EP1821262A2 - System for checking the authorisation of persons to carry out activities requiring authorisation - Google Patents

Abstract

The system has a central server (1) connected with terminals at control points by data transmission connections, where relevant data of the terminals and person are stored in the server. A determination is executed in one terminal based on information stored in the terminal to find whether an action that is to be authorized is enabled at the terminal in the starting event of the person, without a straight data transmission link to the central server.

Description

The invention relates to a system for controlling authorizations of persons to carry out authoritative activities. In particular, the system is advantageously applicable to the administration of a large number of authorizations for buildings located remotely at any location. A typical application is the management of access authorizations. In an advantageous embodiment, biometric data of the persons registered in the system are used as recognition features.

According to the EP 523 908 B1 the signature of a person is used as key information for access control. Significant information on the type of signing of a person authorized to sign up in principle is created and stored once by means of signatures. If this person then wants to gain concrete access, she has to sign again, from this data is generated, which are compared with the stored data. If there is sufficient agreement, access is granted. According to this system, it is no longer necessary to carry an item acting as a key or to apply a password. Nothing is said about the administration of access authorizations in buildings located far apart with a total of many access openings.

The DE 296 02 655 U1 describes a system for assigning access rights to decentralized facilities. The control devices on the respective doors are not connected to the central unit. They receive access rules in the form of data, which are brought manually on a mobile data carrier, and are read in after the reading unit has been unlocked. The persons requesting admission must enter valid key information via an input unit, eg a numeric keypad. The control device can also record data, such as who came and went when. If necessary, these data must be brought to the central unit manually by means of a mobile data carrier. An advantage of this system is that it does not require an upright data network between the central unit and distributed control devices. The disadvantage is that the data exchange between the central unit and distributed control devices arranged by physical transport of a data carrier, and thus very slow and cumbersome. This method is therefore only useful if all parts of the plant are geographically close to each other.

The AT 410 489 B describes a system for logging onto a distributed data processing system with the aid of a biometric feature. The peculiarity here is that the data that serves as the key to access always remain separate from the data with which the user actually works. This is achieved by using a different central computer for the user identification than for the applications which are made accessible after recognition. This is very advantageous for data protection reasons when using the system hardware by several providers who have software running on it. The user ID is stored in a central data memory and, if necessary, is compared under automated, electronic exchange of information with a user ID currently recorded on a terminal. Nothing more is said about further details of this information exchange or the user administration.

The EP 1 460 508 A1 describes the access control to a data processing system, which may also be distributed. Access is granted when an identification feature to be entered, which may also be a biometric feature, matches a feature stored on an on-board radio-to-mobile medium. This method is safer than an access control based solely on a key brought along. Furthermore, it is advantageous that for the decision whether to grant admission or not, no communication with a central server is required. The disadvantage is that a part similar to a key must be carried.

The WO 2004/034335 A1 describes a multi-level access control system for a building. The system consists of a central computer and thus data channels connected to local, memory and computational test points at the individual inputs. To verify the identity of a person requesting access, locally recorded data is sent to the central computer and compared there with centrally stored identification data. Depending on the match, a corresponding signal is sent to the respective test site. Neither identification data on the individual persons nor data on the frequency of access are stored at the individual inspection stations. The system needs an upright data connection to the server to check the access authorization of a person. In the case of the access request, the information required to verify the identity must also be transmitted via this data connection via a biometric feature, that is to say a relatively large amount of data become. That the system is intended only for local use cases and only for good use.

The GB 2 331 825 A describes a person recognition system for access from outside to a database created in a central server. In this case, a fingerprint is used, which is stored in the central server and on a mitzubringenden card. At the local terminal, a currently on-site fingerprint is compared with the one stored on the card, then everything is sent to the server where it is compared again with stored data. If everything fits, the server sends a signal to the local terminal, which allows access to the central database. The system offers a high degree of security against manipulation by third parties on the data transmission network. In order to verify the identity of the person requesting access, data exchange with the central server is required, and in addition a considerable amount of data must be transmitted per identification process. Thus, the existence of a functional data connection between the local terminal and the central server is an essential prerequisite for this process.

The WO 2001/091038 A1 describes a system and method for controlling the access of persons to secured buildings or similar areas. The system consists of a central server, individual, locally arranged access control units and a communication channel for the connection between server and access control units. By authorized employees are master data, which also biometric data such as fingerprint include recorded stored and as far as required for on-site verification, sent to the access control units, stored there again and further used in then independent of the server if necessary, access requests. Compared to the server, all access control units are the same. A person can only have access to all access control units, or none at all. To each of these units, the record required to check the access authorization is sent by all the persons registered in the system. Thus, the storage space requirement for each individual access control unit increases proportionally with the number of persons detected in the overall system, even if only a few authorized persons actually need access to individual access control units.

Starting from this prior art, the object underlying the invention is how the WO 2001/091038 A1 a common control system for persons to authorize activities, such as passing through a gate, the commissioning of machinery or the switching on and off of alarm systems, in arbitrarily widely spaced and distributed buildings and rooms to propose, even then controlled authorization may be possible should, if there is temporarily no upright data connection between the individual control points and a central server. Compared to the system according to the WO 2001/091038 A1 the system should be better for a larger total number of control posts and authorized persons expandable, it is to be found with a smaller data storage per control point Auslangen and it should be supplemented in an economically meaningful scope with other useful functions.

• "Autorisierung" - ist die "kontrollierte Zuweisung von Zugriffsrechten". Dazu wird die Identität einer Person, welche Rechte begehrt überprüft, und es wird bei positivem Ergebnis eine Handlung gesetzt , durch welche diese Person die Rechte in Anspruch nehmen kann, beispielsweise wird eine Sperre geöffnet.
• "Kontrollstelle" - ist einer von mehreren Orten an denen Autorisierung stattfindet.
• "Terminal" - ist ein technisches Gerät, welches als Teil des Kontrollsystems an einer Kontrollstelle angeordnet ist.

For the sake of better understanding, the meaning of individual terms in the sense of this description is hereby clarified:

• "Authorization" - is the "controlled allocation of access rights". For this purpose, the identity of a person who seeks rights is checked and, if the result is positive, an action is taken whereby that person can claim the rights, for example, a lock is opened.
• "Control Point" - is one of several places where authorization takes place.
• "Terminal" - is a technical device located at a control post as part of the control system.

To achieve the object, a system is used in which a terminal is arranged at each control point, which comprises an identification device, a barrier actuator and a data recording device. These terminals are networked through a data processing system comprising a single central server and a plurality of terminal servers located thereunder. The central server stores the required information about all buildings and persons entitled to access - more simply called "employees". In the individual terminals required for the self-sufficient operation of the respective terminal subset of this information is also stored. The terminal servers hierarchically located between the terminals and the central server control the data transfer between the central server and each subset of the terminals. According to the invention, it is provided that only information concerning those employees are sent to the individual terminals and stored there, which actually have permissions at the respective control points. Furthermore, the invention provides that at the individual terminals, the data who, when and where the authorization has exercised, are recorded and sent to the central and server. If the data connection between a terminal and the server fails, the data accumulating at the terminal in the meantime is temporarily stored at the terminal until the data connection is up again and it is communicated to the server.

The invention will be explained in detail with reference to an exemplary drawing:

Fig. 1:

shows an overview diagram for a representative section of a control system according to the invention.

In the ever networked access control system only once required central server 1 is a central database set up with all required for the access system terminal and Miterbeiterammdaten. Terminals and employees are clearly identifiable in the data processing system. For each employee it is determined at what times he can pass through which terminals, or for each terminal is determined when it can be crossed by which employee. In addition, the master data per employee at least a unique name and a unique identification information. This identification information may be, for example, compressed information obtained by an image processing algorithm from an image of an employee's fingerprint.

The central server 1 is connected to a plurality of terminal servers 2. In the case of spatial proximity, this connection can be formed via a LAN. A Local Area Network (LAN) in this sense is a networking method between nearby computers. At present, a technology that is often used specifically for this purpose is the so-called Ethernet standard. At a greater distance - it can span across continents - the connection can be made via a VPN channel on the Internet. A VPN channel in this sense is a data transmission protocol by which an information flow over a public data network is handled in such a way that it appears to the partners involved as if they were only communicating with one another via an internally accessible data network. Such transmission methods are state of the art and need not be further described here.

A terminal server 2 establishes the further data connections to LAN / RS485 converters 3 located geographically via a LAN. These converters 3 translate the data transfer between the format used in the LAN and the more robust, but not so fast, RS485 format, which is easier to wire. In this format, the data exchange with the individual terminals 4 is handled.

A terminal 4 is mounted in the area of the control points, for example, to be controlled doors or gates of buildings or rooms. At least in the case of doors, it should consist of an indoor unit 4.1, through which the lock is actuated, and an outdoor unit, 4.2, to which the identifier of the passage desiring employee is taken and compared with stored features. Three relays can be switched via such a terminal and the associated actions, such as opening a door, can be carried out.

After in the repair of such a control system, the necessary equipment mounted and the necessary line connections are made in the central server 1, the individual devices, ie terminals 4, LAN / RS485 converter 3 and terminal server 2 registered. Then the master data of the individual employees are created and it is determined at which terminals at which times the individual employees are allowed to pass. These registration entries are made by an authorized system administrator who has access to the central server 1. Part of this registration work is also to create identification information of each employee. For example, this can be done by reading an image of a fingerprint of the employee, from this special features are filtered out and stored as a biometric key in the central server 1. It is possible to record several fingers as biometric keys by one employee. Each finger is assigned a relay. In this way, a person selectable several different actions can be triggered via a terminal. The creation of the data and the recording of the biometric key can also be done decentrally on a PC, which is equipped with appropriate software and recording device and has a corresponding network connection.

As soon as an employee is "created", the central server 1 sends to the terminals concerned 4 an information packet which consists of the name of this employee used in the data processing system, his biometric key and the information over the times, at which certain permissions are granted to him, such as passage. The affected terminals take this information as a work instruction and store it in the case of a gate on a local data storage attached in the outdoor unit 4.2.

When an employee at a terminal requests 4 passage, he enters an image of his finger on a scanning device attached to the outdoor unit 4.2, recognizable as a dark, rectangular strip, by passing his finger slowly over this strip. The remote unit further processes this image in a local computing device attached to it to extract from it specific features that are comparable to the stored biometric keys previously communicated from the central server 1. In the local data processing unit of the outdoor unit 4.2, the newly filtered-out features are compared with the stored features of employees entitled to transit. If a match is found, the operator is deemed to be recognized and passage is granted by sending a corresponding signal to the associated indoor unit 4.1 which, by switching the corresponding relay, initiates the desired action, in this case opening the lock. By dividing the terminal 4 into an indoor unit 4.1 and an outdoor unit 4.2 can be better adapted to the individually very different locks to be triggered by the indoor unit, as with a more complex overall unit.

The information that the employee concerned has triggered an action at the relevant terminal 4 at the relevant time is communicated from the terminal 4 via the higher-level LAN / RS485 converter 3 and the further upstream terminal server 2 to the central server 1 and recorded there.

If the data connection between terminal 4 and central server 1 does not work, which can not be ruled out at least temporarily, the function of the terminal relating to the employee does not change at all. The data required for checking and possibly granting rights of individual employees are located locally in terminal 4, and the required data processing also takes place locally in terminal 4. The only difference from the mode of operation of an existing data connection to the central server 1 is that the information that Employee x at time y at the terminal z by means of biometric key has actuated the relay a is not immediately communicated to the central server 1, but initially only in the terminal 4 is stored and only then communicated to the central server 1 when the data connection works again.

If data relating to individual terminals at the central server 1 is changed while the data connection to these terminals is interrupted, these terminals operate according to the previous data status until the data connection is restored. Then they will be updated.

On the one hand on the central server 1, on the other hand on the affected terminals 4, - on the one hand extremely good manageability of the data, as on the central server 1 all data are editable, on the other extreme robustness of the function achieved because the terminals 4 work well even if the data transmission - whose uninterrupted functioning can not be guaranteed - is interrupted.

Above all in order not to have to register those persons, which only in individual cases need specific rights at a terminal, in the entire plant, but also for security reasons, it makes sense to provide direct access possibilities for authorized employees to the terminals existing there at the individual building locations. Thus, for example, gates can be opened for a short time on arrival of a delivery without prior identification process by means of relay switching. Or the access for individual employees can be blocked at short notice even if the data transfer to the central server has failed. This accessibility is best via PC workstations, produced, which are connected to those terminal servers 2 via LAN, which also connect to the affected terminals 4.

Of course, it makes sense to design the database of employees and buildings required in the central server 1 in such a way that, if necessary, other useful information about employees or buildings can also be stored or that a data exchange with relevant databases is possible.

The invention can also be meaningfully combined with checkpoints where a biometric feature is not included as an identification feature, but, for example, a password to be entered manually or a password, number, signal or even a mechanical key to be read out from a data store to be provided.

The control system was described above all with reference to the important application case "Granting or denying access and recording the access data". However, the areas of application may also relate to many other authoritative activities such as the commissioning of machines, etc. In this sense, the term "lock actuator" as used in the specification and the following claims is somewhat more general than the device by which a door is unlocked.

Claims (3)

Control system for authoritative activities in distributed buildings or rooms, with correspondingly adjustable authorizations to persons to perform the ability to perform authoritative activities or denied, wherein at individual control points, a terminal is arranged, which a biometric identification feature identification device, a lock actuator and a data recording device, wherein the system includes a central server in which the information about which person is recognizable by which biometric identification feature is stored, wherein between the central server and the individual terminals an automatic data transmission connection is established, the information being authorized by persons which identification features are recognizable, automatically communicated from the central server via the data transmission connection to the terminals u nd is stored there and regardless of whether at the given time the data transmission connection to the central server is upright or interrupted, is applied for a person's request to lock opening to verify the identity of this person, characterized in that the individual persons detected is assigned concretely to which concrete Terminals (4) at which times the lock can be opened for them, that information is sent from the central server (1) to an individual terminal (4) only with respect to that subset of total detected persons, for which precisely at this individual terminal (4) the lock may be opened and that the terminal (4) registers the information when which person has exercised such authorization, caches it locally if necessary and then automatically communicates with the central server (1) via the data transmission connection if the data transmission connection to the central server he (1) is upright. Control system according to claim 1, characterized in that it is used to manage the passage of people through gates. Control system according to claim 2, characterized in that the terminals (4) consist of an indoor unit (4.1) and an outdoor unit (4.2) which are arranged separately, the main function of the indoor unit (4.1) being to control the blockage of the transmission point while it is functions of the outdoor unit to perform the identification of persons and to store the related data.

Images