EP3147870A1

EP3147870A1 - Control panel for physical access control

Info

Publication number: EP3147870A1
Application number: EP15187165.4A
Authority: EP
Inventors: Jochen Becker; Dietmar Zappel
Original assignee: Ileso Engineering GmbH; Ileso Eng GmbH
Current assignee: Xccelo Systems GmbH
Priority date: 2015-09-28
Filing date: 2015-09-28
Publication date: 2017-03-29

Abstract

Problem

A downside of conventional control panels lies in their sometimes inadequate level of security.

Solution

The problem is solved by a control panel (10) for physical access control, comprising a main device (11) comprising a mainboard (12) for controlling front ends connected to the control panel (10) and a user interface (13) connected to the mainboard (12) for operating the control panel (10), wherein the mainboard (12) comprises a central processing unit, flash memory connected to the central processing unit for storing access profiles and transactional data, and a secure element connected to the central processing unit for storing cryptographic keys, wherein the mainboard (12) is adapted to control the front ends securely using the cryptographic keys.

Description

Technical Field

The invention pertains to the field of security engineering, particularly physical security.

Background Art

Throughout the above-mentioned field, physical security describes any security measure that is designed to protect personnel or property from damage or harm. More specifically, access control is the selective restriction of access to facilities, equipment, and other physical resources. State-of-the-art electronic access control systems manage large user populations, controlling for user lifecycles times, dates, and individual access points.
In this context, by "control panel" is meant any electronics panel that can interface with or control access to control system field devices such as credential readers, electrified locks, door position switches, and request-to-exit devices. An overview of such panels and associated networks is provided in NORMAN, Thomas L.Electronic Access Control. 1st edition. Oxford: Butterworth-Heinemann, 2012. ISBN 0123820286. p.221-239.
A system for physical access control is disclosed in US 8881252 B (BRIVO SYSTEMS, INC.) 04.11.2014 and includes, inter alia, a conventional control panel.

Summary of invention

The invention aims to provide an improved panel for physical access control.

Technical Problem

Solution to Problem

The problem is solved by the feature recited in Claim 1.

Advantageous effect of invention

Any control panel according to Claim 1 bears the advantage that keys and particulars may be stored cryptographically secure. To this end, key material may be bound to the secure hardware of the main device in a non-exportable fashion, mitigating the risk of keys being extracting and protecting the latter from unauthorized use.
By integrating a functional module that may be dimensioned for the use case and peripherals at hand, a control panel according to Claim 2 proves scalable for a wide variety of deployment scenarios.
The features recited in Claim 3 allow for even improved protective mechanisms using configurable event triggers that facilitate a partial or complete auto-purge of the panel's internal database in case of tampering. This way, a potential attacker may be denied access to any data worthy of protection.
The subject-matter of Claim 4 implements a concept of high serviceability: Pertinent data such as assigned bus addresses are routinely mirrored between the main device and add-on module. Such added redundancy allows for the unskilled service technician to replace either component as required, causing the substitute device to import its complete configuration from the senior peer.
An embodiment according to Claim 5 allows for legacy front ends such as various magnetic contacts, locks, and release buzzers to be controlled.
The added features of Claim 6 permit a single cable to provide both data connection and electrical power to the control panel and add-on module or modules.
Claim 7 defines a control panel that may be conveniently mounted inside an equipment rack shared with circuit breakers and other industrial control equipment. As an alternative, the control panel may support a regular wall mount.
The variant of Claim 8 takes account of the fact that off-the-shelf radio-frequency identification (RFID) readers are delivered with factory default settings. Such third-party devices are typically prepared to be configured by means of an RFID card, mobile handhelds, or radio USB dongles, often in conjunction with proprietary software accompanying the product. For these types of generic readers, the claimed subject matter permits the control panel to imitate an RFID tag upon interrogation, thus also eliminating the risk of losing or misplacing the physical configuration card.
A control panel according to Claim 9 offers a most versatile user interface for stand-alone operation.
The features recited in Claim 10 and Claim 11, respectively, let users of a corresponding control panel choose between various stationary and mobile configuration scenarios. For instance, assuming a user has been assigned the role of a security administrator, her Bluetooth-enabled portable device - referenced by unique identification - may be authorized to connect to the control panel peer-to-peer, allowing her to customize the control panel on site.
An embodiment according to Claim 12 fulfils the most critical prerequisites for installing an advanced mobile operating system such as Android 4.4 or later. Though its widespread popularity, use of the Android operating system prepares the control panel for the use of numerous libraries and application programming interfaces (APIs) that mitigate hardware integration effort and risk of functional defects such as in the panel's firmware.
The added features of Claim 13 enable a local web service to be used as a communication handler, offering various standard protocols for communicating with arbitrary host systems. Also, by maintaining an additional local web server, any functional parameters required for operating the panel may be accessed through the device's configuration homepage.
Claim 14 defines a control panel that meets the Common Criteria for an at least semi-formally designed and tested target of evaluation (EAL5+), thus qualifying the device for a high level of independently assured security.
Lastly, a control panel according to Claim 15, assuming the use of a sufficient key length, is prepared for data privacy protection as may be required by national regulations such as the German Federal Data Protection Act or United States Privacy Act.

Brief description of drawings

Figure 1 is a block diagram of a control panel according to the invention.
Figure 2 is a block diagram of a mainboard.
Figure 3 is a block diagram of a first baseboard.
Figure 4 is a block diagram of a second baseboard.

Description of embodiments

Figure 1 is an overview of a control panel (10) for physical access control according to an embodiment of the invention. In this embodiment, the control panel (10) is composed of a main device (11), which serves to control an arbitrary number of conventional front ends (not depicted), and an add-on module (17), which basically serves to adapted a limited number of those front ends to the main device (11). Physically, the main device (11) and add-on module (17) are adapted to be mounted on a joint DIN rail or side by side on a wall.
The main device (11) essentially consists of a generic first baseboard (18), an application-specific mainboard (12) carried by the first baseboard (18), and a user interface (13) connected to the mainboard (12), the user interface (13) of the present embodiment comprising light-emitting diodes (35), buttons (36), and an optional liquid-crystal display (37). The add-on module (17) comprises a second baseboard (19), the mainboard (12) and second baseboard (19) each being connected to the first baseboard (18) through an interface (20) and a power supply (21, 33).
Figure 2 elucidates the mainboard (12) in further detail. As may be gathered from this drawing, the mainboard (12) comprises a quad-core central processing unit (14) based on a reduced instruction-set computing (RISC) architecture, 1 GB of random-access memory (42) connected to the central processing unit (14) through a memory bus (43), and an additional 8 GB of flash memory (15) connected to the central processing unit (14) for storing access profiles and transactional data. The mainboard (12), based on the aforementioned specifications, is prepared to operate an Android system - as maintained by Google Inc. -, manage its data using a relational database management system (RDBMS), and even host a web service for configuring the access profiles through a host, web browser, or application-specific client.
As an essential element of the invention, the mainboard (12) further comprises a secure element (16, 44) connected to the central processing unit (14) for storing cryptographic keys, which in the present embodiment are used both to authenticate the control panel (10) to its front ends as well as to encrypt the transactional data stored in flash memory (15). On the mainboard (12) at hand, the secure element (16, 44) takes the form of an integrated circuit (16) brazed to the mainboard (12). Specifically, a trusted platform module (TPM) microcontroller as specified in ISO/IEC 11889 offers a particularly powerful cryptoprocessor. However, an alternative may make use of an optional subscriber identity module (44) as defined by the 3^rd Generation Partnership Project (3GPP).
In a preferred embodiment, the subscriber identity module (44) may take the form of a Java Card as specified by Oracle Corporation. Specifically, the module (44) may be based on the Java Card OpenPlatform (JCOP) serviced by NXP Semiconductors, include a memory chip model trademarked by NXP as MIFARE, and feature MIFARE DESFire EV1 emulation as a proprietary Java Card API extension. Corresponding contactless services are specified by Amendment C to the GlobalPlatform (GP) 2.2.1 architectural component of the JCOP.
The mainboard (12) further comprises, inter alia, an Ethernet physical transceiver (30) connected to the central processing unit (14) through a media-independent interface (31), a short-range radio frequency module (38) connected to the central processing unit (14) through a universal asynchronous receiver/transmitter (39), and an embedded low-energy Bluetooth and Wi-Fi module (40) connected to the central processing unit (14) through a secure digital input/output (41) interface (20).
Preferably, the low-energy Bluetooth module (40) supports the iBeacon protocol standardized by Apple Inc., taking the form of a so-called beacon. Based on such transmitter, the mainboard (12) may be adapted to broadcast its identifier to nearby portable electronic devices such as smartphones and tablets. Using a compatible app and operating system, maintenance personnel can thus be guided indoors to the approximate location of a specific control panel (10).
Figure 3 depicts the first baseboard (18). Aside from a power converter (32) feeding the power supply (21, 33) and sourcing its power over Ethernet (34), the first baseboard (18) most notably comprises a tamper detector (22) connected to the mainboard (12) through a general-purpose input/output (23). In the present embodiment, the tamper detector (22) serves a two-fold purpose: While physical intrusion into the main device (11) will trigger a first type of event, an integrated absolute position transducer and acceleration sensor will trigger a second type event. Such discrimination enables the security administrator to configure a distinct action to be performed in response to each of the two events.
Similarly, now referencing Figure 4 , the second baseboard (19), for each of its attachable front ends, comprises an RS-485 transceiver (25) - connected to the first baseboard (18) through a serial network bus (26) - as well as two air-gap switches (27, 28) connected to the first baseboard (18) through an inter-integrated circuit (29).

Industrial applicability

First and foremost, the invention is applicable throughout the security industry.

Reference signs list

Similar reference signs denote corresponding features consistently throughout the attached drawings:

10: Control panel
11: Main device
12: Mainboard
13: User interface
14: Central processing unit (CPU)
15: Flash memory
16: Secure element (brazed)
17: Add-on module
18: First baseboard
19: Second baseboard
20: Interface
21: Internal system supply
22: Tamper detector
23: General-purpose input/output
24: For each front end
25: RS-485 transceiver and termination
26: Universal serial bus
27: First air-gap switch
28: Second air-gap switch
29: Inter-integrated circuit (I²C)
30: Ethernet physical transceiver (PHY)
31: Media-independent interface
32: DC/DC power converter
33: Supply for reader, door opener and add-on modules
34: Power over Ethernet plus (PoE+)
35: Light-emitting diode (LED)
36: Button
37: Liquid-crystal display (LCD)
38: Short-range radio frequency (RF) module
39: Universal asynchronous receiver/transmitter (UART)
40: Wireless-fidelity (Wi-Fi) module
41: Secure digital input/output (SDIO)
42: DDR3 random-access memory (RAM)
43: DDR3 memory bus
44: Subscriber identity module (SIM)
45: Module bus connector

Citation list

The following literature is cited throughout this document.

Patent literature

US 8881252 B (BRIVO SYSTEMS, INC.) 04.11.2014

Non-patent literature

NORMAN, Thomas L.Electronic Access Control. 1st edition. Oxford: Butterworth-Heinemann, 2012. ISBN 0123820286. p.221-239.

Claims

Control panel (10) for physical access control,
comprising a main device (11) comprising
a mainboard (12) for controlling front ends connected to the control panel (10) and a user interface (13) connected to the mainboard (12) for operating the control panel (10),
wherein the mainboard (12) comprises a central processing unit (14) and flash memory (15) connected to the central processing unit (14) for storing access profiles and transactional data,
characterized in that
the mainboard (12) further comprises a secure element (16, 44) connected to the central processing unit (14) for storing cryptographic keys, wherein the mainboard (12) is adapted to control the front ends securely using the cryptographic keys.
Control panel (10) according to Claim 1,
characterized in
an add-on module (17) for connecting the front ends to the main device (11), wherein the main device (11) further comprises a first baseboard (18), the add-on module (17) comprises a second baseboard (19), and the mainboard (12) and second baseboard (19) are each connected to the first baseboard (18) through an interface (20) and a power supply (21, 33).
Control panel (10) according to Claim 2,
characterized in that
at least the first baseboard (18) comprises a tamper detector (22) connected to the mainboard (12) through a general-purpose input/output (23).
Control panel (10) according to Claim 2 or Claim 3,
characterized in that,
for each front end (24), the second baseboard (19) comprises an RS-485 transceiver (25) connected to the first baseboard (18) through a serial network bus (26).
Control panel (10) according to any of Claim 2 to Claim 4,
characterized in that
for each front end (24), the second baseboard (19) comprises air-gap switches (27, 28) connected to the first baseboard (18) through an inter-integrated circuit (29).
Control panel (10) according to any of Claim 2 to Claim 5,
characterized in that
the mainboard (12) further comprises an Ethernet physical transceiver (30) connected to the central processing unit (14) through a media-independent interface (31),
the first baseboard (18) comprises at least one power converter (32) connected to the power supply (21, 33), and
the power supply (21, 33) is adapted to source power over Ethernet (34) through the power converter (32).
Control panel (10) according to any of Claim 2 to Claim 6,
characterized in that
the main device (11) and add-on module (17) are adapted to be mounted on a joint DIN rail or side by side on a wall.
Control panel (10) according to any of the preceding claims,
characterized in that
the control panel (10) comprises an antenna module for emulating a radio-frequency identification card.
Control panel (10) according to any of the preceding claims,
characterized in that
the user interface (13) comprises light-emitting diodes (35), buttons (36), and preferably a liquid-crystal display (37).
Control panel (10) according to any of the preceding claims,
characterized in that
the mainboard (12) further comprises a
short-range radio frequency module (38) connected to the central processing unit (14) through a
universal asynchronous receiver/transmitter (39) and an embedded Wi-Fi module (40) connected to the central processing unit (14) through a secure digital input/output (41).
Control panel (10) according to Claim 10,
characterized in that
the Wi-Fi module (40) is adapted to support a personal-area network, preferably Bluetooth.
Control panel (10) according to any of the preceding claims,
characterized in that
the central processing unit (14) is based on a reduced instruction-set computing architecture and
the mainboard (12) further comprises random-access memory (42) connected to the central processing unit (14) through a memory bus (43).
Control panel (10) according to Claim 12,
characterized in that
the mainboard (12) is further adapted to host a web service for configuring the access profiles using the cryptographic keys.
Control panel (10) according to any of the preceding claims,
characterized in that
the secure element (16, 44) takes the form of a subscriber identity module (44) or an integrated circuit (16) brazed to the mainboard (12).
Control panel (10) according to any of the preceding claims,
characterized in that
the mainboard (12) is further adapted to encrypt the transactional data using the cryptographic keys.