Assa Abloy Ab

Gemalto Sa

Gemalto Inc.

Hid Global Corporation

Kapil Sachdeva

Sylvain Jacques Prevost

HongQian Karen Lu

Ksheerabdhi Krishna

Asad Mahboob Ali

Apostol Vassilev

Jianbo Chen

Eric Fernand Le Saint

Philip Hoyer

Bertrand Du Castel

Matvey Mukha

Wayne Pak

Stephen Carney

Philip Hill

Systems and methods for providing secure execution of functions for edge devices include a plurality of edge devices, a controller, and an array of secure elements. The edge devices are each configured to obtain data for an application of the system. The controller is connected to communicate with the edge devices to receive the data from each of the edge devices. The array of secure elements is connected to the controller, and each secure element executes functions using the data received from the edge devices. The controller associates an identified secure element of the array of secure elements with a respective edge device to execute the functions for data received from the respective edge device, and the controller is connected to communicate a result of the executed functions to the respective edge device.

Secure element arrays in internet-of-things systems

This disclosure describes techniques for updating firmware of a secure element. The techniques include operations comprising: receiving, by a gateway device, from a remote source, a firmware file; receiving, by a processing element implemented on the gateway device, ephemeral session specific key material for a first secure element implemented on the gateway device; dividing the firmware file into a plurality of data chunks; applying, by the processing element, the ephemeral session specific key material to a first data chunk of the plurality of data chunks to generate a first data packet; and sending, by the processing element, the first data packet to the first secure element.

Methods and processes to securely update secure elements

Methods and systems for trajectory and intent prediction are provided. The methods and systems include operations comprising: receiving an observed trajectory of a user and user behavior information; processing the observed trajectory by a machine learning technique to generate a plurality of predicted trajectories, the machine learning technique being trained to establish a relationship between a plurality of training observed trajectories and training predicted trajectories; adjusting the plurality of predicted trajectories based on the user behavior information to determine user intent to operate a target access control device; determining that the target access control device within a threshold range of a given one of the plurality of predicted trajectories; and in response to determining that the target access control device is within the threshold range of the given one of the plurality of predicted trajectories, performing an operation associated with the target access control device.

Trajectory and intent prediction

A physical access control (PAC) system comprises an authentication device that includes physical layer circuitry and processing circuitry. The physical layer circuitry transmits and receives radio frequency electrical signals over a radio access network. The processing circuitry is operatively coupled to the physical layer circuitry and includes an authentication engine. The authentication engine is configured to receive access credential information via the radio access network using a cloud-based messaging service; authenticate the access credential information using the authentication device; and initiate access to a physical access portal according to the access credential information.

Physical access control systems and methods

An authentication engine, residing at one or more computing machines, receives, from a vision device comprising one or more cameras, a probe image. The authentication engine generates, using a trained facial classification neural engine, one or more first labels for a person depicted in the probe image and a probability for at least one of the one or more first labels. The authentication engine determines that the probability is within a predefined low accuracy range. The authentication engine generates, using a supporting engine, a second label for the person depicted in the probe image. The supporting engine operates independently of the trained facial classification neural engine. The authentication engine further trains the facial classification neural engine based on the second label.

Systems and methods for fine tuning image classification neural networks

A method and device for discovering, identifying, and configuring a particular one of a plurality of devices to be administered is described. The method and device facilitate these steps by eliminating the need for an administrator to know a specific MAC address or unique identifier for the device to be administered, and by eliminating the need to identify that specific MAC address or unique identifier in a list of MAC addresses or unique identifiers.

Discovering, identifying, and configuring devices with opaque addresses in the internet of things environment

Atomically modifying a personal security device includes presenting the personal security device to a reader/writer coupled to an access module, the access module determining if the personal security device includes a factory security mechanism, and, if the personal security device includes a factory security mechanism, using the reader/writer and the access module to replace the factory security mechanism with another security mechanism. The access module may authenticate the personal security device in connection with replacing the factory security mechanism. Authenticating the personal security device may grant access to a user through a door controlled by the access module. Replacing the factory security mechanism may include replacing an application on the personal security device. An ISO/IEC 7816-13 application management request command may be used to replace the application.

Field revisions for a personal security device

Method for providing user-to-user delegation service in federated identity environment, characterized in that it comprises a delegation or assignment step wherein a delegator specifies said delegation at an identity provider for delegating a privilege or task to a delegatee to be performed at a service provider.

User to user delegation service in a federated identity management environment

(EN)A system, method and computer-readable storage medium with instructions for operating a digital signature server and a portable security device to cooperate to provide digital signature services using a private key stored on the portable security device by delegating to a user's smart card the actual task of digitally signing documents. Other systems and methods are disclosed.

System and method for using a portable security device to cryptograhically sign a document in response to signature requests from a relying party to a digital signature service

A method of operating a host computer having a web-browser with the capability of executing at least one web-browser add-on to provide a web application access to a smart card to protect the smart card from security threats associated with being connected to the Internet. Prior to establishing a connection between a web application executing in the web browser, verifying that the web application has been authorized to connect to a smart care using the web-browser add-on to provide a web application access to a smart card.

System and method for providing security in browser-based access to smart cards

The invention relates to a portable authentication token comprising connection means for connecting to a computer, browser communication means for communicating with a browser running on the computer, and user authentication means for authenticating a user of the token to a server. The user authentication means are triggered via the browser communication means when the user connects to the server from the browser of the computer. The user authentication means are set to authenticate the user by communicating with the server through the browser. The token comprises out-of-band token communication means set to validate user authentication by establishing a communication channel between the token and the server, the communication channel bypassing the browser. The invention also relates to an authentication method and to a system comprising a token, a computer and a server to which the user authenticates with the token.

Method of preventing web browser extensions from hijacking user information

A system and a method for operating a device that is not capable of independently maintaining a local time clock to enforce a time-based transaction policy that requires a reliable time reference. The device establishes a secure communications channel to one or more network-attached time sources and inquires of each of the network-attached time-sources as to the current time using the secure communications channel. The device receives the current time from the network-attached time-sources and uses the received current times to estimate a current calendar time and to compute a reliability index associated with the estimated current calendar time. The device uses the estimated current calendar time and reliability index to enforce the time-based transaction policy.

Enforcing time-based transaction policies on devices lacking independent clocks

A client-side application extension executable on a host computer from within a web-browser having the capability of executing at least one web-browser add-on to provide a user access to a smart card, connected to the host computer having a smart card resource manager, via the web-browser. The web-browser extension has instructions to direct the central processing unit to access data on the smart card via a web-browser and platform independent interface module and a web-browser and platform dependent wrapper module connected to the web-browser and platform independent interface module and to the smart card resource manager having a function processing module operable to receive a call to the at least one function for accessing data on the smart card and for transforming the function call into a corresponding call to the smart card resource manager.

System and method for browser based access to smart cards

A system and method for establishing uniqueness in type definition names. Each application vendor has associated therewith a unique data sequence. The data sequence is combined with the type definition name and then a digital operation is performed to produce a unique digital identifier that is used in place of the type name.

Imparting digital uniqueness to the types of a programming language using a unique digital sequence

Updating the access control of a smart card at multiple points of the smart card life cycle. The system and method for updating the access control mechanisms during the smart card life cycle includes implementing an interface having a method for providing access control and a method for registering an access manager as an active access manager. In response to a request to register an access manager, the system and method executes the method for determining whether registering the access manager may be allowed.

Growing community of inventors

Austin, TX, United States of America

Kapil Sachdeva