Policy-based physical security system for restricting access to computer resources and data flow through network equipment

• US 20080209505A1
• Filed: 08/14/2007
• Published: 08/28/2008
• Est. Priority Date: 08/14/2006
• Status: Active Grant

• Current Assignee: HID Global Corporation (Assa Abloy AB)
• Original Assignee: Quantum Secure Incorporated (Assa Abloy AB)
• Inventors: Jain, Ajay, Sharma, Shailendra, Ghai, Vikrant
• Granted Patent: US 9,111,088 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments are directed to systems and methods for integration and normalization of physical security data, states and events to and from disparate physical security systems to maintain in real-time rules based policy state information to enforce physical security policies uniformly across network and information technology (IT) systems. Moreover it pertains specifically to such apparatus for providing an integration platform, methods and processes for normalizing data from physical security systems, to maintain physical security states, mapping to network access and either directly affecting the network equipment through standard programming commands or providing interfaces for network equipment and IT applications to query and determine physical security access states thus enforcing rules in real-time based on security systems data and events.

Claims

1. A system comprising:

a plurality of network resources distributed throughout a site, each sensor configured to generate a signal in response to a defined event;

a central network device security management processor coupled to the plurality of network resources, configured to receive signals from each of the plurality of network resources, and normalize the signal data in accordance with a defined data mapping scheme;

a rules definition component defining physical security policies comprising actionable events definitions and responses to actionable events, the physical security policies comprising rules consisting of virtual objects representing network devices used by the plurality of network resources; and

a signal processing component applying the defined rules to the normalized signal data to invoke the defined responses to the actionable events.

2. The system of claim 1 wherein the network resources comprise network management systems for centralized alarm monitoring, event response, and application of policies for the protection of network resources.

3. The system of claim 1 wherein the network resources comprise subscriber and services provisioning systems for provisioning system users and assigning privileges and granting access to resources based on assigned privileges.

4. The system of claim 1 wherein the network resources comprise network services configured to prioritize network traffic and automatically respond to security events.

5. The system of claim 1 wherein the network resources comprise communication systems selected from the group consisting of:

telephonic communication, radio communication, and internet protocol (IP) communication.

6. A system comprising:

a physical security interface module interfacing to a plurality of security sensors distributed throughout a site, each sensor configured to respond to a corresponding type of actionable event;

a network interface module interfacing to a plurality of network resources distributed throughout a site;

a central network device security management processor coupled to the plurality of network resources, configured to receive signals from each of the plurality of network resources;

an integration module including an agent for each type of security sensor to accept command and data from each security sensor in a native format; and

a normalization module mapping the command and data from each security sensor in native format to a common format for the network resources and the security sensors.

7. The system of claim 6 wherein the plurality of sensor types comprise physical access, intrusion, and environmental conditions.

8. The system of claim 6 wherein the normalization module converts the native format for each security sensor into XML format.

9. The system of claim 6 further comprising a rules engine applying defined rules on the data and commands from each security sensor.

10. The system of claim 6 wherein the network resources comprise network management systems for centralized alarm monitoring, event response, and application of policies for the protection of network resources.

11. The system of claim 6 wherein the network resources comprise subscriber and services provisioning systems for provisioning system users and assigning privileges and granting access to resources based on assigned privileges.

12. The system of claim 6 wherein the network resources comprise network services configured to prioritize network traffic and automatically respond to security events.

13. The system of claim 6 wherein the network resources comprise communication systems selected from the group consisting of:

telephonic communication, radio communication, and internet protocol (IP) communication.

14. The system of claim 6 further comprising a visual editor component representing each normalized physical sensor as an object containing one or more attributes that define a spatial relationship to other objects through one or more defined rules.

15. A method of managing data and events related to information technology security, in a physical security management process comprising:

defining a first plurality of objects representing actors, facilities, and network resources within a managed site;

defining a second plurality of objects representing actions, conditions and references;

constructing a rule from the first plurality of objects and second plurality of objects through connectors that dictate process flow by the first and second plurality of objects;

receiving a plurality of signals from disparate security devices distributed throughout the site;

normalizing the plurality of signals to a common standard format; and

processing the signals through the rule to perform an action in accordance with the rule, wherein the action effects a change in one or more settings for the network resources.

16. The method of claim 15 wherein the rule is constructed using a graphical visual policy editor.

17. The method of claim 15 wherein the rule dictates a response to a physical intrusion event, and wherein the action is selected from the group consisting of:

generating an alarm, providing an alert to official personnel, or preventing access to areas of the site.

18. The method of claim 15 wherein the rule dictates a network backup action within the network resources.

19. The method of claim 15 wherein the action comprises one of:

restricting access of personnel to one or more devices of the network resources.

20. The method of claim 15 wherein the disparate security devices are selected from the group consisting of:

proximity alarms, infrared detectors, motion sensors, smoke detectors, bar code readers, and biometric sensors.