Physical access control and security monitoring system utilizing a normalized data format

• US 8,234,704 B2
• Filed: 08/14/2007
• Issued: 07/31/2012
• Est. Priority Date: 08/14/2006
• Status: Active Grant

• Current Assignee: HID Global Corporation (Assa Abloy AB)
• Original Assignee: Quantum Security Incorporated
• Inventors: Ghai, Vikrant, Sharma, Shailendra, Jain, Ajay
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): King, John B
• Application Number:
  US11/893,057
• Publication Number:
  US 20080209506A1
• Time in Patent Office: 1,813 Days
• Field of Search: 726/1, 726/16, 713/168, 713/182, 707/19
• US Class Current: 726/16
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition

Abstract

Embodiments disclose a system and method for the integration of data and events to and from physical access control and security monitoring systems that is normalized to standardized definition for enforcement of standardized rules, created through a visual policy editor, affecting persistence, propagation of data and generation of alerts and notifications for physical security, network and IT systems. Data from disparate physical security systems is normalized for visual rule creation by rule object shapes representing normalized security systems, data and processes. A rules-based policy engine enforces security policies and generates actionable events. The overall system provides an integration platform, methods and processes for normalizing data from physical security systems, representation of physical security systems, data and processes for visual creation of rules using defined stencil objects, generating formatted rules, and enforcing these rules in real-time on security systems data and events.

Claims

1. A system comprising:

a plurality of security sensors distributed throughout a plurality of sites, each sensor configured to generate a sensor signal in response to a defined event, wherein the sensor signal is provided in a native format proprietary to a manufacturer of the respective sensor;

a central security management processor coupled to the plurality of security sensors, configured to receive sensor signals from each of the plurality of security sensors and configured to manage individual user profiles and their respective access privileges and credentials in the system;

a normalization module configured to normalize the sensor signal data in accordance with a defined data mapping scheme by mapping the sensor signal data from each security sensor in the native format of each manufacturer to a common format, the common format including a data object and processing information for the sensor signal, the normalization module further configured to generate unique physical access privileges and credentials to exclusively map a user'"'"'s profile to a spatial hierarchy of physical sites along with security devices of the system, wherein the unique physical access credentials maintain a common representation of the user'"'"'s identity across the plurality of sites and to associate specific user identities with respective actionable events;

a visual policy manager having a rules definition component configured to define, at design time, physical security policies in the context of user profiles at all sites through actionable representations of physical, network and information technology resources of the sites, wherein the security policies define standardized rule definitions through visual rules depicted by live objects that contain attributes to define their spatial relationship to the actionable representations, and that are applied to the actionable events normalized to the common format to produce normalized event data; and

a signal processing component applying, at run time, the defined standardized rules comprising condition-action sequences including relevant transformation and routing rules to the normalized signal data and to invoke the defined responses to the actionable events in order to maintain user profiles and physical security states across the plurality of sites and to resolve the actionable events through the associated specific user identities.

2. The system of claim 1 wherein the plurality of sensors comprise intrusion sensors, physical access sensors, and environmental sensors, and wherein the defined responses comprise at least one of generating an audible alarm, notifying authority personnel, initiating lockdown mode of the site, initiating computer backup and shutdown procedures, and facilitating exit from the site.

3. The system of claim 2 wherein the plurality of sensors are selected from the group consisting of:

proximity alarms, infrared detectors, motion sensors, smoke detectors, bar code readers, and biometric sensors, and wherein the native format encompasses native sensor data including text data and binary data represented in the proprietary manufacturer format, and wherein the native sensor data includes at least one of a command or sensor state information.

4. The system of claim 1 wherein the physical security policies comprise rules consisting of virtual objects representing personnel and physical assets of the site and events involving the personnel and physical assets, wherein each rule has an associated action and one rule is applied at a time to the normalized event data in a sequential order dictated by one of a defined rule execution order or a top to bottom order based on event time.

5. The system of claim 4 wherein the rules are constructed using a graphical visual policy editor comprising a web-based online graphical editor, the graphical editor including a drag and drop graphical user interface component that facilitates creation of rules through interconnection of rule objects and definition of rule properties.

6. A system comprising:

an interface circuit interfacing to a plurality of security sensor types distributed throughout a plurality of sites, each sensor type configured to respond to a corresponding type of actionable event, each sensor type provided by a different manufacturer of a plurality of manufacturers;

an integration circuit including a processing agent for each type of security sensor to accept sensor data from each security sensor in a native data representation format of each respective manufacturer of the plurality of manufacturers;

a central security management processor coupled to the integration circuit and configured to manage individual user profiles and their respective access privileges and credentials in the system;

a normalization circuit mapping the sensor data from each security sensor in the native data representation format of each manufacturer of the plurality of manufacturers to a common data representation format, the common data representation format including a data object and processing information for the sensor data, the normalization circuit further configured to generate unique physical access privileges and credentials to exclusively map a user'"'"'s profile to a spatial hierarchy of physical sites along with security devices of the system, wherein the unique physical access credentials maintain a common representation of the user'"'"'s identity across the plurality of sites and to associate specific user identities with respective actionable events;

a visual policy manager circuit defining, at design time, physical security policies in the context of user profiles at all sites through actionable representations of physical, network and information technology resources of the sites, wherein the security policies define standardized rule definitions through visual rules depicted by live objects that contain attributes to define their spatial relationship to the actionable representations, and that are applied to the actionable events normalized to the common data representation format to produce normalized event data; and

a signal processing circuit receiving the normalized event data and applying, at run time, relevant transformation and routing rules comprising condition-action sequences in order to maintain user profiles and physical security states across the plurality of sites and to resolve the actionable events through the associated specific user identities.

7. The system of claim 6 wherein the plurality of sensor types comprise physical access, intrusion, and environmental conditions, and wherein the action events comprise at least one of generating an audible alarm, notifying authority personnel, initiating lockdown mode of the site, initiating computer backup and shutdown procedures, and facilitating exit from the site.

8. The system of claim 6 wherein the normalization module converts the native data representation format for each security sensor into XML (Extensible Markup Language) format, and wherein the native data representation format encompasses native sensor data including text data and binary data represented in a proprietary format, and wherein the native sensor data includes at least one of a command or sensor state information.

9. The system of claim 6 further comprising a rules engine applying defined rules on the data and commands from each security sensor, wherein each rule has an associated action and one rule is applied at a time to the normalized event data in a sequential order dictated by one of a defined rule execution order or a top to bottom order based on event time.

10. The system of claim 6 further comprising a visual editor component representing each normalized physical sensor as an object containing one or more attributes that define a spatial relationship to other objects through one or more defined rules, the visual editor including a drag and drop graphical user interface component that facilitates creation of rules through interconnection of rule objects and definition of rule properties.

11. A method comprising:

interfacing in a centralized security system, a plurality of security sensor types distributed throughout a plurality of sites, each sensor type configured to respond to a corresponding type of actionable event, each sensor type provided by a different manufacturer of a plurality of manufacturers;

accepting sensor data from each security sensor an integration module including an agent for each type of security sensor, wherein the sensor data from each security sensor is embodied in a native data representation format of each respective manufacturer of the plurality of manufacturers;

defining individual user profiles and their respective access privileges and credentials in the system;

mapping the sensor data from each security sensor in the native data representation format of each manufacturer of the plurality of manufacturers to a common data representation format, the common data representation format including a data object and processing information for the sensor data;

generating unique physical access privileges and credentials to exclusively map a defined user profile to a spatial hierarchy of physical sites along with security devices of the system, wherein the unique physical access credentials maintain a common representation of the user'"'"'s identity across the plurality of sites and to associate specific user identities with respective actionable events;

defining physical security policies of the site in the context of user profiles at all sites through actionable representations of physical, network and information technology resources of the site, wherein the security policies define standardized rule definitions through visual rules depicted by live objects that contain attributes to define their spatial relationship to the actionable representations, and that are applied to the actionable events normalized to the common data representation format to produce normalized event data; and

receiving the normalized event data and applying relevant transformation and routing rules comprising condition-action sequences in order to maintain user profiles and physical security states across the plurality of sites and to resolve the actionable events through the associated specific user identities.

12. The method of claim 11 wherein the plurality of sensor types comprise physical access, intrusion, and environmental conditions, and wherein the action events comprise at least one of generating an audible alarm, notifying authority personnel, initiating lockdown mode of the site, initiating computer backup and shutdown procedures, and facilitating exit from the site.

13. The method of claim 11 further comprising converting the native data representation format for each security sensor into XML (Extensible Markup Language) format, and wherein the native data representation format encompasses native sensor data including text data and binary data represented in a proprietary format, and wherein the native sensor data includes at least one of a command or sensor state information.

14. The method of claim 11 further comprising applying, through a rules engine, defined rules on the data and commands from each security sensor, wherein each rule has an associated action and one rule is applied at a time to the normalized event data in a sequential order dictated by one of a defined rule execution order or a top to bottom order based on event time.

15. The method of claim 11 further comprising representing, through a visual editor, each normalized physical sensor as an object containing one or more attributes that define a spatial relationship to other objects through one or more defined rules, the visual editor including a drag and drop graphical user interface component that facilitates creation of rules through interconnection of rule objects and definition of rule properties.