Apparatus and method for access control

• US 9,286,741 B2
• Filed: 09/11/2012
• Issued: 03/15/2016
• Est. Priority Date: 10/18/2011
• Status: Active Grant

• Current Assignee: Axis AB (Canon Inc.)
• Original Assignee: Axis AB (Canon Inc.)
• Inventors: Adolfsson, Johan, Sagefalk, Willy
• Primary Examiner(s): Barakat, Mohamed
• Application Number:
  US13/609,993
• Publication Number:
  US 20130093563A1
• Time in Patent Office: 1,281 Days
• Field of Search: 340 51- 586
• US Class Current: 1/1
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G07C 9/00182 operated with unidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/00309 operated with bidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07C 9/32 in combination with an identity check
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04M 2203/6045 Identity confirmation
• CPC Class Codes: H04W 12/08 Access security

Abstract

A method and apparatus for controlling access from a first area to a second area includes receiving an identity signal from an identifier input device, and checking for stored data indicating that the identity represented by the identity signal is registered as present in the first area. If a predetermined access requirement is fulfilled, then a pass signal at the first access controller is generated. To control access from the second area to a third area, an enter message is sent to a second controller with at least the identity and data indicating that the identity is present in an access area of the second controller. An exit message is sent to a third controller controlling access to the first area, including at least the identity and data indicating that the identity is not present in an access area of the third controller.

Claims

1. A method for controlling access from a first area to a second area, the method comprising:

receiving, at a first access controller controlling access from the first area to the second area, an identity signal from an identifier input device;

checking, in a memory of the first access controller, for data indicating that an identity represented by the identity signal is registered as present in the first area;

if the identity is registered as present in the first area, then determining that one access criterion is fulfilled;

determining a predetermined access requirement is fulfilled, responsive to at least fulfilment of said one access criterion, to then perform the following acts;

generating a pass signal at the first access controller granting passage from the first area to the second area;

sending an enter message from the first access controller to a second access controller controlling access from the second area, the enter message including at least the identity and data indicating that an entity associated with the identity is present in the second area, wherein the enter message identifies an access area into which the entity associated with the identity is about to enter; and

sending an exit message from the first access controller to a third access controller controlling access to the first area, the exit message including at least the identity and data indicating that the entity associated with the identity is not present in the first area,

wherein the enter message and the exit message are separate messages; and

wherein the first access controller, the second access controller and the third access controller are connected in a distributed, non-centralized network.

2. The method according to claim 1, wherein the checking in the memory of the first access controller is performed by the first access controller.

3. The method according to claim 1, wherein the method further comprises receiving an entering confirmation signal and wherein the sending of the enter message and the sending of the exit message is performed by the first access controller in response to the receipt of the entering confirmation signal.

4. The method according to claim 1, wherein in response to the enter message the identity is registered at the second access controller and in response to the exit message the identity is deleted from the third access controller.

5. The method according to claim 1, wherein the enter message identifies a sender of the enter message.

6. The method according to claim 1, further comprising changing the registration of the identity to indicate that the identity is present in the second area after the identity has been found to be registered as present in the first area.

7. The method according to claim 1, further comprising generating a no pass signal at the first access controller if the predetermined access requirement is not fulfilled.

8. The method according to claim 1, further comprising receiving the enter message at the second access controller and registering, in response to the receipt of the enter message in a storage of the second access controller, the identity as being present in the second area.

9. The method according to claim 1, wherein the predetermined access requirement at least require fulfilment of one additional access criterion relating to a specific time period, wherein this criterion is fulfilled if an access attempt including the identity signal is performed within the specific time period.

10. The method according to claim 1, wherein the predetermined access requirement at least require fulfilment of one additional access criterion, wherein this criterion is fulfilled if an access attempt includes an identity signal allowing access to an access level equal to or higher than the access level of a passage being subject for the access attempt.

11. The method according to claim 1, wherein the identity requires at least two-factor authentication.

12. The method according to claim 11, wherein the two factors in the two-factor authentication is a code to be keyed in and a hardware identifier.

13. An access controller for controlling access from a first area to a second area, the access controller comprising:

an identity signal receiver arranged to receive identity signals from an identifier input device;

a processing unit configured to check if an access criterion is fulfilled, one access criterion being that an identity represented by identity signal is registered as being present in an area from where the identity signal is sent;

a memory configured to store data indicating all identities registered as present in the first area;

a pass signal generator configured to generate a pass signal in response to fulfilment of the access criterion;

a controller selector configured to select a second access controller controlling a passage from the second area to a third area and to select a third access controller controlling a passage to the first area;

an enter message transmitter configured to transmit an enter message to the selected second access controller controlling the passage from the second area, the enter message includes at least the identity and data indicating that an entity associated with the identity is present in the second area; and

an exit message transmitter configured to transmit an exit message to the selected third access controller controlling the passage to the first area, the exit message including at least the identity and data indicating that the entity associated with the identity is not present in the first area,

wherein the enter message and the exit message are separate messages.

14. The access controller according to claim 13, further comprising a no-pass signal generator configured to generate a no-pass signal if the access criterion is not fulfilled.

15. The access controller according to claim 13, further comprising:

an enter message receiver configured to receive the enter message;

an exit message receiver configured to receive the exit message; and

a storage writer configured to adjust data in the memory using information from the received enter message and using information from the received exit message.

16. A method for controlling access from a first area to a second area, the method comprising:

receiving, at a first access controller controlling access from the first area to the second area, an identity signal from an identifier input device;

checking, in a memory of the first access controller, for data indicating that an identity represented by the identity signal is registered as present in the first area;

if the identity is registered as present in the first area, then determining that one access criterion is fulfilled;

determining a predetermined access requirement is fulfilled, responsive to at least fulfilment of said one access criterion, to then perform the following acts;

generating a pass signal at the first access controller granting passage from the first area to the second area;

retrieving, in the memory of the first access controller, an address of a second access controller controlling access from the second area;

sending an enter message to the second access controller controlling access from the second area, the enter message including at least the identity and data indicating that an entity associated with the identity is present in the second area;

retrieving, in the memory of the first access controller, an address of a third access controller controlling access to the first area; and

sending an exit message to the third access controller controlling access to the first area, the exit message including at least the identity and data indicating that the entity associated with the identity is not present in the first area,

wherein the enter message and the exit message are separate messages.

17. An access controller for controlling access from a first area to a second area, the access controller comprising:

an identity signal receiver arranged to receive identity signals from an identifier input device;

a processing unit configured to check if an access criterion is fulfilled, one access criterion being that an identity represent by identity signal is registered as being present in an area from where the identity signal is sent;

a memory configured to store data indicating all identities registered as present in the first area;

a pass signal generator configured to generate a pass signal in response to fulfilment of the access criterion;

a controller selector configured to select a second access controller controlling a passage from the second area to a third area and to select a third access controller controlling a passage to the first area, the controller selector is further configured to retrieve, in the memory of the access controller, an address of the second access controller controlling the passage from the second area to the third area and an address of the third access controller controlling the passage to the first area;

an enter message transmitter configured to transmit an enter message to the selected second access controller controlling the passage from the second area to the third area, the enter message includes at least the identity and data indicating that an entity associated with the identity is present in the second area; and

an exit message transmitter configured to transmit an exit message to the selected third access controller controlling the passage to the first area, the exit message including at least the identity and data indicating that the entity associated with the identity is not present in the first area,

wherein the enter message and the exit message are separate messages.