Abstract: Methods and systems for securely communicating with an access control system are provided. The methods and systems establish, between first and second devices, a communication session based on a plurality of ephemeral keys. The methods and systems compute, by the first device, a shared session key as a function of a second public key of the second device and a sum of a first private key of the first device and a first ephemeral key of the plurality of ephemeral keys; and compute, by the second device, the shared session key as a function of a second private key of the second device and a sum of a first public key of the first device and a second ephemeral key of the plurality of ephemeral keys. The methods and systems exchange one or more messages securely between the first device and the second device using the shared session key.

Abstract: Methods and systems for establishing a system specific trust system are provided. The methods and systems establish a secure channel between a first device and a second device using a system specific trusted authority. The methods and systems determine, by the first device, using a first certificate associated with the second device, a first set of access rights of the second device and determine, by the second device, using a credential associated with the first device, a second set of access rights of the first device.

Abstract: Systems and methods may be used for authenticating and validating a credential for performing an action. A method may include using an access control device to exchange public keys with a user device. The method may include sending, to the user device, a first authentication cryptogram including a first signature, a public key certificate, and a Credential Trust Information (CTI), and receiving, from the user device, a second authentication cryptogram including a second signature, a public key of the user device, and a credential. The access control device may authenticate the user device based on the credential and the second signature The access control device may determine whether the credential received in the second authentication cryptogram is signed by a trusted credential issuer to validate the user device. The method may include causing the action to be performed.

Abstract: Methods and systems for establishing a system specific trust system are provided. The methods and systems establish a secure channel between a first device and a second device using a system specific trusted authority. The methods and systems determine, by the first device, using a first certificate associated with the second device, a first set of access rights of the second device and determine, by the second device, using a credential associated with the first device, a second set of access rights of the first device.

Abstract: Methods and systems for securely communicating with an access control system are provided. The methods and systems establish, between first and second devices, a communication session based on a plurality of ephemeral keys. The methods and systems compute, by the first device, a shared session key as a function of a second public key of the second device and a sum of a first private key of the first device and a first ephemeral key of the plurality of ephemeral keys; and compute, by the second device, the shared session key as a function of a second private key of the second device and a sum of a first public key of the first device and a second ephemeral key of the plurality of ephemeral keys. The methods and systems exchange one or more messages securely between the first device and the second device using the shared session key.

Abstract: Methods and systems for protecting user credentials from swapping attacks are provided. The methods and systems establish, between a first device and a second device, a communication session and receive, by the second device from the first device, a certificate associated with the first device. The methods and systems obtain credential selection information from the certificate associated with the first device and transmit a credential corresponding to the credential selection information from the second device to the first device.

Abstract: Methods and systems for communicating with an access control system preserving privacy are provided. The methods and systems establish, between a first device and a second device, a privacy key pair using a group generator, the privacy key pair comprising a privacy public key and a privacy private key, and compute, by the first and second devices, ephemeral key pairs based on the privacy key pair. The methods and systems establish a shared session key based on the ephemeral key pairs and transmit, by the first device to the second device, a message comprising a certificate of the first device using the shared session key that has been established based on the ephemeral key pairs.