AU2019100694A4 - A system for writing credential information on a credential - Google Patents

Abstract

Abstract Disclosed herein is a system and a method for writing credential information onto a credential, for example an Aviation Security Identification Card. 00-1 r-4 inn - r~iN Y- ----- ---

Description

A SYSTEM FOR WRITING CREDENTIAL INFORMATION ON A CREDENTIAL

Technical field

The disclosure herein generally relates to a system and a method for writing credential information on a credential.

Background

Figure 1 shows a photograph of an example of a credential 1 in the form of an Aviation Security Identification Card (ASIC), which are issued to people authorised to enter an Australian aviation security zone. In the context of the present document, a credential is an electronic device issued 10 to a person and which has stored therein credential information used by the person to gain access to at least one secure area. Other examples of credentials include Maritime Security Cards (MSIC) that are issued to people authorised to enter an Australian maritime security zone, and security cards for Canadian airports (Restricted Area Identity Card), New Zealand airports (Airport Identity Card), United States airports (Security Identification Display Area) and for 15 many maritime ports and corporate environments across the world. The credential information may or may not include the identity of the person, as for the credential 1 of figure 1.

The example credential of figure 1 is in the form of a card, however it may have the form of a key fob, a smart phone, or generally any suitable form. The example credential 1 comprises a polymer card in which is embedded an integrated circuit (IC) in which is stored the credential 20 information, which may be encrypted. The integrated circuit is in the form of a smart card chip in accordance with the ISO/IEC 14443 type A 13.56 MHz contactless smart card standard, as at 1 June 2019, however other credentials may comprise an IC in accordance with another suitable standard. Example ICs suitable for holding security information are branded MIFARE, including the MIFARE CLASSIC, MIFARE DESFIRE EVI and MIFARE DESFIRE EV2, 25 which are available from NXP SEMICONDUCTORS. Generally, any suitable IC may be used.

These ICs can be configured and used in accordance with manufacturer manuals.

The credential information stored in the IC memory can be read by an access control reader of an access control system, for example. The process of the access control reader reading the credential information may comprise the access control reader decrypting the credential information if encrypted. The access control system can determine whether the credential information satisfies an access condition, and if so provide access by, for example, unlocking a barrier, opening a gate, controlling a door, etc. The access credential condition may be, for

2019100694 25 Jun 2019 example, that the credential information so read matches credential information stored in access control system memory. Examples of access control systems include but are not limited to

SIP ASS and SIPORT by SIEMENS, EBI by HONEYWELL, CARD AX by GALLAGHER and access control systems available from Inner Range Pty Ltd..

An issued credential generally has specific credential information stored on it for the holder to gain access to a secure area of a facility, an example of which includes but is not limited to an airport. For example, flight crews and a cabin crews may be required to carry separate credentials for each of their departure and destination airports. This may be inconvenient and time consuming, especially because the flight crew member may have to repeat the process for 10 every security controlled Australian airport. Similar procedures may be required to update foreign issued credentials at foreign airports in jurisdictions other than Australia.

Summary

Disclosed herein is a system for writing credential information onto a credential. The system comprises a credential interface device configured to read identifier information indicative of an 15 identifier stored in a memory of the credential and send the identifier information so read, and write credential information on receipt of credential information writing instructions into the memory. The system comprises a computing system configured to receive the identifier information when so sent by the credential interface device, and send the credential information writing instructions to the credential interface device that when executed by the credential interface device causes the credential interface device to write the credential information associated with the identifier into the memory.

In an embodiment, the computing system is configured to determine the credential information associated with the identifier so received, and send the credential information to the credential information device for writing the credential information onto the memory.

In an embodiment, the computing system is configured to determine the credential information associated with the identifier by receiving a request to write the credential information.

An embodiment comprises artificial intelligence algorithms.

An embodiment is configured to determine the type of credential and in response write the credential information to the memory in a format in accordance with the type of credential.

In an embodiment, the credential comprises an Aviation Security Identification Card (ASIC).

2019100694 25 Jun 2019

An embodiment is configured for biometric identification.

An embodiment is configured for two factor identification.

In an embodiment, the credential interface device is a self-service credential interface device.

In an embodiment, the credential interface device is in communication with an access control system for communicating an access request thereto when the credential is in communication with the credential interface device.

Disclosed herein is a system in accordance with the above disclosure and comprising a plurality of credential interface devices, each of the plurality of credential interface devices being configured to read identifier information indicative of an identifier stored in the memory of the 10 credential when in communication therewith and send the identifier information so read, and write credential information on receipt of the credential information writing instructions into the memory, wherein the computing system is configured to receive the identifier information when so sent, and send the credential writing instructions to the credential interface device of the plurality of credential interface devices for which the identifier information was received.

Disclosed herein is a method for writing credential information onto a credential. The method comprises reading identifier information indicative of an identifier stored in a memory of the credential. The method comprises sending the identifier information. The method comprises receiving credential information writing instructions. The method comprises writing the credential information as per the credential writing instructions into the memory.

Disclosed herein is non-transitory processor readable tangible media including program instructions which when executed by a processor causes the processor to perform a method disclosed above.

Disclosed herein is a computer program for instructing a processor, which when executed by the processor causes the processor to perform a method disclosed above.

Any of the various features of each of the above disclosures, and of the various features of the embodiments described below, can be combined as suitable and desired.

Brief description of the figures

Embodiments will now be described by way of example only with reference to the accompanying figures in which:

2019100694 25 Jun 2019

Figure 1 shows a photograph of an example of a credential.

Figure 2 shows a schematic diagram of an embodiment of a system for writing credential information on a credential, and an example credential.

Figure 2a shows another schematic diagram the system of figure 2.

Figure 3 shows a schematic diagram of a credential interface device of the system of figure 2, and the example credential.

Figure 4 shows an isometric view of the credential interface device of the system of figure 2.

Figure 5 shows another schematic diagram of the system of figure 2.

Description of embodiments

Figure 2 shows an embodiment of a system for writing credential information on a credential, the system and credential being generally indicated by the numerals 10 and 14 respectively. The system 10 comprises a credential interface device 12. The credential interface device 12 is configured to read identifier information indicative of an identifier stored in a memory 20 of the 15 credential 14. The credential interface device 12 is configured to send the identity information so read. The credential interface device 12 is configured to write credential information on the credential 14. The system 10 comprises a computing system 16 configured to receive the identifier information when so sent by the credential interface device 12. The computing system 16 is configured to send writing instructions to the credential interface device 12 that when executed by the credential interface device 12 cause the credential interface device 12 to write credential information associated with the identifier onto the credential 14.

The credential 14 takes the form of a smart card in accordance with the ISO/IEC 14443 type A 13.56 MHz contactless smart card standard as at 1 June 2019, however it may be in accordance with generally any suitable standard, for example the Global Platform Standard, a contact smart 25 card standard, and the Federal Information Processing Standard 201 (FIPS 201). The credential may alternatively be in the form of a key fob, a wearable in the form of a smart ring, smart bracelet or smart pendent, a smart phone or generally be in any suitable form. The credential 14 is an Aviation Security Identification Card (ASIC). ASICs are issued to people authorised to enter a secure area of a security controlled Australian airport. Examples of security controlled 30 Australian airports include but are not limited to Brisbane Airport, Sydney Airport and

2019100694 25 Jun 2019

Melbourne Airport. A secure area may be an airside security area, a landside security area, and/or a sterile area, for example.

The system 10 is generally located at a facility in the form of a security controlled Australian airport, however the system 10 may be generally used in any suitable form of facility, for example a corporate facility and public infrastructure in the form of a power station or water treatment facility, for example. In an example use of the system 10 at an airport, a person in the form of a flight crew member can present their ASIC 14 to the credential interface devices 12 at the security controlled Australian airport. The credential interface device 12 reads from memory 20 of the IC 22 of the ASIC f 4 identity information indicative of the identity of the flight crew member. The credential interface device 12 subsequently writes to the memory 20 credential information associated with the identifier and in this but not all embodiments the facility. Credential information associated with the facility can include cryptographic keys for the facility and necessary for an access control system to provide access. Subsequent to the credential information being written to the credential 14, the person can use the credential 14 to gain access to secure areas at the facility, for example by presenting the credential 14 to another credential interface of an airport access control system.

Figure 2a shows another schematic diagram of the system 10, showing that the credential interface device 12 is one of a plurality of credential interface devices. Embodiments may have one, more than one, 10, more than 10, 50, more than 50, 100, or more than 100 credential interface devices. The capacity of the computing system 16 can be increased to accommodate any desired number of credential interface devices, as required. The plurality of credential interface devices 12 may be disposed at the facility. A credential interface device 12 device may be, for example, at each gate of the international terminal and at each gate of the domestic terminal at an Airport, for example. Flight and cabin crew may use any one of the plurality of credential interface devices 12 on disembarking at a gate.

Figure 3 shows a schematic diagram of the credential interface device 12 and credential 14. The credential interface device 12 comprises a credential reader 18 in the form of a credential contactless reader which can communicate with the credential 14, including reading the memory 20 of the credential 14 (comprising a “credential encoding interface”), the memory 20 being generally integral with the credential’s IC 22 (e.g. a MIFARE branded ICs). The credential reader 18 can also write to the memory 20 (comprising a “credential decoding interface”). The credential reader 18 may comprise a MFRC630 near field communication reader for MIFARE branded ICs available from NXP Semiconductor, or generally any suitable contactless reader.

2019100694 25 Jun 2019

The MFRC630 or other credential reader may be used in accordance with manuals available from NXP Semiconductor. In an alternative and otherwise identical embodiment, the credential reader 18 may comprise a credential contact reader which can communicate with the credential 14 via electrical pads or electrical contacts on a credential surface, and yet other otherwise identical embodiments may comprise both a credential contactless reader and credential contact reader. The credential interface device 12 has a computer network interface 24 in accordance with the IEEE 802.3 (“Ethernet”) standard available 1 June 2019 (an “Ethernet network interface”), or alternatively the IEEE 802.11 (“Wi-Fi”) standard available 1 June 2019 (a “Wi-Fi network interface”). In use, the computer network interface 24 is in communication with a computer network in the form of a local area network (LAN) 38, which may be for example an

Ethernet LAN network, a Wi-Fi LAN network or generally any suitable form of computer network (e.g. WAN, USB etc.). The identifier information read from memory 20 by the credential interface device 12 is sent via the computer network interface 24 and the LAN 38.

The computing system 16 is also in communication with the computer network 38, for receiving 15 the sent identifier information and comprises at least one network interface for doing so.

Alternatively, the computing system 16 may be in communication with the credential interface device with a point-to-point connection, for example a serial connection.

Figure 4 shows an isometric view of the credential interface device 12, which is in the present but not necessarily in all embodiments is a self-service credential interface device in the form of 20 a kiosk having an optional electronic display 40 in the form of a touch screen. The credential interface device 12 is operable by the holder of the credential 14 without an additional operator.

In the present but not necessarily in all embodiments, the credential interface device 12 can additionally comprise:

• A power over Ethernet (PoE) interface · RS232, Relay, Weigand and USB interfaces • A processor in the form of a central processing unit, and operating system software in the form of a MICROSOFT WINDOWS operating system, for example WINDOWS IOT or LINUX, and suitable program instructions for operation as described herein.

• A camera for recording of a user using the credential interface device 12 and/or facial recognition.

• A physical tamper switch for detecting tampering.

Figure 5 shows another schematic diagram of the system 10. The computing system 16 is a distributed computing system comprising a plurality of servers 30,32,34,36 each connected to a

2019100694 25 Jun 2019 local area network in the form of a Wi-Fi or Ethernet LAN 38. Table 1 below includes more details regarding computer servers and other components of computing system 16.

Table 1. Computer servers and other components of computing system 16.

Component	Description
Data store	The data store 43 is in the form of data storage on a secure cloud allowing airlines, for example, to upload their employees information. Alternatively, the data store may be on a data base cluster server 32, for example. Generally, any suitable data store may be used.
Access control system updater 45	This software runs on server 36 and regularly checks the data store for any changes, creating new entities, updating existing entities recorded in the access management system.
Credential interface device Server 30	This computer server sits between the access control system updater 36 and the plurality of credential interface devices 12 at the facility (e.g. airport). It can check the health of the plurality of credential interface devices 12, responds to queries from the plurality of credential interface devices 12, and checks the identity management system data.
Plurality of credential interface devices, for example 12 connected to LAN 38	Users interact by presenting their credentials to the credential reader 18 which can communicate with the credentials. Instructions and feedback to the user are displayed on electronic display 40.
Credential interface device application	An instance of this application runs on each of the credential interface devices 12 to interact with the users in order to encode credentials and provide instructions and feedback on the display 40. It communicates with the credential information device server 47 on server 36.

The computing system 16 may alternatively comprise virtual servers, virtual machines, or any number of servers, physical or virtual, in communication with the LAN 38, for example. There may be any number of software modules on any number of computing devices, for example computer servers.

When a credential 14 is tapped or passed over a credential reader 18 (for a contactless transaction), or inserted into a contact credential interface device (for a contact transaction):

• A unique identification (UID) is extracted from the credential 14 and is sent by the credential interface device 12 to the credential interface device server 30 o The credential interface device server 30 sends activation keys associated with the credential UID o The credential interface device server 30 writes data to relevant area of the credential 14 and secures with a facility encryption key.

o The credential interface device server 30 informs the access control system of a successful credential written to the credential 14.

2019100694 25 Jun 2019

The computing system 16 is configured to determine the credential information associated with the identifier so received. The computing system receives a request by the holder of the credential, for example, to write the credential 14 with credential information.

An authorised user can through client access machine 38 generate request information indicative of a request to write credential information to a credential 14. An authorised airline representative (e.g. an administrator in one of the airlines QANTAS, VIRGIN, etc) may use a user interface of the client access machine to generate the request information. The user may select an airline employee in a list of airline employees, and click on a button “Add credentials”, where after the client access machine 42 generates the request information and sends it the data store 43. The request information is in a computer readable file accompanied by digital photograph information of the employee.

In the present but not necessarily all embodiments, the access control system updater 45 has the following functions and/or features, however functions and/or features may be modified, added or omitted as suitable and/or desired:

· Data received in the file can be processed in batch;

• For each new entry received, a cardholder record can be created or updated in access control system 33.

For invalid, missing or incorrect format data, importing of a record can cease and errors can be added to a list in a summary email.

Other functions and/or features of the present but not necessarily all embodiments include:

• The success/failure of creation of each cardholder batch may be reported back to the requester, by email via email server 34 o Access credentials, keys and password are stored in encrypted form in a secure digital storage.

• The access control system software runs on a separate virtual machines.

• The updater software 36 checks and downloads data from the data storage 43 periodically, in the present but not all embodiments every 10 minutes, however shorter or longer periods may be used.

Any other error report is emailed to a nominated email address. The email server may be a SMTP, IMAP, POP3, or generally any suitable form of email server.

2019100694 25 Jun 2019

Credential interface device server 30 can perform the following functions and has the following features in the present but not necessarily all embodiments:

• Receives the card's identification number from a credential interface device 12, and o Checks if card's identification number exits in the access control system 33

Sends the required digital keys applicable to that particular card identification number back to credential interface device 12.

Credential interface device 12 applies the received digital keys to the credential (access card) 14.

· If the above was successful:

o Credential interface device server 30 receives a card activated message from the credential interface device

12.

o Server 30 updates Access Control System 33 record with

Card successfully encoded”.

• Otherwise i.e. applying the digital keys was unsuccessful o Credential interface device server 30 receives a card activation failed message from the credential interface device 12.

Otherwise i.e. card's identification number does not exist • Sends proper error report to the credential interface device 12.

Artificial intelligence algorithms may be used, which may improve data integrity and access management. The artificial intelligence algorithms can comprise, for example, business rules 25 comprising detecting attempts to encode card out-of-ordinary time or any other anomaly in user behaviour when attempting to encode a card.

The system 10 is configured to automatically detect the type of credential and in response write the credential with credential information. For example, the ASICs associated with some airlines are different than others, and the system 10 may detect the credential is issued by a particular airline. For some airline ASICs, the following can apply:

• On first presentation of a card to a credential interface device 12, the credential interface device detects the card is a type that needs alternative processing.

o The card credential interface device requests the digital keys from the credential interface server 30 o The card credential interface device applies digital keys on the card o performs writing to the card by performing the write protocol related to the type (e.g. make and model) of card.

ίο

2019100694 25 Jun 2019

A system for writing credential information on a credential, otherwise identical to that of figure 2, is configured for biometric identification. The card credential interface device captures a biometric signature from the user claiming to be the cardholder. Examples of the biometric signature include but are not limited to fingerprint, palm vein, iris, retina and face information.

The captured biometric information is digitized and transmitted to the credential interface server 30. The credential interface 30, verifies the biometric signature received, against a pre-recorded digital signature of the person in its database. On successful match of the two digital signatures, the above card activation protocol continues.

A system for writing credential information on a credential, otherwise identical to that of figure

2, is configured for two factor identification. This can be in the form of sending a one-time PIN via a short message service (SMS), for example, on the first presentation of the card to the user’s mobile telephone number, which may subsequently be entered on a user interface, for example touch screen, of the credential interface device 12.

The credential interface device 12, in this but not necessarily in all embodiments, is in communication with an access control system 33 for communicating an access request thereto when the credential is in communication with the credential interface device 12. The credential 14 holder may, for example, unlock doors, open gates or otherwise gain access by presenting their credential 14 to a credential interface device 12.

Now that embodiments have been described, it will be appreciated that some embodiments may 20 have some of the following advantages:

• A reduced number of staff may be required to update credentials.

• The chance for human error is reduced.

• Processes may be streamlined.

• Holders of credentials may spend less time updating credential information on their credentials.

Variations and/or modifications may be made to the embodiments described without departing from the spirit or ambit of the invention. For example, the steps of writing credentials are different for a differently configured system and access control system. The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive.

Reference to a feature disclosed herein does not mean that all embodiments must include the feature.

2019100694 25 Jun 2019

Prior art, if any, described herein is not to be taken as an admission that the prior art forms part of the common general knowledge in any jurisdiction.

In the claims which follow and in the preceding description of the invention, except where the context requires otherwise due to express language or necessary implication, the word “comprise” or variations such as “comprises or “comprising is used in an inclusive sense, that is to specify the presence of the stated features but not to preclude the presence or addition of further features in various embodiments of the invention.

Claims (5)

1. Claims

   1. A system for writing credential information onto a credential, the system comprising:

   a credential interface device configured to read identifier information indicative of an identifier stored in a memory of the credential and send the identifier information

   5 so read, and write credential information on receipt of credential information writing instructions into the memory;

   a computing system configured to receive the identifier information when so sent by the credential interface device, and send the credential information writing instructions to the credential interface device that when executed by the credential

   0 interface device causes the credential interface device to write the credential information associated with the identifier into the memory.
2. 2. A system defined by claim 1 wherein the computing system is configured to determine the credential information associated with the identifier so received, and send the credential information to the credential information device for writing the credential

   5 information onto the memory.
3. 3. A system defined by any one of the preceding claims configured to determine the type of credential and in response write the credential information to the memory in a format in accordance with the type of credential.
4. 4. A system defined by any one of the preceding claims comprising a plurality of credential

   0 interface devices, each of the plurality of credential interface devices being configured to read identifier information indicative of an identifier stored in the memory of the credential when in communication therewith and send the identifier information so read, and write credential information on receipt of the credential information writing instructions into the memory, wherein the computing system is configured to receive the 25 identifier information when so sent, and send the credential writing instructions to the credential interface device of the plurality of credential interface devices for which the identifier information was received.
5. 5. A method for writing credential information onto a credential, the method comprising:

   reading identifier information indicative of an identifier stored in a memory of the 30 credential;

   sending the identifier information;

   receiving credential information writing instructions; and

   2019100694 25 Jun 2019 writing the credential information as per the credential writing instructions into the memory.

   2019100694 25 Jun 2019