a smart-device associated with a user, wherein the first ephemeral ID signal is not permanently associated with the user, wherein the short-range transceiver is configured to output to the smart device, an identifier associated with the identity reader device and second ephemeral ID signal, wherein the second ephemeral ID signal is not permanently associated with the identity reader device, in response to the first ephemeral ID signal, and wherein with the short-range transceiver is configured to receive from the smart-device a first authorization server token, wherein the first authorization server token is associated with the user;
a processor coupled to the short-range transceiver, wherein the processor is configured to determine whether the first authorization server token is valid, and wherein the processor is configured to determine card emulation data from a payload portion of the first authorization server token; and
a radio frequency (rf) transmitter coupled to the processor, wherein the rf transmitter is configured to transmit the card emulation data to the card reader device via rf signals; and
wherein the card reader device is configured to direct the peripheral device to perform a user-perceptible action in response to the card emulation data.
2. The device of claim 1 wherein the second ephemeral ID signal is selected from a group consisting of: random data, pseudo random data, and data selected from a predetermined set of data.
3. The device of claim 1
wherein the peripheral device comprises an electro-mechanical device; and
wherein the user-perceptible change in the electro-mechanical device is selected from a group consisting: unlocking a door, activating a gate, opening a door, unlocking a car door, activating an appliance, activating a vending machine.
4. The device of claim 1
wherein the peripheral device comprises an electrical device; and
wherein the user-perceptible change in the electrical device is selected from a group consisting: controlling a television, logging into a web service or site, enabling the electrical device.
5. The device of claim 1 wherein the processor is configured to determine whether a current time is within a time period associated the first authorization server token.
6. The device of claim 1 wherein the rf transmitter is configured to transmit the card emulation data via radio frequency identification (RFID) signals;
wherein the RFID signals are characterized by being high frequency (HF), low frequency (LF) or ultra-high frequency (UHF) signals.
7. The device of claim 1 wherein the short-range transceiver is selected from a group consisting of: BLE, Bluetooth, Wi-Fi, Zig-Bee, near field communication (NFC) and ultrawide band (UWB).
8. A method for providing card identity data to a card reader device coupled to an access control system comprising:
scanning with a short-range transceiver in an identity reader device coupled to the access control system, for a plurality of first ephemeral ID signals within a geographic region proximate to the identity reader device;
receiving with the short-range transceiver an first ephemeral ID signal from a smart-device associated with a user, wherein the first ephemeral ID signal is not permanently associated with the user;
transmitting with the short-range transceiver an identifier associated with the identity reader device and second ephemeral ID signal to the smart device, in response to receiving the first ephemeral ID signal, wherein the second ephemeral ID signal is not permanently associated with the identity reader device;
receiving with the short-range transceiver a first authorization server token from the smart-device, wherein the first authorization server token is associated with the user;
determining in a processor of the identity reader device whether the first authorization server token is valid;
determining in the processor card emulation data from a payload portion of the first authorization server token, in response to determining that the first authorization server token is valid; and
transmitting with a radio frequency (rf) transmitter in the identity reader device the card emulation data to the card reader device via rf signals; and
wherein the card reader device is configured to direct a peripheral device to perform a user-perceptible action in response to the card emulation data.
9. The method of claim 8 wherein the second ephemeral ID signal is selected from a group consisting of: random data, pseudo random data, and data selected from a predetermined set of data.
10. The method of claim 8
wherein the peripheral device comprises an electro-mechanical device; and
wherein the user-perceptible change in the electro-mechanical device is selected from a group consisting: unlocking a door, activating a gate, opening a door, unlocking a car door, activating an appliance, activating a vending machine, printing upon media.
11. The method of claim 8
wherein the peripheral device comprises an electrical device; and
wherein the user-perceptible change in the electrical device is selected from a group consisting: controlling a television, logging into a web service or site, enabling the electrical device, releasing a print job.
12. The method of claim 8
where the rf signals comprise radio frequency identification (RFID) signals;
wherein the RFID signals are characterized by being high frequency (HF), low frequency (LF) or ultra-high frequency (UHF) signals.
13. The method of claim 8 wherein the short-range transceiver is selected from a group consisting of: BLE, Bluetooth, Wi-Fi, Zig-Bee, near field communication (NFC) and ultrawide band (UWB).
14. A system coupled to a card reader device, wherein the card reader device is coupled to a peripheral device and an access control system, the system comprising:
an identity reader device comprising:
a first short-range transceiver configured to scan for a plurality of first ephemeral ID signals within a geographic region proximate to the identity reader device, wherein the short-range transceiver is configured to detect first ephemeral ID signals, wherein the short-range transceiver is configured to output an identifier associated with the identity reader device and second ephemeral ID signals in response to first ephemeral ID signals, wherein with the short-range transceiver is configured to receive authorization server tokens, and wherein the second ephemeral ID signals are not permanently associated with the identity reader device;
a first processor coupled to the first short-range transceiver, wherein the processor is configured to determine whether the authorization server tokens are valid, and wherein the processor is configured to determine card emulation data from payload portions of the authorization server tokens; and
a radio frequency (rf) device coupled to the first processor, wherein the rf device is configured to transmit card emulation data to the card reader device via rf signals when the authorization server tokens are valid; and
a smart device coupled to the identity reader device comprising:
a second short-range transceiver configured to output a first ephemeral ID signal to the identity reader device, wherein the first ephemeral ID signal is not permanently associated with the smart device, wherein the second short-range transceiver is configured to receive the identifier associated with the identity reader device and a second ephemeral ID signal from the identity reader device;
a wide-area transceiver configured to output at least a portion of the identifier associated with the identity reader device, the second ephemeral ID signal and a user identifier to a remote authentication server, and wherein the wide-area transceiver is configured to receive an authorization server token from the remote authentication server; and
wherein the second short-range transceiver is configured to output the authorization server token to the identity reader device.
15. The system of claim 14 wherein the peripheral device comprises an electro-mechanical device configured to perform a user-perceptible change selected from a group consisting: unlocking a door, activating a gate, opening a door, unlocking a car door, activating an appliance, activating a vending machine, printing media.
16. The system of claim 14 wherein the peripheral device comprises an electrical device configured to perform a user-perceptible change selected from a group consisting: controlling a television, logging into a web service or site, enabling the electrical device, enabling a print job.
17. The device of claim 14 wherein the smart device further comprises an executable software application configured to be executed on a processor comprising:
executable code that directs the second short-range transceiver to receive the identifier associated with the identity reader device and the second ephemeral ID signal from the identity reader device,
executable code that directs the wide-area transceiver to output the portion of the identifier associated with the identity reader device, the second ephemeral ID signal and the user identifier to the remote authentication server,
executable code that directs the wide-area transceiver to receive an authorization server token from the remote authentication server; and
executable code that directs the second short-range transceiver to output the authorization server token to the identity reader device.
18. The device of claim 14 wherein the radio frequency (rf) device is configured to output radio frequency identification (RFID) signals selected from a group consisting of high frequency (HF) signals, low frequency (LF) signals, ultra-high frequency (UHF) signals and near field communication (NFC) signals.
19. The device of claim 14 wherein the first short-range transceiver is selected from a group of consisting of: BLE, Bluetooth, Wi-Fi, Zig-Bee and ultrawide band (UWB).
20. The device of claim 14 wherein the smart device is selected from a group consisting of: a smart ring, a smart device, a smart phone, smart glasses, smart headphones, a fitness tracker, and a wearable device.