Entry control system

• US 9,898,878 B2
• Filed: 04/12/2017
• Issued: 02/20/2018
• Est. Priority Date: 12/22/2003
• Status: Expired due to Term

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Fedronic, Dominique Louis Joseph, Wen, Wu
• Primary Examiner(s): Hailu, Teshome
• Application Number:
  US15/485,274
• Publication Number:
  US 20170287243A1
• Time in Patent Office: 314 Days
• Field of Search: 713172
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

An integrated security system which seamlessly assimilates with current generation logical security systems. The integrated security system incorporates a security controller having standard network interface capabilities including IEEE 802.x and takes advantage of the convenience and security offered by smart cards and related devices for both physical and logical security purposes. The invention is based on standard remote authentication dial-in service (RADIUS) protocols or TCP/IP using SSL, TLS, PCT or IPsec and stores a shared secret required by the secure communication protocols in a secure access module coupled to the security controller. The security controller is intended to be a networked client or embedded intelligent device controlled remotely by to an authentication server. In another embodiment of the invention one or more life cycle management transactions are performed with the secure access module. These transactions allow for the updating, replacement, deletion and creation of critical security parameters, cryptographic keys, user data and applications used by the secure access module and/or security token. In another embodiment of the invention a security access module associated with the security controller locally performs local authentication transactions which are recorded in a local access list used to update a master access list maintained by the authentication server.

Claims

1. A method for physically controlling access to a protected location, comprising:

establishing a secure communications connection over a network between a security controller and an authentication server;

operatively coupling a security token to the security controller;

providing a critical security parameter to the security controller for authentication after using a token remote authentication application on the security token to verify the critical security parameter against one or more reference critical security parameters;

sending the critical security parameter to the authentication server via the secure communications connection;

performing an authentication transaction at the authentication server for the critical security parameter;

sending a result of the authentication transaction from the authentication server to the security controller via one of;

the secure communications connection or the security token; and

energizing an electromechanical circuit coupled to and controlled by the security controller if the result of the authentication transaction is successful.

2. The method according to claim 1 wherein the security controller and electromechanical circuit are in one integral unit.

3. The method according to claim 1 wherein the secure communications connection includes a shared secret established between the security controller and the authentication server which is securely maintained by a secure access module operatively coupled to the security controller.

4. The method according to claim 1 wherein the security controller is one of a plurality of security controllers, wherein the plurality of security controllers are networked clients of the authentication server.

5. The method according to claim 1 wherein at least a portion of the secure communications connection is established over a wireless telecommunications link.

6. The method according to claim 1 wherein the secure communications connection incorporates a security protocol including SSL, IPsec, PCT, TLS or RADIUS.

7. The method according to claim 1 wherein the security controller is in secure communications over the network with a life cycle management server.

8. The method according to claim 7 wherein the life cycle management server is adapted to perform life cycle management functions related to applications, critical security parameters or user data installed in either the security token or the secure access module.

9. The method according to claim 1 wherein the critical security parameter is provided by the user and the one or more reference critical security parameters are operatively stored on the security token.

10. The method according to claim 1 wherein the secure communications connection incorporates a shared secret which is maintained by the authentication server and the security controller.

11. A system for physically controlling access to a protected location, comprising:

an authentication server;

a security controller that establishes the secure communications connection with the authentication server;

a security token operatively coupled to the security controller, the security token sending a critical security parameter to the security controller for authentication after using a token remote authentication application on the security token to verify a user supplied critical security parameter against one or more reference critical security parameters; and

an electromechanical circuit that is coupled to and controlled by the security controller and that opens a physical access gateway when energized, wherein the security controller sends the critical security parameter to the authentication server via the secure communications connection and energizes the electromechanical circuit in response to an affirmative authentication result received from the authentication server.

12. The system according to claim 11 wherein the security controller and electromechanical circuit are in one integral unit.

13. The system according to claim 11 wherein the secure communications connection includes a shared secret established between the security controller and the authentication server which is securely maintained by a secure access module operatively coupled to the security controller.

14. The system according to claim 11 wherein the security controller is one of a plurality of security controllers, wherein the plurality of security controllers are networked clients of the authentication server.

15. The system according to claim 11 wherein at least a portion of the secure communications connection is established over a wireless telecommunications link.

16. The system according to claim 11 wherein the secure communications connection incorporates a security protocol including SSL, IPsec, PCT, TLS or RADIUS.

17. The system according to claim 11 wherein the security controller is in secure communications over the network with a life cycle management server.

18. The system according to claim 17 wherein the life cycle management server is adapted to perform life cycle management functions related to applications, critical security parameters or user data installed in either the security token or the secure access module.

19. The method according to claim 11 wherein the critical security parameter is provided by the user and the one or more reference critical security parameters are operatively stored on the security token.

20. The method according to claim 11 wherein the secure communications connection incorporates a shared secret which is maintained by the authentication server and the security controller.