Leveraging flexible distributed tokens in an access control system

1. A method, comprising:

determining, by a server, whether a guest associated with a guest device is authorized to control an access control device based on an access control list stored on the server;

deriving, by the server, a caveated cryptographic bearer token from a base cryptographic bearer token in response to a determination that the guest is authorized to control the access control device, wherein the base cryptographic bearer token includes a base set of caveats and a first keyed cryptographic hash of the base set of caveats, wherein the caveated cryptographic bearer token includes a guest set of caveats including a time-based caveat that defines a time limit for control of the access control device and a second keyed cryptographic hash based on the first keyed cryptographic hash and the guest set of caveats, and wherein the first keyed cryptographic hash is a key for the second keyed cryptographic hash;

transmitting, by the server, the caveated cryptographic bearer token to the guest device in response to derivation of the caveated cryptographic bearer token;

transmitting, by the guest device and in response to receipt of the caveated cryptographic bearer token from the server, a request to control the access control device to the access control device, wherein the request includes the caveated cryptographic bearer token; and

authenticating, by the access control device, the request based on the received caveated cryptographic bearer token, the base cryptographic bearer token stored on the access control device, and a real-time clock of the access control device.

2. The method of claim 1 , further comprising requesting, by the guest device, the caveated cryptographic bearer token from the server; and

wherein determining whether the guest is authorized to control the access control device comprises determining whether the guest is authorized to control the access control device in response to receipt of the request for the caveated cryptographic bearer token by the server.

3. The method of claim 1 , wherein authenticating the request comprises:

determining whether the caveated cryptographic bearer token was derived from the base cryptographic bearer token based on the first keyed cryptographic hash and the second keyed cryptographic hash; and

comparing the time-based caveat to the real-time clock of the access control device to determine whether a current time is within the time limit.

4. The method of claim 1 , further comprising:

transmitting, by the guest device, a command to control a function of the access control device in response to successful authentication of the request by the access control device; and

performing, by the access control device, the function based on the command.

5. The method of claim 1 , wherein the access control list identifies one or more access control devices and guest access control permissions for each of the one or more access control devices; and

wherein the access control list is modifiable by an owner device authenticated via a separate security domain.

6. The method of claim 5 , further comprising:

verifying, by the server, an identifier of an owner associated with the owner device via the separate security domain;

determining, by the server, a guest access control permission for one of the one or more access control devices to revoke; and

updating, by the server, the access control list to revoke the guest access control permission;

wherein revocation of the guest access control permission prevents the server from subsequently issuing a caveated cryptographic bearer token to a corresponding guest device to control a corresponding access control device.

7. The method of claim 5 , further comprising:

verifying, by the server, an identifier of an owner associated with the owner device via the separate security domain;

transmitting, by the server and to a target guest device associated with a target guest, an invitation to control the access control device;

verifying, by the server, a guest identifier of the target guest via the separate security domain in response to transmitting the invitation to the target guest device; and

updating, by the server, the access control list to indicate that the target guest is authorized to have time-limited and permission-limited control the access control device in response to successful verification of the guest identifier via the separate security domain.

8. The method of claim 5 , further comprising:

registering an owner of the access control device with the server via the separate security domain;

providing a programming code of the access control device to the owner device as proof of possession of the access control device;

transmitting the base cryptographic bearer token generated by the access control device from the owner device to the server; and

updating the access control list to identify ownership of the access control device by the owner.

9. The method of claim 8 , wherein the base cryptographic bearer token stored on the access control device is the base cryptographic bearer token generated by the access control device and transmitted to the server.

10. The method of claim 8 , wherein the programming code is identified on at least one of a component of the access control device or paperwork provided with the access control device upon purchase of the access control device.

11. The method of claim 1 , wherein the first keyed cryptographic hash is keyed based on a security key generated during a pairing between the access control device and an owner device.

12. The method of claim 11 , wherein the security key comprises a secure password authentication key exchange (SPAKE) key generated during a secure password authentication key exchange between the access control device and the owner device.

13. The method of claim 1 , wherein the first keyed cryptographic hash is a first keyed-hash message authentication code (HMAC) and the second keyed cryptographic hash is a second HMAC.

14. An access control system, comprising:

a server including a first processor and a first memory comprising a first plurality of instructions stored thereon that, in response to execution by the first processor, causes the server to (i) determine whether a guest associated with a guest device is authorized to control a lock device based on an access control list stored on the server, (ii) derive a caveated cryptographic bearer token from a base cryptographic bearer token in response to a determination that the guest is authorized to control the lock device, wherein the base cryptographic bearer token includes a base set of caveats and a first keyed cryptographic hash of the base set of caveats, wherein the caveated cryptographic bearer token includes a guest set of caveats including a time-based caveat that defines a time limit for control of the lock device and a second keyed cryptographic hash based on the first keyed cryptographic hash and the guest set of caveats, and wherein the first keyed cryptographic hash is a key for the second keyed cryptographic hash, and (iii) transmit the caveated cryptographic bearer token to the guest device in response to derivation of the caveated cryptographic bearer token;

a guest device including a second processor and a second memory comprising a second plurality of instructions stored thereon that, in response to execution by the second processor, causes the guest device to (i) receive the caveated cryptographic bearer token from the server and (ii) transmit a request to control the lock device to the lock device in response in response to receipt of the caveated cryptographic bearer token, wherein the request includes the caveated cryptographic bearer token; and

a lock device including a lock mechanism to control access to a passageway, a third processor, and a third memory comprising a third plurality of instructions stored thereon that, in response to execution by the third processor, causes the lock device to authenticate the request based on the received caveated cryptographic bearer token, the base cryptographic bearer token stored on the lock device, and a real-time clock of the lock device.

15. The access control system of claim 14 , wherein to authenticate the request comprises to:

determine whether the caveated cryptographic bearer token was derived from the base cryptographic bearer token based on the first keyed cryptographic hash and the second keyed cryptographic hash; and

compare the time-based caveat to the real-time clock of the lock device to determine whether a current time is within the time limit.

16. The access control system of claim 15 ,

wherein the access control list identifies one or more lock devices and guest access control permissions for each of the one or more lock devices; and

wherein the access control list is modifiable by an owner device authenticated via a separate security domain.

17. The access control system of claim 16 , wherein the second plurality of instructions further causes the guest device to transmit a command to unlock the lock mechanism of the lock device in response to successful authentication of the request by the lock device; and

wherein the third plurality of instructions further causes the lock device to unlock the lock mechanism in response to the command.

18. The access control system of claim 14 , wherein the lock mechanism comprises at least one of a deadbolt or latch bolt.

19. The access control system of claim 14 , further comprising an owner device, and wherein the access control list identifies one or more access control devices and guest access control permissions for each of the one or more access control devices;

wherein the access control list is modifiable by the owner device authenticated via a separate security domain;

wherein the first plurality of instructions further causes the server to:

verify an identifier of an owner associated with the owner device via the separate security domain;

determine a guest access control permission for one of the one or more access control devices to revoke; and

update the access control list to revoke the guest access control permission; and

wherein revocation of the guest access control permission prevents the server from subsequently issuing a caveated cryptographic bearer token to a corresponding guest device to control a corresponding access control device.

20. The access control system of claim 19 , wherein the owner device includes a third processor and a third memory comprising a third plurality of instructions stored thereon that, in response to execution by the third processor, causes the owner device to:

register an owner of the access control device with the server via the separate security domain;

receive a programming code of the access control device as proof of possession of the access control device, wherein the programming code is identified on at least one of a component of the access control device or paperwork provided with the access control device upon purchase of the access control device;

transmit the base cryptographic bearer token generated by the access control device from the owner device to the server; and

update the access control list to identify ownership of the access control device by the owner.

21. An access control system, comprising:

at least one processing device; and

at least one memory comprising a plurality of instructions stored thereon that, in response to execution by the at least one processing device, causes the access control system to:

request, by a guest device, a derived cryptographic bearer token from a cloud system, wherein the derived cryptographic bearer token includes a guest set of caveats including a time-based caveat that restricts control of the access control device beyond a defined time;

determine, by the cloud system, whether the guest is authorized to control the access control device based on an access control list stored on the cloud system;

derive, by the cloud system, the derived cryptographic bearer token from a base cryptographic bearer token in response to a determination that the guest is authorized to control the access control device, wherein the base cryptographic bearer token includes a base set of caveats and a first keyed cryptographic hash of the base set of caveats, wherein the derived cryptographic bearer token includes the guest set of caveats and a second keyed cryptographic hash based on the first keyed cryptographic hash and the guest set of caveats, and wherein the first keyed cryptographic hash is a key for the second keyed cryptographic hash;

transmit, by the cloud system, the derived cryptographic bearer token to the guest device in response to derivation of the derived cryptographic bearer token;

transmit, by the guest device and in response to receipt of the derived cryptographic bearer token from the cloud system, a request to control the access control device to the access control device, wherein the request includes the derived cryptographic bearer token; and

authenticate, by the access control device, the request based on the received derived cryptographic bearer token, the base cryptographic bearer token stored on the access control device, and a real-time clock of the access control device.

22. The access control system of claim 21 , wherein to authenticate the request comprises to:

determine whether the derived cryptographic bearer token was derived from the base cryptographic bearer token based on the first keyed cryptographic hash and the second keyed cryptographic hash; and

compare the time-based caveat to the real-time clock of the access control device to determine whether a current time is within the time limit.

23. The access control system of claim 21 , wherein the derived cryptographic bearer token further includes at least one of a permission-based caveat or a location-based caveat.