Entry control system

• US 10,417,849 B2
• Filed: 08/27/2018
• Issued: 09/17/2019
• Est. Priority Date: 12/22/2003
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Fedronic, Dominique Louis Joseph, Wen, Wu
• Primary Examiner(s): Hailu, Teshome
• Application Number:
  US16/112,990
• Publication Number:
  US 20190088049A1
• Time in Patent Office: 386 Days
• Field of Search: 713172
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

An integrated security system which seamlessly assimilates with current generation logical security systems. The integrated security system incorporates a security controller having standard network interface capabilities including IEEE 802.x and takes advantage of the convenience and security offered by smart cards and related devices for both physical and logical security purposes. The invention is based on standard remote authentication dial-in service (RADIUS) protocols or TCP/IP using SSL, TLS, PCT or IPsec and stores a shared secret required by the secure communication protocols in a secure access module coupled to the security controller. The security controller is intended to be a networked client or embedded intelligent device controlled remotely by to an authentication server. In another embodiment of the invention one or more life cycle management transactions are performed with the secure access module. These transactions allow for the updating, replacement, deletion and creation of critical security parameters, cryptographic keys, user data and applications used by the secure access module and/or security token. In another embodiment of the invention a security access module associated with the security controller locally performs local authentication transactions which are recorded in a local access list used to update a master access list maintained by the authentication server.

Claims

1. A method for obtaining physical access to a protected location, the method comprising:

presenting a security token to communicate with a security controller of a physical access control system by a communication interface, the security token including memory that contains at least one critical security parameter;

causing the security controller to temporarily maintain a local access list of authenticated users that are granted access to the protected location using one or more predetermined critical security parameters, the security controller being in communication with a life cycle management server adapted to perform life cycle management functions related to the at least one critical security parameter contained in the security token;

providing the at least one critical security parameter from the security token to the security controller to authenticate the user by performing one or more authentication transactions based on the critical security parameters; and

permitting the security controller to send the local access list to an authentication server that updates a master access list maintained by the authentication server, wherein, based on a signal that the one or more authentication transactions successfully authenticate the user, an electromechanical circuit is activated to grant the user access to the protected location.

2. The method according to claim 1 wherein the local access list is sent to the authentication server via a secure communications connection.

3. The method according to claim 1 wherein the local access list is sent over an IEEE 802.x standard network arrangement.

4. The method according to claim 2 wherein the secure communications connection includes a shared secret established at the security controller which is securely maintained by a secure access module operatively coupled to the security controller.

5. The method according to claim 1 wherein the security controller is one of a plurality of security controllers, wherein the plurality of security controllers are networked clients of the authentication server.

6. The method according to claim 2 wherein at least a portion of the secure communications connection is established over a wireless telecommunications link.

7. The method according to claim 2 wherein the secure communications connection incorporates a security protocol including SSL, IPsec, PCT, TLS or RADIUS.

8. The method according to claim 1 wherein the critical security parameter is provided by the user and the one or more reference critical security parameters are operatively stored on the security token.

9. The method according to claim 2 wherein the secure communications connection incorporates a shared secret which is maintained by the authentication server and the security controller.