Legacy access control security system modernization apparatus

• US 20070043954A1
• Filed: 08/17/2005
• Published: 02/22/2007
• Est. Priority Date: 08/17/2005
• Status: Active Grant

• Current Assignee: Common Credential Systems LLC
• Original Assignee: Common Credential Systems LLC
• Inventors: Fox, Christopher
• Granted Patent: US 7,669,054 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A system is provided for upgrading a legacy security system having a legacy control panel and a legacy card reader, without interfering with legacy system operation. A new control panel is installed between the legacy card reader and the legacy control panel. Also, a new token reader is installed next to the legacy card reader and connected to the new control panel. The new control panel passes credentials it receives from the legacy card reader to the legacy control panel, avoiding interference with legacy system operation. When the new control panel receives credentials from the new token reader, it evaluates them against an access rights list administered independently of the legacy access rights list. When the new control panel determines that an access request should be granted, it sends a memorized legacy credential associated with full access rights to the legacy control panel, causing it to open the door.

Claims

1. An apparatus for extending the functionality of a legacy security system that controls access to at least one portal, wherein:

said legacy security system comprises a plurality of legacy tokens, a legacy token reader and a legacy control panel,

each legacy token carries a legacy-system access key,

said legacy token reader and said legacy control panel are communicatively coupled together over first and second data channels,

said legacy token reader has first and second data channel outputs for connecting to said first and second data channels,

said legacy control panel has first and second data channel inputs for connecting to said first and second data channels, and

said legacy control panel is programmed to grant access to the portal in response to reading a serial data stream that carries an authorized legacy-system access key, said apparatus comprising;

a secondary token reader operable to communicate with secondary tokens containing secondary-system access keys;

a secondary control panel in communication with said secondary token reader, said secondary control panel having a legacy-reader interface, a legacy-controller interface, a memory, and a rights-management interface wherein

the legacy-reader interface is adapted for electrical connection to the first and second data channel outputs of the legacy token reader to enable communication with said legacy token reader,

the legacy-controller interface is adapted for electrical connection to the first and second data channel inputs of the legacy control panel to enable communication with said legacy control panel,

the memory is adapted to store an access rights list of secondary-system access keys associated with access rights to the portal,

the rights-management interface is adapted to accept programming input to update and manage said access rights list, and

the secondary control panel has an operational mode adapted to (a) transmit a memorized authorized legacy-system access key in response to an evaluation, using said access rights list, that a secondary-system access key received from a secondary token is associated with rights to access the portal, and (b) transmit any legacy-system access keys received from a legacy token to the legacy control panel without evaluation against said access rights list.

2. The apparatus of claim 1, wherein the secondary control panel has a learning mode for memorizing a legacy-system access key received from the legacy token reader.

3. The apparatus of claim 1, wherein said first and second data channels are dedicated to the communication of binary zeros and ones, respectively, of a common serial data stream.

4. The apparatus of claim 3, wherein the legacy-system access key is no more than 24 bits in length, and wherein the secondary-system access key comprises at least a 64-bit unique identifier.

5. The apparatus of claim 1, wherein the secondary-system tokens are operable to receive a challenge message from the secondary token reader and generate a message authentication code using a secure hash algorithm that uses the challenge message as an input.

6. The apparatus of claim 1, wherein the secondary token reader is adapted to mediate communications from the legacy token reader to the secondary control panel.

7. The apparatus of claim 1, wherein the secondary control panel also has supervised ajar, tamper, and request-to-exit inputs, and hosts a plurality of fully isolated high current solid state strike and auxiliary drivers, whereby to enable the secondary controller to function as a fully self-sufficient door controller.

8. A method of using a legacy control panel and a secondary control panel to regulate access to a doorway, the method comprising:

receiving an access credential from a token reader communicatively coupled to the secondary control panel;

using the secondary control panel to evaluate the access credential against an access rights list that is associated with the secondary control panel;

transmitting a memorized legacy access credential from the secondary control panel to the legacy control panel; and

using the legacy control panel to engage or disengage a lock mechanism to enable passage through the doorway.

9. The method of claim 8, further comprising:

configuring the secondary control panel to memorize a legacy access credential; and

causing the secondary control panel to memorize a legacy access credential to subsequently transmit to the legacy control panel when subsequent attempts are made to access the doorway.

10. The method of claim 8, wherein:

the access rights list associated with the secondary control panel is not recognized or processed by the legacy control panel;

the legacy control panel is associated with a legacy access rights list by which it recognizes the memorized legacy access credential; and

the legacy access rights list is distinct and independently administered from the access rights list associated with the secondary control panel.

11. The method of claim 10, wherein the access credential received from the token reader is a cryptographically secure access credential, but where the memorized legacy access credential is not cryptographically secure.

12. The method of claim 10, further comprising:

providing both a legacy token reader and a secondary token reader to provide access to the doorway, thereby enabling bearers of both legacy tokens and secondary tokens to access the doorway;

communicatively coupling both the legacy token reader and the secondary token reader to the secondary control panel; and

configuring the secondary control panel to receive a legacy access credential from the legacy token reader and re-transmit the legacy access credential, without functionally consequential alteration, to the legacy control panel, while continuing to evaluate access credentials received from the secondary token reader against the access rights list associated with the secondary control panel.

13. The method of claim 12, further comprising:

using an administrative system associated with the legacy control panel to create a legacy token having a legacy access credential;

assigning access rights to the legacy access credential and manifesting said access rights in the legacy access rights list;

configuring the secondary control panel to memorize the legacy access credential;

producing the legacy token to the legacy token reader;

transmitting the legacy access credential from the legacy token to the legacy token reader to the secondary control panel;

causing the secondary control panel to memorize the legacy access credential, whereby the secondary control panel is operable to subsequently transmit the legacy access credential to the legacy control panel when subsequent attempts are made to access the doorway using secondary tokens.

14. The method of claim 13, further comprising:

providing an administrator workstation to make rights changes and add and delete authorized credentials to a rights database;

providing a rights distribution server in communication with the secondary control panel to push updated access rights lists from the rights database to the secondary control panel;

providing an audit server and audit database to receive audit information tracking access attempts from the secondary control panel;

providing a monitoring workstation equipped with historical data analysis tools to evaluate the audit data maintained in the audit database; and

providing a report data server to receive audit data retrieval requests from the monitoring workstation and retrieve audit data from the audit database.

15. A method of upgrading a legacy security system having a legacy token reader with data-zero-bit and data-one-bit outputs, a legacy control panel with data-zero-bit and data-one-bit inputs, and data-zero-bit and data-one-bit wires connecting the legacy token reader'"'"'s data-zero-bit and data-one-bit outputs to the legacy control panel'"'"'s data-zero-bit and data-one-bit inputs, the method comprising:

installing a secondary control panel in proximity with the legacy control panel, wherein the secondary control panel has a data-zero-bit input, a data-one-bit input, a data-zero-bit output, a data-one-bit output;

disconnecting the data-zero-bit and data-one-bit wires from the legacy control panel'"'"'s data-zero-bit and data-one-bit inputs;

connecting the data-zero-bit and data-one-bit wires to the secondary control panel'"'"'s data-zero-bit and data-one-bit inputs;

running new wires from the secondary control panel'"'"'s data-zero-bit and data-one-bit outputs to the legacy control panel'"'"'s data-zero-bit and data-one-bit inputs;

installing a secondary token reader in proximity with the legacy token reader;

providing a communicative coupling between the secondary token reader and the secondary control panel; and

maintaining a communicative coupling between the legacy token reader and the secondary control panel.

16. The method of claim 15, wherein the secondary control panel has a key bus input for interfacing with the secondary token reader, and wherein the method of providing a communicative coupling between the secondary token reader and the secondary control panel comprises running a key bus wire, distinct from the data-zero-bit and data-one-bit wires, between the secondary token reader and the secondary control panel.

17. The method of claim 15, wherein the secondary token reader has a data-zero-bit input, a data-one-bit input, a data-zero-bit output, a data-one-bit output, the method further comprising:

disconnecting the data-zero-bit and data-one-bit wires from the legacy token reader'"'"'s data-zero-bit and data-one-bit outputs;

connecting the data-zero-bit and data-one-bit wires to the secondary token reader'"'"'s data-zero-bit and data-one-bit outputs; and

running new wires from the legacy token reader'"'"'s data-zero-bit and data-one-bit outputs to the secondary token reader'"'"'s data-zero-bit and data-one-bit inputs, whereby the secondary token reader mediates communications from the legacy token reader to the secondary control panel.

18. The method of claim 15, wherein the legacy token reader is installed in a public-access area, further comprising co-locating the secondary control panel with the legacy control panel in a secure area remote from the legacy token reader.

19. The method of claim 15, wherein the legacy security system includes both first and second legacy control panels communicatively coupled to first and second legacy token readers, respectively, the method further comprising:

interfacing the secondary control panel with the first legacy control panel, but not with the second legacy control panel; and

installing a key conversion module proximate the second legacy token reader, the key conversion module being operable to receive a secondary credential from a secondary token, extract a legacy credential from the secondary credential, and transmit the extracted legacy credential to the second legacy controller.

20. The method of claim 15, further comprising:

connecting the secondary control panel to a public communications network;

providing an administrator workstation to make rights changes and add and delete authorized credentials to a rights database;

providing a rights distribution server in communication with the secondary control panel to push updated access rights lists from the rights database to the secondary control panel;

providing an audit server and audit database to receive audit information tracking access attempts from the secondary control panel;

providing a monitoring workstation equipped with historical data analysis tools to evaluate the audit data maintained in the audit database; and

providing a report data server to receive audit data retrieval requests from the monitoring workstation and retrieve audit data from the audit database.