Universal validation module for access control systems

• US 9,769,164 B2
• Filed: 06/23/2015
• Issued: 09/19/2017
• Est. Priority Date: 10/29/2009
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: McGeachie, John J.
• Primary Examiner(s): GIRMA, FEKADESELASS
• Application Number:
  US14/746,890
• Publication Number:
  US 20150317852A1
• Time in Patent Office: 819 Days
• Field of Search: 726 2, 726 7, 726 27, 726 1, 726 3, 726 6, 726 9, 726 4, 726 5, 726 8, 726 19, 726 20, 726 26, 726 28, 726 29, 340 56, 340 581, 340665, 3405457, 3405731, 340 565, 340 57, 340 583, 340 586
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G07C 2209/02 Access control comprising means for the enrolment of users
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

A validation module provides for the upgrading of a physical access control system (PACS) to full HSPD-12 compliance without requiring modification or replacement of the existing PACS. The validation module may contain all of the validation functionality required by federal specifications and technical requirements. The validation module may be installed between an existing PACS panel and a supported card/biometric reader. Readers may be selected based on assurance level requirements, e.g., contactless or contact readers for low and medium assurance level areas and full biometric readers for high assurance areas. The validation module may validate a card according to the assurance level setting, extract ID information from data on the card and then pass the ID information to the PACS panel for an access decision. Cardholder data captured by one validation module may be distributed to other validation modules of the PACS using a management station.

Claims

1. A method for accessing control system, comprising:

providing coupling to the access control system using modular communication interfaces that includes a first communication port that couples to at least one reader of the access control system and enables a validation device to receive cardholder data from the at least one reader and includes a second communication port that couples to an access decision component of the access control system and enables a validation device to send extracted ID information to the access decision component;

receiving cardholder data in connection with an access request at an access point controlled by the access control system;

validating the cardholder data using an Internet connection to access a remote revocation database that indicates if credentials corresponding to cardholder data have been revoked by authenticating the cardholder data according to an authentication mechanism;

after validation of the cardholder data, extracting ID information from the validated cardholder data; and

sending the extracted ID information to an access decision component of the access control system that determines whether access is granted for a cardholder corresponding to the extracted ID information.

2. The method according to claim 1, wherein the modular communication interfaces further include a third communication port that couples to a management station.

3. The method according to claim 2, further comprising:

exchanging information with the management station.

4. The method according to claim 1, wherein the authentication mechanism is at least one of:

cardholder unique identifier (CHUID), card authentication key (CAK), PIV authentication key (PKI), and biometric authentication (BIO).

5. The method according to claim 1, wherein validating the cardholder data includes performing certificate path discovery and validation to a trusted authority.

6. The method according to claim 1, further comprising:

performing enrollment processing for cardholder data that is identified as being used for a first time with the access control system.

7. The method according to claim 6, wherein the enrollment processing includes capturing and storing certificates of the cardholder data that is identified as being used for the first time.