Two-factor authentication system

1. An access point device configured to perform a two-factor authentication prior to granting access to a secure area, comprising:

memory comprising a set of instructions; and

at least one processor, wherein

the set of instructions and the at least one processor are configured to

perform facial recognition on a person proximate to the access point device, and perform wireless handshake with a mobile device associated with the person, prior to granting or denying entry to the secure area; and

when the access point device is a handshake initiator, the set of instructions and the at least one processor are configured to connect with the mobile device and receive a timestamp and a cryptographic signature from the mobile device.

2. The access point device of claim 1 , wherein the set of instructions and the at least one processor are further configured to receive an unlock request from the mobile device associated with a person.

3. The access point device of claim 2 , further comprising:

a camera is configured to scan facial features of the person, allowing the set of instructions and the at least one processor to determine if the facial features are visible.

4. The access point device of claim 3 , wherein the set of instructions and the at least one processor are further configured to

store a plurality of 2-dimensional (2D) images and a plurality of 3-dimensional (3D) images of the person captured by the camera, and

perform anti-spoofing to determine if the plurality of captured 2D images and the plurality of 3D images are of a live person.

5. The access point device of claim 4 , wherein

the plurality of captured 3D image is a 3D depth map of the person's face captured by the camera, and

the 3D depth map is a data structure that comprises of distance information from a viewpoint of the camera to the person in front of the camera.

6. The access point device of claim 4 , wherein the set of instructions and the at least processor are further configured to check a depth of the person's face from the plurality of captured 3D images at various points on the face.

7. The access point device of claim 4 , wherein the set of instructions and the at least one processor further configured to scan for liveness of the face and analyze the person's skin texture to determine liveness of the person.

8. The access point device of claim 4 , wherein the set of instructions and the at least one processor are further configured to compare the plurality of captured 2D images and the plurality of captured 3D images against previously stored 2D images and 3D images to perform facial recognition of the person requesting access to the secured area.

9. The access point device of claim 1 , wherein the set of instructions and at least one processor are further configured to perform the wireless handshake with the mobile device to determine if a valid wireless handshake exists between the access point device and the mobile device.

10. The access point device of claim 1 , wherein, when the access point device is the handshake initiator, the set of instructions and the at least one processor are further configured to verify or validate the timestamp and the cryptographic signature using one of the plurality of valid public keys previously stored in unlock service server.

11. The access point device of claim 1 , when the access point device is the handshake initiator, the set of instructions and the at least one processor are further configured to verify or validate a current timestamp of the access point against the timestamp received from the mobile device, and

when the timestamp received from the mobile device is within a predefined period of time, both in past and in present, the handshake is valid.

12. The access point device of claim 1 , wherein, when the access point device is a handshake initiator, the set of instructions and the at least one processor are further configured to connect to, and receive a user identification (ID) from, the mobile device.

13. The access point device of claim 12 , wherein, when the access point device is the handshake initiator, the set of instructions and the at least one processor are further configured to transmit a random challenge string to the mobile device, thereby causing the mobile device to generate a cryptographic signature for the random challenge string, the cryptographic signature generated by a private key residing on the mobile device and comprising a hash of the random challenge string.

14. The access point device of claim 13 , wherein, when the access point device is the handshake initiator, the set of instructions and the at least one processor are further configured to receive the cryptographic signature from the mobile device and verify or validate the cryptographic signature using one of the plurality of valid public keys previously stored in unlock service server.

15. A mobile device used to gain access to a secure area, comprising:

memory comprising a set of instructions; and

at least one processor, wherein

the set of instructions and the at least one processor are configured to

generate a public key synced with an access point device by way of an unlock service server, allowing for a wireless handshake between the mobile device and the access point device, and

generate a private key securely stored within the mobile device;

wherein, when the mobile device is a handshake initiator, the set of instructions and the at least one processor are configured to connect with the access point device and send a current timestamp and a cryptographic signature generated by the private key to the access point device.

16. The mobile device of claim 15 , wherein, when the mobile device is a handshake initiator, the set of instructions and the at least one processor are further configured to connect to, and send a user identification (ID) to, the access point device.

17. The mobile device of claim 16 , wherein, when the mobile device is the handshake initiator, the set of instructions and the at least one processor are further configured to receive a random challenge string generated by the access point device and generate a cryptographic signature for the random challenge string,

the cryptographic signature generated by a private key resides on the mobile device and comprises a hash of the random challenge string.

18. The mobile device of claim 17 , wherein, when the mobile device is the handshake initiator, the set of instructions and the at least one processor are further configured to transmit the cryptographic signature to the access point device, thereby causing the access point device to verify or validate the cryptographic signature using one of the plurality of valid public keys previously stored in unlock service server.