EP2674922A1

EP2674922A1 - Protection at network element location

Info

Publication number: EP2674922A1
Application number: EP12305666.5A
Authority: EP
Inventors: Cedric Pontois; Fréderic Faucheux
Original assignee: Alcatel Lucent SAS
Current assignee: Alcatel Lucent SAS
Priority date: 2012-06-11
Filing date: 2012-06-11
Publication date: 2013-12-18

Abstract

For protecting physical access through a lock mechanism to a network element (NE) in a telecommunication network (TN), a system (LPS) coupled to the lock mechanism comprises an interface (INT) for checking information about whether the network element (NE) is connected or not to the telecommunication network (TN) and for checking information about a value of a software parameter (SP) indicating if the lock mechanism should be inhibited or not. The system activates an electromagnet for inhibiting the lock mechanism if the network element (NE) is connected to the telecommunication network (TN) and if the value of the software parameter (SP) indicates that the lock mechanism should be inhibited.

Description

FIELD OF THE INVENTION

The present invention relates to a protection at network element location, especially at a base station of a telecommunication network or at a data center.

BACKGROUND

In general, access to a connected site is done through a door using a lock controlled by a key. Current solution to lock a site is to use basic cylinder sash lock that is easy to force for example with a screwdriver resulting in many door alarms for operators.
There is therefore a need to improve physical access security to connected sites such as base stations or data centers.

SUMMARY

To remedy the problems referred to hereinabove, a system for protecting physical access through a lock mechanism to a network element in a telecommunication network, the system being coupled to the lock mechanism and comprising:

means for checking information about whether the network element is connected or not to the telecommunication network,
means for checking information about a value of a software parameter indicating if the lock mechanism should be inhibited or not,
means for inhibiting the lock mechanism if the network element is connected to the telecommunication network and if the value of the software parameter indicates that the lock mechanism should be inhibited.

Advantageously, the mechanical lock of the network element, for example a base station, is automatically inhibited once the communication is established with the operator network. In this manner operator will be able to re-activate the mechanical lock if on-site maintenance is needed. If the network communication is broken between operator and base station, the mechanical lock is by default active.
Furthermore, the system prevents breaking on network element like base station by forcing the door lock resulting in many less alarm for operators, hence a reduction of maintenance costs. By consequence, preventing open doors will avoid at least the following problems:

theft of hardware or other material present on site,
vandalism
overheating or too cooling of electronic boards,
rain falling inside the network element like base station resulting in short circuit and outage.

Today, for a network element like base station, the lock mechanism like the door cylinder sash lock is visible and easy to force with a screw driver. By inhibiting the sash lock (either by hiding it behind a metal plate or by mechanically disconnecting the sash), the process to force the base station will be really more complicated.
In an embodiment, means for inhibiting the lock mechanism is an electromagnet that is linked to the lock mechanism and cooperates with a metallic object preventing the lock mechanism to work.
In an embodiment, the electromagnet is powered on by the system to cooperate with the metallic object.
In an embodiment, the system is connected to a device able to command the system and to attribute the value of the software parameter.
In an embodiment, the network element is a base station or a data center.
In an embodiment, physical access to the network element is access to a room inside the network element where hardware or electronic devices are located.
A further object of the invention is method for protecting physical access through a lock mechanism to a network element in a telecommunication network, comprising the following steps executed in a system coupled to the lock mechanism:

checking information about whether the network element is connected or not to the telecommunication network,
checking information about a value of a software parameter indicating if the lock mechanism should be inhibited or not,
inhibiting the lock mechanism if the network element is connected to the telecommunication network and if the value of the software parameter indicates that the lock mechanism should be inhibited.

The invention relates further to a computer program adapted to be executed in a system for a physical access protection of a network element in a telecommunication network, said program induing instructions which, when the program is executed in said system, execute the steps of the method of the invention.

BRIEF DESCRIPTION OF THE FIGURES

Some embodiments of the present invention are now described, by way of example only, and with reference to the accompanying drawings, in which:

FIG. 1 is a schematic block-diagram of a network element NE coupled to a lock protection system LPS,
FIG. 2 is a flowchart showing steps performed to execute a process of physical access protection of a network element in a telecommunication network according to an embodiment of the invention,
FIG. 3a is a schematic block-diagram of a lock protection system of a network element in a telecommunication network with keyhole protected according to an embodiment of the invention,
FIG. 3b is a schematic block-diagram of a lock protection system of a network element in a telecommunication network with keyhole accessible according to an embodiment of the invention,
FIG. 4a is a schematic block-diagram of a lock protection system of a network element in a telecommunication network in an inhibited lock state according to an embodiment of the invention, and
FIG. 4b is a schematic block-diagram of a lock protection system of a network element in a telecommunication network in an active lock state according to an embodiment of the invention,

The same reference number represents the same element or the same type of element on all drawings.

DESCRIPTION OF EMBODIMENTS

The figures and the following description illustrate specific exemplary embodiments of the invention. It will thus be appreciated that those skilled in the art will be able to devise various arrangements that, although not explicitly described or shown herein, embody the principles of the invention and are included within the scope of the invention. Furthermore, any examples described herein are intended to aid in understanding the principles of the invention, and are to be construed as being without limitation to such specifically recited examples and conditions. As a result, the invention is not limited to the specific embodiments or examples described below, but by the claims and their equivalents.
Referring to FIG. 1, a network element NE included in a telecommunication network TN is associated with a lock protection system LPS including an electromagnet EM and an interface INT. The lock protection system LPS is a mechanical system whose function is to protect or inhibit physical access to the network element NE. The lock protection system LPS is coupled to a lock mechanism allowing physical access to the network element NE, more specifically to a room where at least a communicating device of the network element is located.
The lock protection system LPS is connected to a command device CD, that can be a server or any communicating device, able to command the lock protection system LPS.
The electromagnet EM is linked to the lock mechanism of the network element and cooperates with a metallic object in order to inhibit or not the lock mechanism. In all cases, the metallic object prevents the lock mechanism to work, for example by impeding access to the lock mechanism by human.
The lock mechanism can feature various ways to access it as non limited examples: key hole, mechanical combination lock, or electronic keypads, that all need to be hidden or inhibited so that a malicious intruder will not be able to use them.
The interface INT checks signal information about whether the network element NE is connected or not to the telecommunication network TN.
In one embodiment, the signal information comes from the network element itself. In this case, the network element comprises also an interface to communicate with the lock protection system LPS.
In another embodiment, the signal information comes from the command device CD which retrieves information if the network element NE is connected or not to the telecommunication network TN from an entity of the telecommunication network.
By default, the lock protection system LPS is not active, in order to cover cases where the network element is powered-off or has a broken connection with the telecommunication network. Thus, as the electromagnet EM is powered by the same power source as the network element NE, the lock protection system LPS is automatically deactivated in case of a power-off situation.
The lock protection system LPS is activated if two conditions are satisfied: a connection with the operator of the telecommunication network and a feature activated by software. Once the electromagnet is power on, the lock is inhibited.
The electromagnet EM is controlled by the lock protection system LPS that follows the process according to FIG. 1 comprising steps S1 to S4.
At step S1, the electromagnet EM is not powered, meaning that lock protection system LPS is not activated.
At step S2, the interface INT of the lock protection system LPS checks information about whether the network element NE is connected or not to the telecommunication network.
If the network element NE is connected to the telecommunication network, the process continues with step S3, otherwise the process goes back to step S1.
The information checked by the interface INT at step S2 can come from the network element itself or from the command device CD connected to the lock protection system LPS.
At step S3, the interface INT of the lock protection system LPS checks information about a value of a software parameter SP indicating if the lock mechanism should be inhibited or not. For example, the software parameter SP is the following parameter DOOR_LOCK_INHIBIT being a Boolean parameter, having a state with value of "1" meaning the lock mechanism should be inhibited and another state with value of "0" meaning the lock mechanism should not be inhibited.
If the value of the software parameter SP is "1", the process continues with step S4, otherwise if the value of the software parameter SP is "0", the process goes back to step S1.
The information checked by the interface INT at step S3 comes from the command device CD that is connected to the lock protection system LPS and attributes the value of the software parameter.
At step S4, the electromagnet EM is powered on to cooperate with a metallic object, meaning that lock protection system LPS is activated to inhibit the lock mechanism and protect physical access to the network element NE. By physical access to the network element NE, it is meant for example access to a room inside the network element where hardware or electronic devices are located, like a server.
At this step, the lock protection system LPS is thus activated as the both conditions are satisfied: the network element NE is connected to the telecommunication network and software parameter SP at state with value of "1".
In reference to FIG. 3a and 3b, a metallic plate can be lifted thanks to a knob only if the electromagnet EM does not lock this metallic plate, i.e. the electromagnet is not powered.
In FIG. 3a, the electromagnet EM is powered on and the metallic plate protects the keyhole that is not accessible, the metallic plate being attracted by the electromagnet.
In FIG. 3b, the electromagnet EM is powered off and the metallic plate lets the keyhole accessible, the metallic plate being free to move.
In reference to FIG. 4a and 4b, the electromagnet EM does not aim to protect the lock cylinder, but to inhibit the multi-lock mechanism. Once inhibited, the lock cylinder can be turned but it does not act on the multi-lock mechanism. Opening the door can only be done if the electromagnet EM is powered off. Then, the multi-lock mechanism is released and engaged with the lock cylinder.
In FIG. 4a, the electromagnet EM is powered on, the spring around it being compressed, and metal moving part of the multi-lock mechanism is attracted by the electromagnet and moved away from the lock cylinder.
In FIG. 4b, the electromagnet EM is powered of and the spring around it is released, pushing the metal moving part of the multi-lock mechanism back toward the lock cylinder.
The lock protection system LPS may also be used directly on a door lock mechanism itself, for example in the case when the room containing the network element to be protected is already inside a secure building. In this case there is no need to have a specific key or combination to know to enter the room: an operator agent can enter the room when the network element is powered off, when it is not connected to the operator network. Otherwise the agent has to modify the value of the DOOR_LOCK_INHIBIT software parameter to "0" and the door will unlock.
Advantageously, the lock protection system LPS solution is lighter and cheaper than a security door:

lighter: some embodiments described above weigh less than a kilogram when a security door adds many kilograms; the weight aspect is important when considering the network deployment (handling) and hosting infrastructure (foundation slab or other);
cheaper: due to the increasing cost of metal, a security door represent a highly cost compared to the limited list of elements required by the lock protection system LPS.

In some of its embodiments, the lock protection system LPS is also very simple to add to an already installed equipment (possibly without a service interruption).
The invention described here relates to a method and a system for a physical access protection of a network element in a telecommunication network. In an embodiment, the steps of the method of the invention are determined by the instructions of a computer program incorporated in a system such as the lock protection system LPS. The program includes program instructions which, when said program is executed in a processor of the system the operation whereof is then controlled by the execution of the program, execute the steps of the method according to the invention.
As a consequence, the invention applies also to a computer program, in particular a computer program on or in an information medium readable by a data processing device, adapted to implement the invention. That program may use any programming language and be in the form of source code, object code or an intermediate code between source code and object code, such as a partially compiled form, or in any other desirable form for implementing the method according to the invention.
The information medium may be any entity or device capable of storing the program. For example, the medium may include storage means or a recording medium on which the computer program according to the invention is recorded, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a USB key, or magnetic recording means, for example a diskette (floppy disk) or a hard disk.

Claims

A system (LPS) for protecting physical access through a lock mechanism to a network element (NE) in a telecommunication network (TN), the system (LPS) being coupled to the lock mechanism and comprising:
means (INT) for checking information about whether the network element (NE) is connected or not to the telecommunication network (TN),

means (INT) for checking information about a value of a software parameter (SP) indicating if the lock mechanism should be inhibited or not,

means (EM) for inhibiting the lock mechanism if the network element (NE) is connected to the telecommunication network (TN) and if the value of the software parameter (SP) indicates that the lock mechanism should be inhibited.
A system according to claim 1, wherein means (EM) for inhibiting the lock mechanism is an electromagnet that is linked to the lock mechanism and cooperates with a metallic object preventing the lock mechanism to work.
A system according to claim 2, wherein the electromagnet is powered on by the system (LPS) to cooperate with the metallic object.
A system according to any of claims 1 to 3, wherein the system (LPS) is connected to a device (CD) able to command the system (LPS) and to attribute the value of the software parameter (SP).
A system according to any of claims 1 to 4, wherein the network element is a base station.
A system according to any of claims 1 to 4, wherein the network element is a data center.
A system according to any of claims 1 to 6, wherein physical access to the network element (NE) is access to a room inside the network element where hardware or electronic devices are located.
A method for protecting physical access through a lock mechanism to a network element (NE) in a telecommunication network (TN), comprising the following steps executed in a system (LPS) coupled to the lock mechanism:
checking (S2) information about whether the network element (NE) is connected or not to the telecommunication network (TN),

checking (S3) information about a value of a software parameter (SP) indicating if the lock mechanism should be inhibited or not,

inhibiting (S4) the lock mechanism if the network element (NE) is connected to the telecommunication network (TN) and if the value of the software parameter (SP) indicates that the lock mechanism should be inhibited.
A computer program adapted to be executed in a system (LPS) for protecting physical access through a lock mechanism to a network element (NE) in a telecommunication network (TN), the system (LPS) being coupled to the lock mechanism, said program including instructions which, when said program is executed in said system, execute the following steps:
checking (S2) information about whether the network element (NE) is connected or not to the telecommunication network (TN),

checking (S3) information about a value of a software parameter (SP) indicating if the lock mechanism should be inhibited or not,

inhibiting (S4) the lock mechanism if the network element (NE) is connected to the telecommunication network (TN) and if the value of the software parameter (SP) indicates that the lock mechanism should be inhibited.