APPARATUS AND METHOD FOR ACCESS CONTROL

• US 20130093563A1
• Filed: 09/11/2012
• Published: 04/18/2013
• Est. Priority Date: 10/18/2011
• Status: Active Grant

• Current Assignee: Axis AB (Canon Inc.)
• Original Assignee: Axis AB (Canon Inc.)
• Inventors: Adolfsson, Johan, Sagefalk, Willy
• Granted Patent: US 9,286,741 B2
• Time in Patent Office: Days
• US Class Current: 340/5.7
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G07C 9/00182 operated with unidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/00309 operated with bidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07C 9/32 in combination with an identity check
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04M 2203/6045 Identity confirmation
• CPC Class Codes: H04W 12/08 Access security

Abstract

A method and apparatus for controlling access from a first area to a second area includes receiving an identity signal from an identifier input device, and checking for stored data indicating that the identity represented by the identity signal is registered as present in the first area. If a predetermined access requirement is fulfilled, then a pass signal at the first access controller is generated. To control access from the second area to a third area, an enter message is sent to a second controller with at least the identity and data indicating that the identity is present in an access area of the second controller. An exit message is sent to a third controller controlling access to the first area, including at least the identity and data indicating that the identity is not present in an access area of the third controller.

Claims

1. A method for controlling access from a first area to a second area, the method comprising:

receiving, at a first access controller, an identity signal from an identifier input device;

checking in a memory of the first access controller for data indicating that the identity represented by the identity signal is registered as present in the first area;

if the identity is registered as present in the first area, then one access criterion is fulfilled;

if a predetermined access requirement, which requires at least fulfilment of one access criterion, is fulfilled, then the following acts are performed;

generating a pass signal at the first access controller;

sending an enter message to a second controller controlling access from the second area to a third area, the enter message including at least the identity and data indicating that the identity is present in an access area of the second controller; and

sending an exit message to a third controller controlling access to the first area, the exit message including at least the identity and data indicating that the identity is not present in an access area of the third controller.

2. The method according to claim 1, wherein the checking in the memory of the first access controller is performed by the first access controller.

3. The method according to claim 1, wherein the method further comprises receiving an entering confirmation signal and wherein the sending of an enter message and the sending of an exit message is performed by the first access controller in response to the receipt of the entering confirmation signal.

4. The method according to claim 1, wherein the enter message identifies the specific access area into which the identity is entering.

5. The method according to claim 1, wherein the enter message identifies the sender of the enter message.

6. The method according to claim 1, further comprising changing the registration of the identity to indicate that the identity is present in the second area after the identity has been found to be registered as present in the first area.

7. The method according to claim 1, further comprising generating a no pass signal at the first access controller if a predetermined access criterion is not fulfilled.

8. The method according to claim 1, further comprising receiving the enter message at the second controller and registering, in response to the receipt of the enter message and in a storage of the second controller, the identity as being present in an access area of the second controller.

9. The method according to claim 1, wherein the predetermined access requirement at least require fulfilment of one additional access criterion relating to a specific time period, wherein this criterion is fulfilled if an access attempt including the identity signal is performed within a specific time period.

10. The method according to claim 1, wherein the predetermined access requirement at least require fulfilment of one additional access criterion relating access levels, wherein this criterion is fulfilled if an access attempt includes an identity signal allowing access to an access level equal to or higher than the access level of a passage being subject for the access attempt.

11. The method according to claim 1, wherein an identity requires at least two-factor authentication.

12. The method according to claim 11, wherein the two factors in the two-factor authentication is a code to be keyed in and a hardware identifier.

13. An access controller for controlling access from a first area to a second area, the access controller comprising:

an identity signal receiver arranged to receive identity signals from an identifier input device;

a processing unit configured to check if an access criterion is fulfilled, one access criterion being that the identity of the identity signal is registered as being present in the area from where the identity signal is sent;

a memory configured to store data indicating all identities registered as present in the first area;

the processing unit further configured to check if an access requirement is fulfilled, wherein the access requirement at least includes one access criterion and require fulfilment of all included access criteria;

a pass signal generator configured to generate a pass signal in response to fulfilment of the access requirement;

a controller selector configured to select a controller controlling a passage from the second area and to select a controller controlling a passage to the first area;

a transmitter configured to transmit an enter message to the selected controller controlling the passage from the second area, the enter message includes at least the identity and data indicating that the identity is present in an access area of the second access controller; and

a transmitter configured to transmit an exit message to the selected controller controlling the passage to the first area, the exit message including at least the identity and data indicating that the identity is not present in an access area of the third controller.

14. The access controller according to claim 13, further comprising a no-pass signal generator configured to generate a no-pass signal if an access criterion is not fulfilled.

15. The access controller according to claim 13, further comprising:

a receiver configured to receive an enter message;

a receiver configured to receive an exit message; and

a storage writer configured to adjust data in the memory using information from an enter message and using information from an exit message.