System and method for providing configurable security monitoring utilizing an integrated information system

• US 7,627,665 B2
• Filed: 04/03/2001
• Issued: 12/01/2009
• Est. Priority Date: 09/28/2000
• Status: Expired due to Term

• Current Assignee: Vivint Incorporated (NRG Energy, Inc.)
• Original Assignee: Vig Acquisitions Ltd LLC (Intellectual Ventures LLC)
• Inventors: Andersen, Claire, Bahneman, Liem, Barker, Geoffrey T., Alexander, Bruce
• Primary Examiner(s): Bruckart; Benjamin R
• Application Number:
  US09/825,506
• Publication Number:
  US 20020143934A1
• Time in Patent Office: 3,164 Days
• Field of Search: 709223-229, 709217-219, 340504-519, 340540-567, 713/200, 707/200, 348148-153, 702/188, 715/736
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/18 Delegation of network management function, e.g. customer network management [CNM]
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/08 specially adapted for terminal emulation, e.g. Telnet
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method for implementing an integrated information system are provided. A premises server is in communication with a variety of information sources that produce monitoring data for a premises. The premises server collects, presents, and transmits the monitoring device data to a central server capable of processing data from multiple premises servers. The central server receives the data and traverses one or more logical rule sets to determine whether the inputted data violates the rules. Based on an evaluation of the rules, the central server generates outputs in the form of communication to one or more authorized users via a variety of communication mediums and devices and/or the instigation of a variety of acts corresponding to the evaluation of the rules.

Claims

1. In an integrated information system including a central server in communication with premises servers that are associated with two or more geographically distinct sites, a method for processing monitoring device data, the method comprising:

obtaining monitoring device data at the premises servers that are associated with the two or more geographically distinct sites, wherein the monitoring device data corresponds to two monitoring devices with at least one monitoring device at each geographically distinct site wherein the monitoring device data is obtained continuously;

at the premises servers, characterizing the monitoring device data as at least one of asset data, resource data, and event data;

transmitting the monitoring device data and characterization data from the premises servers to the central server;

obtaining one or more monitoring rules at the central server corresponding to the at least one monitoring device, wherein the one or more rules establish the thresholds of monitoring device data that define a rule violation and wherein obtaining one or more rules includes at least one of;

obtaining asset rules if the monitoring device data is characterized as asset data;

obtaining resource rules if the monitoring device data is characterized as resource data; and

obtaining device rules if the monitoring device data is characterized as event data;

processing the monitoring device data at the central server according to the monitoring rules to determine whether a rule violation occurred wherein a rule violation identifies a combination of thresholds for each of the two monitoring devices;

wherein processing the monitoring device data according to the rules includes determining whether the monitoring device data exceeds thresholds of security information indicative of whether an unauthorized access to a premises has occurred; and

generating an output corresponding to the processing of the monitoring device data, wherein the output indicates whether a rule violation occurred;

characterizing the monitoring device data as asset data, resource data or event data;

wherein asset data includes data from an identifiable object that is not capable of independent action;

wherein resource data includes data from an object capable of independent action; and

wherein event data includes data from a device having a defined state.

2. The method of claim 1, wherein the monitoring device data is characterized as asset data and device data.

3. The method of claim 1, wherein the monitoring device data is characterized as resource data and device data.

4. The method of claim 1, wherein the device rules establish a state threshold for a rule violation, and wherein processing the monitoring device data according to the device rules includes determining whether the monitoring device data indicates a particular state.

5. The method of claim 4, wherein the monitoring device data is motion detection data and wherein the device rule threshold is the detection of motion.

6. The method of claim 1, wherein characterizing the monitoring device data comprises determining whether the monitoring device data includes data identifying a monitoring device generating the data.

7. The method of claim 6, wherein characterizing the monitoring device data as asset data further includes comparing the data identifying the monitoring device generating the monitoring device data to a set of known assets.

8. The method of claim 7, wherein the set of known assets are maintained in a database.

9. The method of claim 6, wherein characterizing the monitoring device data as resource data further includes comparing the data identifying the monitoring device generating the monitoring device data to a set of known resources.

10. The method of claim 9, wherein the set of known resources are maintained in a database.

11. The method of claim 1, wherein generating an output corresponding to the processing of the monitoring device data includes generating a communication to one or more designated users, wherein generating the communication includes identifying a hierarchy that prioritizes the communication to the one or more designated users.

12. The method of claim 11, wherein generating an output to one or more designated users includes:

obtaining a schedule of preferred notification methods; and

selecting a notification method from the schedule of notification methods.

13. The method of claim 12, wherein the schedule of preferred notification methods includes an indication of one or more preferred communication methods based on a time of day.

14. The method of claim 12, wherein each designated user is associated with a schedule of preferred notification methods.

15. The method of claim 11, wherein generating a communication to one or more designated users includes generating a wireless communication to a designated user.

16. The method of claim 1, wherein generating an output corresponding to the processing of the monitoring device data includes initiating an action at a geographically distinct site where the monitoring data was obtained.

17. The method of claim 16, wherein the action includes activating a physical device within a monitored premises.

18. The method of claim 17, wherein the physical device generates a an output in a tangible medium.

19. The method of claim 17, wherein the physical device is an audible alarm.

20. The method of claim 17, wherein the physical device is a microphone and speaker assembly.

21. The method of claim 1, wherein generating an output corresponding to the processing of the monitoring device data includes processing one or more additional monitoring device rules prior to generating an output.

22. The method of claim 1, wherein the at least one monitoring device includes a network access monitor and wherein the monitoring device includes data identifying one or more users logged into a computer network.

23. The method of claim 1, wherein the at least one monitoring device includes a movement sensor and wherein the monitoring device data includes data identifying whether an individual has passed through a monitored area.

24. The method of claim 23, wherein the monitoring device data further includes data identifying a particular individual passing through the monitored data.

25. The method of claim 1, wherein the at least one monitoring device includes a number of monitoring devices and wherein the monitoring device data includes data identifying the location of individuals within a premises.

26. The method of claim 25, wherein the monitoring device data further identifies the identities of individuals within the premises.

27. The method of claim 26, wherein generating an output corresponding to the processing of the monitoring device data includes generating an output dedicated to a particular individual identified within the premises.

28. The method of claim 1, wherein obtaining monitoring device data from at least one monitoring device includes obtaining the monitoring device data from a distributed communication network.

29. A computer readable medium having computer-executable instructions for performing the method recited in claim 1.

30. A computer system having a processor, a memory and an operating environment, the computer system operable to perform the method recited in claim 1.

31. A system for implementing an integrated information system, the system comprising:

one or more monitoring devices corresponding to two or more geographically distinct sites organized according to geographic criteria and operable to continuously transmit monitoring device data;

one or more premises servers operable to obtain the monitoring device data from the one or more monitoring devices, characterize the monitoring device data as at least one of asset data, resource data, and event data, transmit the monitoring device data and characterization data to the central processing server;

a central processing server, the central processing server operable to continuously obtain the monitoring device data originating from at least one monitoring device at each of the two or more geographically distinct sites;

wherein the central processing server processes the monitoring device data according to one or more monitoring device rules corresponding to the one or more monitoring devices organized according to geographic criteria, wherein the central processing server generates an output corresponding to the processing, wherein the output reflects the results of processing the monitoring device data according to the rules;

wherein the processing of monitoring device data performed by the central processing server includes determining whether the monitoring device data exceeds thresholds of security information indicative of whether an unauthorized access to a premises has occurred; and

wherein the processing of monitoring device data performed by the central processing server includes at least one of;

obtaining asset rules if the monitoring device data is characterized as asset data that is from an identifiable object incapable of independent action;

obtaining resource rules if the monitoring device data is characterized as resource data from an object capable of independent action;

obtaining device rules if the monitoring device data is characterized as event data from a device having a defined state; and

wherein the monitoring device rules identify a combination of thresholds for the monitoring device data that define a rule violation.

32. The system as recited in claim 31 further comprising at least one premises server in communication with at least one of the monitoring devices and with the central processing server, wherein the premises server is operable to obtain the monitoring device data from the monitoring device and to transmit the monitoring device data to the central processing server.

33. The system as recited in claim 32, wherein the at least one premises server includes two or more premises servers connected in parallel to each other.

34. The system as recited in claim 31, further comprising one or more rules databases for maintaining the monitoring device rules.

35. The system as recited in claim 34, wherein the one or more rules databases include an event rules database for maintaining monitoring device rules corresponding to event data.

36. The system as recited in claim 34, wherein the one or more rules databases include an asset rules database for maintaining monitoring device rules corresponding to asset data.

37. The system as recited in claim 34, wherein the one or more rules databases include a resource rules database for maintaining monitoring device rules corresponding to resource data.

38. The system as recited in claim 31 further comprising one or more output devices in communication with the central processing server, wherein the output devices are operable to obtain an output from the central processing server.

39. The system as recited in claim 38, wherein the output devices include an audible alarm.

40. The system as recited in claim 38, wherein the output devices include a speaker and microphone assembly.

41. The system as recited in claim 31, wherein one or more of the monitoring devices communicate with the central processing server via a data network.

42. The system as recited in claim 41, wherein the data network is the Internet.

43. The system as recited in claim 41, wherein the data network is a distributed data network.

44. A system for implementing an integrated information system, the system comprising:

one or more monitoring devices corresponding to two or more geographically distinct sites organized according to geographic criteria and operable to continuously transmit monitoring device data;

one or more premises means operable to obtain the monitoring device data from the one or more monitoring devices, characterize the monitoring device data as at least one of asset data, resource data, and event data, transmit the monitoring device data and characterization data to the central processing means;

a central processing means, the central processing means operable to continuously obtain the monitoring device data originating from at least one monitoring device at each of the two or more geographically distinct sites;

wherein the central processing means processes the monitoring device data according to one or more monitoring device rules corresponding to the one or more monitoring devices organized according to geographic criteria, wherein the central processing means generates an output corresponding to the processing, wherein the output reflects the results of processing the monitoring device data according to the rules;

wherein the processing of monitoring device data performed by the central processing means includes determining whether the monitoring device data exceeds thresholds of security information indicative of whether an unauthorized access to a premises has occurred; and

wherein the processing of monitoring device data performed by the central processing means includes at least one of;

obtaining asset rules if the monitoring device data is characterized as asset data that is from an identifiable object incapable of independent action;

obtaining resource rules if the monitoring device data is characterized as resource data from an object capable of independent action;

obtaining device rules if the monitoring device data is characterized as event data from a device having a defined state; and

wherein the monitoring device rules identify a combination of thresholds for the monitoring device data that define a rule violation.

45. The system as recited in claim 44 further comprising data communication means in communication with at least one monitoring device and with the central processing means, wherein the data communication means obtains monitoring device data from the monitoring device and transmits the data to the central processing means.

46. The system as recited in claim 45, wherein the communications means include parallel processing means obtaining and for data transmitting.

47. The system as recited in claim 44, further comprising means for maintaining the monitoring device rules.

48. The system as recited in claim 47, wherein the means for maintaining the monitoring device rules include means for maintaining monitoring device rules corresponding to event data.

49. The system as recited in claim 47, wherein the means for maintaining the monitoring device rules include means for maintaining monitoring device rules corresponding to asset data.

50. The system as recited in claim 47, wherein the means for maintaining the monitoring device rules include means for maintaining monitoring device rules corresponding to resource data.

51. The system as recited in claim 44 further comprising one or more output device means for obtaining outputs from the central processing means.

52. The system as recited in claim 44, wherein one or more of the monitoring devices communicate with the central processing means via data network means.

53. The system as recited in claim 52, wherein the data network means include a distributed data network means.