ES2969462T3 - A security surveillance system - Google Patents

Abstract

A security monitoring system is provided that includes: a system controller; a video camera, coupled to a motion sensor, arranged to monitor a surveillance area; a portable token that stores a token ID; the video camera being configured by receiving a motion detection signal from the motion sensor to send an alert to the system controller; configuring the system controller in an armed state, upon receiving an alert from the video camera, to start an event timer and send an instruction to the video camera to transmit a token activation signal, the instruction including a token identifier. event; the video camera being further configured to, upon receiving the instruction from the system controller, transmit a token activation signal that includes the event identifier; the portable token is configured to respond to the reception of a token activation signal from the video camera transmitting a response that includes the token ID and the event identifier; the system controller is further configured: upon receiving a response from the token to: compare the event identifier included in the response with the event identifier included in the instruction to the video camera; compare the token ID included in the response with one or more stored token IDs; and suspend the event timer if both comparisons match; if no response is received or one or both comparisons do not match, to determine an alarm event upon expiration of the event timer. (Automatic translation with Google Translate, without legal value)

Description

DESCRIPTION

A security surveillance system

Technical field

The present invention refers to a security surveillance system for the surveillance of premises, a video camera for use with a system of this type and methods of configuration and operation of a surveillance system of this type.

Background

Security surveillance systems for monitoring premises, often referred to as alarm systems, typically provide a means to detect the presence and/or actions of people on the premises, and react to detected events. Typically, these systems include sensors to detect the opening and closing of doors and windows, motion detectors to monitor spaces (both inside and outside buildings) for signs of movement, microphones to detect sounds such as breaking. glass, and image sensors to capture still or moving images of the monitored areas. These systems can be autonomous, with alarm indicators such as sirens and flashing lights that can be activated if an alarm situation is detected. These installations usually include a control unit (which can also be called a central unit), usually powered by the electrical network, which is coupled to sensors, detectors, cameras, etc. ("nodes"), and which processes received notifications and determines a response. The central unit can be connected to the various nodes by cables, but it is increasingly common to connect wirelessly, rather than by cables, as this makes installation easier and can also provide some guarantees against effectively disabling the nodes. sensors/detectors by disconnecting them from the central unit. Likewise, to facilitate installation and improve security, nodes in such systems typically include a self-contained power source, such as a battery power supply, rather than being powered by the electrical grid.

As an alternative to stand-alone systems, a security surveillance system may include a premises installation, domestic or commercial, that is connected to a Central Surveillance Station (CMS) where, typically, human operators manage the responses required by the security systems. different types of alarms and notifications. In such centralized surveillance systems, the central unit of the local installation usually processes the notifications received from the nodes of the installation and notifies the Central Surveillance Station only some of them, depending on the system configuration and the nature of the detected events. In such a configuration, the central unit of the installation effectively acts as a gateway between the nodes and the Central Surveillance Station. Again, in these types of installations, the central unit can be connected by cable or wirelessly to the various nodes in the installation, and these nodes are usually battery powered rather than mains powered.

Although security surveillance systems are normally developed to protect premises, such as houses or apartments, some installations include one or more cameras, usually video cameras, arranged to monitor outdoor spaces such as terraces, gardens and esplanades. Typically, in such installations the (video) camera is associated with one or more motion sensors, and the camera and motion sensor(s) are arranged to cover a common surveillance area. When the system is armed, movement within the monitored surveillance area activates the motion sensor, turning on the camera and alerting the central unit which, in turn, can signal an alarm condition to a central surveillance station.

Such external surveillance arrangements are a frequent source of false alarms, triggered by owners or occupants of protected premises who forget that the external area is monitored. False alarms can be expensive for system operators, as they may require the dispatch of security personnel, and may also annoy homeowners/occupants, causing them to become dissatisfied with the system provider. Frequent false alarms can also cause the owner or occupant to leave surveillance systems disarmed, with the potential risk of the security surveillance system failing to detect actual security breaches.

It would be desirable to be able to reduce or even eliminate this problem while maintaining a high level of security.

Embodiments of the invention provide potential solutions to the problems, in systems with external surveillance areas, of false alarms triggered by authorized persons.

The prior art can be consulted in US 2014/139678 A1, US 2016/035198 A1, US 2014/136701 A1 and US 2003/062997 A1.

Summary of the invention

According to a first aspect, a security surveillance system is provided including: a system controller; a video camera, coupled to a motion sensor, arranged to monitor a surveillance area; a portable token that stores a token ID; the video camera being configured to send an alert to the system controller upon receiving a motion detection signal from the motion sensor; the system controller being configured in an armed state, upon receiving an alert from the video camera, to start an event timer and send an instruction to the video camera to emit a token activation signal, including the instruction a event identifier;

the video camera being further configured to, upon receiving the instruction from the system controller, emit a token activation signal that includes the event identifier; the portable token being configured to respond to receipt of a token activation signal from the video camera by issuing a response including the token ID and the event identifier; the system controller being further configured to: upon receiving a response from the token to: compare the event identifier included in the response with the event identifier included in the instruction to the video camera; comparing the witness identifier included in the response with one or more stored witness identifiers; and suspend the event timer if both comparisons provide a match; If no response is received or one or both comparisons do not provide a match, determine an alarm event upon expiration of the event timer.

The video camera and motion sensor may be arranged to monitor a surveillance area and the video camera configured to emit the witness activation signal as a radio signal having an effective range that does not extend significantly beyond the surveillance area.

Optionally, the portable token includes a processor coupled to a token motion sensor, and the token is configured to respond to token activation signals only if the processor determines that the token is moving.

Preferably, the portable token includes a radio activation receiver, and the video camera is configured to emit token activation signals as radio activation signals to which the token responds.

The portable token can be configured to include RSSI data in its response to the token activation signal from the video camera, and the system controller can be configured to use the RSSI data included in the response from the token to determine whether trust the response received. Additionally, the system controller can be configured to consider the response from the token as invalid if the RSSI data included in the response from the token suggests that the response came from outside the camera's usual radio signal range.

Preferably, the radio frequency transceivers of the portable witness, video camera and system controller are configured to operate in the industrial, scientific and medical, ISM radio bands.

Preferably, the video camera is configured, by instruction from the system controller, to transmit video images captured by the video camera using Wi-Fi.

The system controller is optionally configured, in an armed state, to disarm the security surveillance system if both comparisons provide a match.

Alternatively, the system controller can be configured in an armed state, if both comparisons provide a match, to disarm the security surveillance system only with respect to monitoring the surveillance area.

According to a second aspect, a video camera is provided for use in a security surveillance system according to any variant of the first aspect, the video camera including an image sensor, a radio frequency transmitter, a radio receiver. radio frequency, and a processor operatively connected to the image sensor, the radio frequency transmitter and the radio frequency receiver, the processor being configured, upon receiving a motion activation signal from a motion sensor to: transmit, using the radio frequency transmitter radio frequency, an indicator signal to the controller of the security surveillance system; in response to receiving, by means of the radio frequency receiver, an instruction from the controller to cause the radio frequency transmitter to transmit a token activation signal.

Preferably, the token activation signal is a radio activation signal. Optionally, the motion sensor is part of the video camera.

Preferably, the radio frequency transmitter and radio frequency receiver of the video camera are configured to operate within the industrial, scientific and medical, ISM, radio bands, such as the 868 MHz band.

A video camera according to the second aspect may further comprise an RF transmitter configured to transmit Wi-Fi signals, and the video camera processor may be configured, by instructions from the controller of a security facility, to activate the RF transmitter to transmit video images captured by the video camera via Wi-Fi.

According to a third aspect, a method of configuring a security surveillance system is provided, the method comprising: providing a system controller; a remote video camera coupled to a motion sensor; and a portable token that stores a token ID; the video camera being configured to receive a motion detection signal from the motion sensor to send an alert to the system controller; the system controller being configured, upon receiving an alert from the video camera, to start an event timer and send an instruction to the video camera to emit a token activation signal, the instruction including an event identifier; the video camera being further configured to, upon receiving the instruction from the system controller, emit a token activation signal including the event identifier; the portable token being configured to respond to receipt of a token activation signal from the video camera by emitting a response including the token identifier and the event identifier;

the system controller being further configured to: upon receiving a response from the witness, comparing the event identifier included in the response with the event identifier included in the instruction to the video camera; comparing the witness ID included in the response with one or more stored witness identifiers; and suspend the event timer if both comparisons provide a match; If no response is received or one or both comparisons do not provide a match, determine an alarm event upon expiration of the event timer.

According to a fourth aspect, an operating method of a security surveillance system is provided, the security surveillance system including: a system controller; a video camera, coupled to a motion sensor, arranged to monitor a surveillance area; and a portable token that stores a token ID; understanding the method: monitor the surveillance area using the video camera and motion sensor; When the video camera receives a motion detection signal from the motion sensor, sending an alert to the system controller; Upon receiving an alert from the video camera, the system controller starts an event timer and sends an instruction to the video camera to emit a token activation signal, the instruction including an event identifier; the video camera, upon receiving the instruction from the system controller, emits a token activation signal including the event identifier; the portable token responds to receipt of the token activation signal from the video camera by emitting a response including the token identifier and the event identifier; the system controller: upon receiving a response from the token, compare the event identifier included in the response with the event identifier included in the instruction to the video camera; comparing the witness identifier included in the response with one or more stored witness identifiers; and suspend the event timer if both comparisons provide a match; If no response is received or one or both comparisons do not provide a match, determine an alarm event upon expiration of the event timer.

Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

Figure 1 is a schematic drawing showing a stylized building with an outdoor space monitored by a security surveillance system according to an embodiment of the invention; Figure 2 is a schematic drawing showing the main elements of a camera 50 (in this case a video camera) according to one aspect of the description;

Figure 3 schematically shows the main components of various devices of a security surveillance system;

Figure 4 is a simplified schematic sequence diagram illustrating a method according to an aspect of the invention;

Figure 5 is another sequence diagram illustrating what happens when an unauthorized intruder enters the area monitored by the security surveillance camera;

Figure 6 is a timing diagram showing the sequence of events and actions of the various elements of the security system that characterize a method, according to an embodiment of the invention;

Figure 7 is a flow chart illustrating a possible process for a portable authentication device

370 according to an embodiment of the invention; and

Figure 8 is a simplified scheme illustrating two-phase detection.

Specific description

Figure 1 is an overview of a security surveillance system according to a first aspect of the invention. The figure shows an approximate plan view of a domestic dwelling 110, which may be a building such as a house or a protected space, such as an apartment, in a building and which is protected by a security surveillance system 100. The house has a front door 120, in a portal that is the main entrance that gives access to the protected interior of the house. The door 120 is equipped with a door sensor 130 to detect the opening of the door. The door sensor 130 is typically, but not necessarily, a magnetically activated switch that is installed on the opening side of the door, opposite the hinge side. It will be appreciated that the door sensor is an example of a detector for detecting violation of the entry represented by the portal. It will also be appreciated that violation of an input can also be detected using a motion sensor such as a PIR sensor, a video camera or other image sensor, a ground-mounted pressure sensor, or some other contact sensor. or contactless, any of which can be used to detect the violation of an entrance to a building, garden, farm, etc., and which can consequently generate an alarm activation signal to indicate the violation of a monitored entrance.

The door sensor 130 includes an RF transmitter, not shown, that transmits an entry violation signal to a central unit 140 of the surveillance system 100 in the event that the door is opened. Inside the home, near the front door 120, there is a disarming node 150 mounted on a wall. The disarming node 150 has a user interface, including a touch screen or keypad for receiving user input to disarm the system, and a radio frequency transmitter, not shown, for transmitting, as a consequence of the user input, a disarming instruction to the control unit 140. A similar disarming node 160 is also mounted on a kitchen wall near a rear door 170 that also provides access to the protected interior of the home. The house is also provided with windows, 180, and these are provided with one or more sensors to detect the opening of windows, glass breakage, tampering or similar.

The security installation 100 also includes an outdoor surveillance camera, in this case a video camera, 50 to which is associated a transceiver 55 and a motion detector, such as a PIR detector 60. Although the transceiver 55 and the motion detector 60 are shown mounted outside the video camera housing 50, commonly both the transceiver and the motion detector will be integrated into the camera and enclosed within the video camera housing. The motion detector 60 and the video camera 50 are mounted to monitor a monitored area, in this case a rear garden associated with the domestic dwelling 110. The rear garden is accessible through a garden gate 70. The owner or occupant The domestic dwelling 110 can, for example, store removable valuables, such as a scooter 80, in the backyard, and the outdoor surveillance camera can help protect said removable valuables. In the example shown, the exterior surveillance camera 50 is not fixed to the structure of the domestic dwelling 110, but is mounted remotely so that it can better monitor both the rear exterior portion of the property and the rear garden. The video camera 50 is activated in the event that the motion detector 60 detects movement, for example when the garden gate 70 is opened and someone enters the garden. Upon activation, the video camera 50 uses the transceiver 55 to communicate with the central unit 140. If the security surveillance system is in an armed state, the central unit can be configured to enter an alarm state and, for example, communicate with a remote central surveillance station 190 wirelessly, or with a wired connection, for example via Internet 195. The central unit 140 can instruct the video camera 50 to transmit images using the transceiver 55 and then Then forward the images to the central monitoring station for review. After review at the central surveillance station, it may be decided to send security personnel and/or raise the alarm to the police.

Unfortunately, it is easy for a home occupant to arm the security surveillance system before leaving the home and then open the rear gate 70 to retrieve the scooter 80, forgetting that upon entering the backyard after having Armed the security surveillance system will activate an alarm situation. The present description provides methods and apparatus for reducing the risk of such accidental activation of alarm situations.

Figure 2 schematically illustrates the main elements of a camera 50 (in this case a video camera) according to one aspect of the description. The camera includes a camera module 200 including an image sensor and a lens. The camera module 200 is controlled by a processor 210, including RAM 215. Operably coupled to the processor 210 is another memory arrangement 220 for long-term storage of program data and image data (although, of course, can be stored in different memories). The camera 50 is powered by a battery power supply 230. Optionally, a photovoltaic arrangement 240 may be included to provide supplemental power and charge a rechargeable battery within the battery power supply.

The processor 210 is also operatively coupled to the camera's RF transceiver 55. In the example shown, two transceivers 55' and 55" are provided, and at least one of these transceivers uses the industrial, scientific and medical (ISM) radio bands, and the RF transceiver is configured to provide Wi-Fi functionality. The two transceivers may be identical, or one may support ISM while the other supports Wi-Fi. Preferably, RF communication between the central unit and the nodes (including cameras 50), detectors and sensors of the security surveillance systems. According to embodiments of the invention, industrial, scientific and medical (ISM) radio bands are used, such as in Europe the 868 MHz band. Within the 868 MHz band there are several subbands dedicated to "SRD not "specific" that are of interest. When the camera 50 has image data, especially video image data, to send to the central unit 140, a transceiver 55 preferably uses Wi-Fi to transmit the data as long as there is sufficient battery charge. and sufficient available bandwidth. Each of the transceivers has an associated antenna arrangement.

Figure 2 also shows the motion sensor 60, which may be a PIR sensor, incorporated into the camera 50 and operatively coupled to the processor. Also shown are an optional microphone 250 and speaker 260, both operatively coupled to processor 210. The speaker may be used to provide information to an authorized user, as described below, and to enable communications from the central station. Surveillance signals 190 are heard in the vicinity of the camera 50. Finally, the camera may include an indicator light 265, to provide optical information under the control of the processor 210. Of course, the camera may also be associated with a light source. infrared or other type, not shown, for use in illuminating the monitored area and effectively improving the quality of the images obtained by the camera 50.

Figure 3 schematically shows the main components of various security surveillance system devices that may be involved in arming and, more particularly,

disarming of the system, namely the main elements of the central unit 140, and the disarming node 150, and a key ring or token 370.

The central unit 140 includes a processor 300 with an associated memory 310 that stores, among other things, the identities of the key fobs registered in the system, the identities of the door sensors and disarming nodes of the system, along with an association between each disarm node and the access door sensor closest to the disarm node in question. These identities and associations are stored in a database 315 within memory 310. The central unit includes at least one radio frequency transceiver 320, with an associated antenna 322, for communication with the various nodes and sensors of the surveillance system. Typically, there will be a second transceiver 330 as shown, also with an associated antenna 332, for communication with the central monitoring station 190, as a backup or alternative to a wired data connection to the Internet via a data interface. network 340. The antennas of the various transceivers will normally all be internal to the central unit. The processor 300 connects to and controls memory 310, transceivers 320 and 330, and network interface 335. Typically, the central unit is powered from the home power supply (generally referred to as the mains supply) which powers a power supply 336 in or associated with the central unit. The central unit also includes a backup battery power supply that automatically comes into operation should the external power supply fail. The internal battery power supply is based on rechargeable cells 337 that are continuously powered by the power supply 350. The central unit may also include a user interface 325, including a display 326, a keypad or keypad 327. , a speaker 328 and a microphone 329. The numeric keypad or keypad may be provided by making the screen touch sensitive, or as a separate unit from the screen. The central unit can be arranged to accept through the numeric keypad or keypad a code or codes to arm and disarm the system. The central unit may also include a near field communication (NFC) antenna and a corresponding NFC microprocessor or equivalent circuitry that may be used, for example, to detect the presence of a "disarm key" provided to the user of the system and that It can communicate with the central unit using near field communication. Key fobs may also be provided with an antenna and an NFC microprocessor or equivalent circuitry, so that they can be used as "disarm keys" with the head unit and with NFC-enabled disarm nodes.

The disarm node 150 includes a processor 350 with an associated memory 351 that stores an ID of the disarm node. The disarm node also includes a user interface 352 comprising indicators, for example LEDs, 353, a numeric keypad, 354, and optionally a display 355 that may be present instead of or in addition to the LED indicators. The processor 350 controls a transceiver 360, with an associated antenna 361 (which will typically be internal, rather than external as illustrated), and which is used to communicate with the central unit 140 and the key fob 370. The transceiver 360 will normally be configured to operate in the 868 MHz ISM bands (or equivalent ISM bands available in non-European countries). The disarming node includes a battery power supply 362, and generally this will be the only power supply, as it is normally preferred not to have to connect the disarming nodes to the electrical grid. A speaker 363 is provided so that audible messages and instructions can be given to a user at the disarm node. These audible messages and instructions may be automatic, generated by the central unit or by the disarming node itself, but additionally the speaker 363 may be used to relay messages from a central monitoring station 190. The disarming node may also store backup files. audio for these messages and instructions in its internal memory, to avoid problems caused by the use of a low bandwidth channel (for example, an 868 MHz RF channel) between the central unit and the disarm node. A disarm node that stores such audio files can then receive instructions from the central unit to play particular messages, and do so using the stored audio files. For example, the loudspeaker can be used to provide a message of disarmament success or failure. The disarm node can also store audio files for these messages and instructions in its internal memory, to avoid problems caused by using a low bandwidth channel (for example, an 868 MHz RF channel) between the unit. central and the disarming node. A disarm node that stores such audio files may then receive instructions from the central unit to play particular messages and do so using the stored audio files. Conveniently, the disarming node also includes a microphone 364 to allow a user at the disarming node to have a conversation with a human operator at, for example, a central surveillance station 190, or even with emergency services - for example, if you connect through the central monitoring station. Alternatively, the disarming node may not include a microphone, but rather a co-located external microphone so that the user can speak to central monitoring station operators or emergency services. Preferably, the disarming node 150 is fixed to the building protected by the security surveillance system, for example, attached to an internal wall at a height convenient for user operation - for example, fixed at a height of between 1 meter and 1.5 meters from the ground.

The system prepares to arm and disarm from a disarm node. The disarming node also includes a near-field communication antenna and a microprocessor 365 to allow a disarming device, such as an NFC-enabled key fob, to be used to disarm or arm the system by placing the key within a few centimeters of the disarm node, for example, by bringing the key fob into contact with the disarm node.

The disarming node can also be configured to encrypt its radio transmissions and decrypt received signals, so that secure communications with the central unit can be established.

The encryption may be based on a secret shared between the central unit 140 and the disarming node 150.

The key fob 370 includes a processor 375, with an associated memory 376 that stores an identifier for the key fob, a transceiver 377, and a battery 378 that provides power to the processor and the transceiver. The 377 transceiver is typically a conventional polling transceiver designed for low power consumption. Such a polling transceiver, when in sleep state, periodically powers only the front-end of its receiving circuitry to listen for polling signals. If a polling signal is detected, possibly subjected to some minimum power level, the rest of the receiving circuit is energized to receive transmissions. Such a probing transceiver can listen for no more than about 100 - 125 ms each second, unless probing signals are detected.

The transceiver, of any type, is controlled by the processor and allows radio communication with the central unit 140, the disarming node 150 and the transceiver 55 of the camera 50. The key fob also includes a motion sensor 379, as for example an accelerometer, which is used to determine if someone is carrying the key fob or if they are standing still. For example, if it has been deposited inside the house, it may also include one or more buttons 380 that a user can use to issue commands or responses. The key fob may also include one or more visual indicators 385, for example, one or more LEDs, to indicate a status, confirm a button press, or the like. A single multicolor indicator, such as an LED, can be used to provide multiple different indications, keeping the number of components low and allowing the dimensions of the keychain to be compact. The keychain may also include a speaker and a haptic transducer 390, or both, to provide information to the user.

Preferably, the key fob is configured to encrypt its radio transmissions and decrypt received signals, so that secure communication with the central unit is possible. Encryption can be based on a secret shared between the mainframe and the keychain.

Figure 4 is a simplified schematic sequence diagram illustrating a method according to an aspect of the invention. In particular, it illustrates in a simplified manner how a security surveillance system according to an aspect of the invention responds when an authorized person (someone carrying a registered key fob 370) enters an area monitored by the external security surveillance camera 50. .

Let us imagine that an occupant of a premises (for example, a house) monitored by a security surveillance system according to one embodiment of the invention arms the system and then leaves the house, but then You want to pick up your bicycle or scooter from the backyard. The occupant opens the garden gate 70 and enters the area monitored by the security surveillance camera 50. The opening of the garden gate 70 activates, 400, the motion detector 60 associated with the camera 50, which causes the sending a motion activation signal to the camera processor 210. The processor 210 then activates one of the transceivers 55 to transmit, 410, a motion activation signal to the central unit 140. Upon receiving the motion activation signal from the camera 50, the central unit 140 initiates, 420, an external input timer. The central unit 140 also transmits, 430, a radio wake-up start instruction to the camera 50. Upon receiving the radio wake-up start instruction, the camera 50 uses one of its transceivers 55 to transmit, 440, a wake-up signal. low-power out-of-band activation whose intensity is sufficient to activate any 370 key fob that is within the monitored area. As the occupant carries a key fob 370, his key fob is activated and transmits, 450, a signal including the key fob ID (which can be considered the start of a login cycle). The signal from the key fob is received by the central unit 140, and if the key fob ID is registered with the central unit 140, the central unit pauses, 460, the exterior entry timer. The exterior entry timer can be stopped for a selected configurable period long enough to accommodate the usual comings and goings of an occupant. For example, if the occupant stores a bicycle in the back garden, the pause period should be long enough to allow the occupant to unlock their bicycle, put the lock away, put on their helmet and leave the garden, closing the gate behind them. This period can be of the order of one or two minutes. Meanwhile, the security surveillance system remains activated, so opening a door or window, for example, will trigger the usual arm-away response from the central unit. After the pause period has elapsed, the central unit can return to its normal armed state, so that a subsequently detected movement in the monitored area will cause the central unit to start an external entry timer again.

Alternatively, the central unit 140 can be configured to disarm the security surveillance system in step 460 - so that, for example, if the occupant carrying the key fob were to enter the house from the rear garden through the gate rear 170, the surveillance system would not generate an alarm. If this behavior is programmed into the central unit 140, then it is preferable that the disarming node in question, in this case 160, respond to the detection by the sensor 130 of the opening of the rear door 170 by providing some type of audible or visual indication that the security surveillance system has been disarmed as a result of detecting the occupant's presence in the rear yard by virtue of his or her registered key fob. For example, the disarming node could issue a welcome message confirming that "the surveillance system was armed but was disarmed when we recognized it in the backyard." Another option would be to configure the central unit to re-arm the system (to its previous armed state) in case no attempt is made to enter the house within a certain period after disarming the system, and no movement has been detected in the monitored area for a given time. This way, if the occupant has just entered the backyard to grab her bicycle or scooter and then left, the premises will once again be protected by the security surveillance system.

The security surveillance facility according to embodiments of the invention may include several external cameras 50, each with its own respective monitored zone, and the central unit may be configured to disarm the surveillance system, or suspend the timer. exterior entry, only with respect to the monitored area within which a key fob 370 has responded to a radio activation signal. If the system is configured to disarm only with respect to the monitored area in question, it can be configured to re-arm the surveillance system with respect to the previously disarmed monitored area after a period in which no motion triggers are received from the corresponding chamber 50.

Figure 5 is a sequence diagram showing, by way of contrast, what occurs when an unauthorized intruder enters the area monitored by the security surveillance camera 50. Upon entering the monitored area, the intruder activates the security detector. motion 60 associated with the camera 50, which causes a motion activation signal, 500, to be sent to the camera processor 210. The processor then activates one of the transceivers 55 to transmit, 510, a motion activation signal to the central unit 140. Upon receiving the motion activation signal from the camera 50, the central unit 140 initiates, 520, an outside entry timer. The central unit 140 also transmits, 530, a radio wake-up start instruction to the camera 50. Upon receiving the radio wake-up start instruction, the camera 50 uses one of its transceivers 55 to transmit, 540, a wake-up signal. low-power and out-of-band activation. Since the intruder is not carrying an authorized key fob 370, no response to the radio activation signal is received and, consequently, the exterior entry timer expires. Upon expiration, 550, of the exterior input timer, the central unit 140 determines an alarm event, notifies the central monitoring station 190, and instructs the camera 50 to begin transmitting image data that can be supplied to the station. surveillance center 190. The central unit 140 may also activate a siren or other alarm indicator on the premises and/or may activate announcements, for example, from the speaker of the camera 50 to alert the intruder that he has been located.

Figure 6 is a timing diagram showing the sequence of events and actions of the various elements of the security system characterizing a method, according to one embodiment of the invention, of suspending an external entry timer when detects the presence of an authorized user. The diagram refers to the operations of the entry violation detector - for example, the camera 50 including the motion detector 60, the central unit 140 and the portable authentication device 370.

The method begins, 599, with the security surveillance system in an away armed state (the described method could equally be carried out with the system in a home armed state, but generally the problem of owner-induced false alarms caused due to unintentional activation of external monitored areas arises when the systems are in the armed-away state) at 599. At 600, the motion sensor detects an event, for example the opening of the garden gate, in the external monitored area , and this causes the camera processor 210 to cause the camera RF transceiver 55 to transmit an input violation message. This input violation message, including the camera ID, is received at a transceiver of the control unit 140.

The central unit 140 starts, at 610, an entry period timer, which is set for the duration of the period within which a disarming process must be completed before the control unit causes the system to enter a disarming condition. alarm - for example, in the range of 20 to 90 seconds (a set period based on the time required for an occupant/user to disarm the arm - possibly including unlocking the rear door, entering the house and using the disarm node. The central unit identifies the detector that transmitted the motion detection message (which can be considered a form of input violation message) from the camera ID contained in the received message. The central unit 140 includes the identification code of that camera in a message that transmits, at 620, to the camera 50 to cause it to transmit, at 630, a beacon signal or polling signal to activate the transceiver of any portable authentication device (or at least of any portable authentication device that is in motion or that has not had its transceiver turned off after a period of inactivity) that is in the vicinity of the target camera 50, and preferably includes a special identifier that will be included in the signal of beacon or polling, and details of a packet countdown (to be described later) that will be used. The special identifier will normally be a random or pseudo-random number whose value changes with each use. The portable authentication device 370 listens for beacon signals on one or more channels whose parameters are known to each of the portable authentication devices, for example by having been pre-programmed, but more preferably by having been communicated to the or each portable authentication device. when that portable authentication device was first registered with the central unit (although, of course, the central unit could periodically update these parameters through an exchange of messages with the portable authentication device(s). The characteristics of the beacon or polling signal transmitted by the camera 50 are preferably chosen so that the effective range of the beacon signal is small, preferably on the order of a few meters, for example no more than 5 meters (but, for example, course, depending on the extent of the monitored area and the range within which an authorized person is likely to wander) for detection by a portable authentication device 370, so that it is only effective for activating a portable authentication device 370 in the vicinity of chamber 50. These features will be described in more detail later.

The transceiver 377 of a portable authentication device 370 that is located a few meters from the camera 50 (and that is not currently in a powered off state after a period of inactivity determined based on the signals from the motion sensor 379) detects, 640, the beacon signal is activated. Transceiver 377 receives and decodes the beacon signal, recovering the special identifier (if used). Next, the controller 375 of the portable authentication device 370 causes the transceiver 377 of the portable authentication device to transmit, at 650, a message including the ID of the portable authentication device and the special identifier (if used) to the central unit. 140.

The central unit 140 checks that the special identifier (if used) is valid (i.e., that it is one issued within the current outside entry timer period) and also checks whether the ID of the portable authentication device corresponds to one registered with the central unit. If both checks are passed (if a special identifier is used), the central unit, at 660, may suspend the system if the message from the portable authentication device 370, containing the identifier of the portable authentication device and the special identifier ( if used), was received before the exterior input timer expired. In this phase, the control unit 140 may also send, 670, another message to the camera 50 to cause the camera to provide, 680, a notification of the fact that the presence of an authorized key fob 370 has been detected and that it is has suspended the exterior entry period timer. For example, the camera may activate an appropriate light indicator 265 and/or provide a "Welcome" sound or announcement through speaker 260. The camera 50 may also be instructed to send, 685, an additional message to the wearable authentication device. 370 to cause the key fob to generate, 690, a signal indicating successful recognition - for example, by illuminating an indicator on the wearable authentication device, emitting an announcement or sound, or vibrating in a characteristic manner.

As will be described below, the disarm request message sent by the portable authentication device 370 to the control unit 140 may also include a report on the RSSI levels of the messages received by the portable authentication device 370 from the camera 50. , and the control unit 140 may use the information about the RSSI levels measured in such a report to determine whether or not to trust the received disarm request, that is, whether to discard the disarm request as invalid on the basis that it is likely coming from a rogue actor (outside the camera's usual range) rather than an authorized user within the camera's range.

At 695, if an appropriate message is not received from a portable authentication device 370 within the exterior entry timer and no appropriate disarm credentials are received before the exterior entry timer expires, the control unit 140 identifies a state alarm. If the system is supported by a central monitoring station (CMS) 190, the central unit 140 will send a state change message to the CMS 190, typically with the identifier of the camera that first indicated the motion event (as a entry violation example). The CMS 190 may then cause the central unit 140 to activate the camera (and possibly other video cameras) or other image capture devices, audio capture devices, etc., and provide data from these to the CMS 190. . CMS may also invoke human intervention, as appropriate.

Figure 7 is a flow chart illustrating a possible process for a portable authentication device 370 according to an embodiment of the invention to determine whether to respond to a received transmission. At 1000, the portable authentication device receives an RF transmission on its transceiver (the transceiver has not been turned off after determining that the portable authentication device is stopped). As a first step, 1100, the portable authentication device determines whether the received transmission is a disarming instruction, that is, whether it includes a disarming transmission identifier of some kind, for example, an activation beacon (for example, of a camera 50 as described above) or a disarm success or failure message. If the determination is negative, that is, it is not a disarming instruction, the process proceeds to step 1200.

If the determination is positive, the process proceeds to step 1300 in which the movement status of the portable authentication device 370 is checked. If it is determined that the portable authentication device is stopped, the process proceeds to step 1400. If The portable authentication device is configured to turn off its transceiver after a period of inactivity, when the key fob 370 is considered to be stopped, the portable authentication device will not subsequently receive any RF transmission (until it is detected that the portable authentication device has been moved again) and therefore this process will not take place. But if it is determined that the portable authentication device is moving, at 1600, the process continues to step 1800.

At step 1400, the processor 375 determines whether the portable authentication device 370 should be considered stopped, for example, by checking a count (or some other measure of elapsed time) since the portable authentication device was last determined to be stopped. moving. If the count is less than a predetermined threshold, it is determined, 1500, that the portable authentication device 370 is an "active" portable authentication device that can be used to provide a disarm instruction to the central unit (i.e., the portable authentication device is not considered stopped), and the process continues at step 1800. If the portable authentication device is considered stopped, then the portable authentication device 370 will not transmit any disarm message and the process will end at 1700 .

The period of inactivity that is accepted as an indication that a portable authentication device 370 is "active" may be set differently in different installations, but typically this period will not exceed about 60 seconds. A 30-second interruption is usually sufficient for most users, although in system installations where the occupants or users of the protected space are elderly or infirm, 30 seconds may not be sufficient. It is preferable that the disconnection period be relatively short, no more than a minute or so.

If it is determined in step 1300 that the portable authentication device is moving 1600, the process proceeds to step 1800.

At step 1800, the wearable authentication device generates a broadcast message including the wearable authentication device ID, and the disarm broadcast identifier (if used), and other parameters as required by the system (e.g., a report). of measured RSSI).

At step 1200, when it is determined that the transmission is not a disarm instruction, the portable authentication device may be programmed to simply read the transmission and act on the content, or to check for one or more particular flags and respond. differently depending on the indicator(s) determined to be present. Therefore, for example, the surveillance system may be arranged such that the portable authentication device 370 is configured to receive an instruction other than a disarm instruction via the transceiver, including an indicator, from the security unit. control to carry out an action; and wherein in the event that the other instruction includes the flag, the processor is configured to cause the portable authentication device to perform the indicated action regardless of whether, when the instruction is received, the authentication device is determined to laptop is stopped or not. Portable authentication devices 370 configured in this way can be activated by an RF signal, either from the control unit or from a disarming node, allowing the status of all portable authentication devices to be checked and/or updated. within reach. It would also be possible to carry out an audit of all portable authentication devices within range of, for example, the mainframe. If such a portable authentication device 370 includes one or more of a visual indicator 385, an audio transducer 390, a haptic transducer 390, and is further configured to generate an output using one or more of them when indicated by a received instruction that includes the flag, a lost portable authentication device could be caused to announce itself. Of course, this approach would only work with all portable authentication devices if they were not configured to turn off their transceivers after a period of inactivity, or if none of them had turned off their transceiver when the RF signal was transmitted from the control unit or the disarm node.

The portable authentication devices 370 according to the invention can be configured to listen to instructions related to hands-free disarming (including transmissions from external cameras 50 as described above) only on a certain channel or channels, with a frequency and modulation given, but to listen to another channel or channels at a different frequency and possibly with a different modulation for other classes of instructions.

Disarm instructions received from a disarm node typically do not contain a portable authentication device identifier, since if more than one portable authentication device is registered with the central unit, it cannot be assumed which portable authentication device carries the person who opened the door whose opening was detected. But another message may be directed to a particular portable authentication device or to a group of portable authentication devices that is a subset of all registered portable authentication devices. Accordingly, a portable authentication device according to embodiments of the invention may also be arranged to check the content of received messages for the presence of IDs of that portable authentication device. In this way, the control unit 140 can be addressed to an individual portable authentication device 370 or a group of portable authentication devices. For example, in the event that a portable authentication device has been lost, the central unit could transmit an "announce me" message marked with the ID of the particular portable authentication device that has been lost. If other portable authentication devices receive the message, they do not respond to it, because it is marked as an "announce me" message and does not contain your ID. Instead, the lost wearable authentication device sees that the message is marked as an "announce me" message, recognizes its own identifier, and announces its presence using one or more of its built-in indicators (for example, one or more LEDs or a haptic announcement). , like a "buzz" or vibration).

In general, surveillance systems according to embodiments of the invention will not be configured to transmit only disarm messages to the portable authentication devices, but will also be configured to send other types of messages to the portable authentication devices. 370. In systems that only send disarm messages to portable authentication devices 370, a portable authentication device need only recognize a received message as a disarm message and respond with the disarm transmission identifier (if used) and the identifier of the portable authentication device (although, as explained later, portable authentication devices may be required to perform RSSI measurements and include them, or a report based on them, as part of the response). But in systems where additional message types exist, the message types will typically be classified into two classes: messages directed to a subset of one or more of all registered portable authentication devices, which include one or more device IDs authentication devices, and with respect to which a reaction is sought only from the portable authentication device or devices that have an identifier included in the message; and group or general messages, for which a reaction is sought from any portable authentication device receiving the message - and which therefore do not need to include a portable authentication device identifier (and which therefore generally do not will include no portable authentication device ID). For example, a central unit may be configured to instruct the portable authentication device involved in a hands-free disarming event to provide a disarming success indicator in a successful disarming event. Such a command will preferably include the ID of the portable authentication device that transmitted the disarming request to the central unit (the ID of the portable authentication device having been included in said disarming request).

Messages can be sent to the portable authentication devices 370 at least from the control unit (which, in some systems, may be more than one), the disarming nodes 150 and the external surveillance cameras 50. When there are multiple types of messages, they can be labeled as Disarm Message, Group and Addressed, labels that can be considered as class indicators. If finer granularity is required, an additional level of flags can be provided, so that a message type is indicated by a primary flag (Disarm, Group, or Directed Message) and (at least for Group and Directed) a flag. secondary indicating the specific message type within the class. Alternatively, a single level of indicators can be provided, with multiple indicators typically for each of the Group and Directed classes.

Within the 868/869 MHz band in Europe, the subband between 869.7 and 870 MHz is especially interesting for use in the transmission of short-range beacon signals from disarming nodes, since it provides a relatively wide, the beacon channel, which allows the use of a high data rate, for example 250 kbit/s, which is useful to reduce the effective range of the beacon signal. The effective radiated power ceiling of 5 mW is also not a significant limitation for this application. For these reasons, this subband between 869.7 and 870 MHz is the preferred frequency band for short-range disarming node transmissions - and used for communication with portable authentication devices, e.g. of activation messages.

Although, for the reasons just explained, we prefer to transmit the beacons from the disarming node closest to the input that gave rise to the alarm activation signal, there are possible alternatives.

For example, a sensor that detects the violation of an input transmits an alarm activation signal, including a sensor identifier, which is detected by the control unit. The control unit recognizes the sensor ID and uses it to retrieve the ID of the disarm node associated with the sensor in question. The control unit then transmits a message, which may be an activation message, including the identifier of the disarming node in question, which has the effect of causing the disarming node in question to listen to the keyfob signals. (portable identification devices). The control unit then transmits a keychain activation signal that can be received by any keychain adjacent to any of the disarm nodes. Any keyfob that receives the keyfob activation signal from the control unit then responds by transmitting a response signal, including its own identifier, which can only be detected by a disarm node no more than approx. 2 meters from the key fob (using appropriately selected transmission characteristics of power, data rate, etc. to ensure a short effective transmission range). A disarming node that receives the keyfob response signal then transmits a signal, including the keyfob identifier, to the control unit, which then determines whether the keyfob identifier corresponds to a registered keyfob. In this way, only the disarming node whose identifier was included in the transmission from the control unit detects the keyfob response.

As a further alternative, the disarming node may be configured to generate an alarm activation signal that is transmitted to the control unit in response to receiving an input violation signal from a sensor configured to detect violation of an alarm. entrance to the building or protected space. That is, the sensor transmits a signal regarding a detected violation, which is received by the associated disarming node and not by the control unit. The control unit then transmits a keychain activation signal that can be received by any keychain adjacent to any of the disarm nodes. Any key fob that receives the key fob activation signal from the control unit then responds by transmitting a response signal, including its own identifier, which can only be detected by a disarm node located no further than approximately 2 meters away. of the keychain. A disarming node that receives the keyfob response signal then transmits a signal, including the keyfob identifier, to the control unit, which then determines whether the keyfob identifier corresponds to a registered keyfob. In this way, only the disarming node whose identifier was included in the transmission from the control unit detects the keyfob response. However, this approach is less preferable than the alternatives already mentioned, because if the signal from the sensor that detects the violation of an input is only received by the control unit through the disarm node, instead of directly, the security system is reduced - the disarming node becomes a point of weakness, because if it is disabled or its signals blocked in any way by a malicious actor, the control unit will not receive any alarm activation signal regarding the violation . For this reason, it would be desirable to include anti-tamper features in the disarm node, such as sensors to detect and report attempts to open the disarm node, and possibly also implement a "heartbeat" function in which the disarm node periodically "registers" with the control unit - failure of the control unit to receive the heartbeat, or receipt of a tamper message from the disarm node causes the control unit to determine an alarm condition which notifies the central monitoring station (if present) and provides alarm signals (auditory and optical) through the alarm facility - as well as sending reports to the user's phone - email, as appropriate. Such additional security features may also be present in the disarming nodes according to any of the other embodiments and variants.

Achieving effective battery life for the nodes and sensors of alarm and surveillance systems is a constant concern, because battery failure disables the node or sensor in question, which can lead to a loss of security, and replacement Battery replacement may involve an on-site visit to the system supplier, which is expensive and inconvenient. In the case of a portable authentication device, loss of battery means that the device stops working, which is inconvenient for the user, and the cause of the failure may not be obvious to the user, so the user may have have to go on site to identify and solve the problem. Consequently, we are interested in reducing power consumption on all battery-operated components of the system, including the wearable authentication device. For this reason, the use of a radio-activated receiver in the portable authentication device is attractive, although acceptable battery life can also be obtained by using a more conventional radio receiver that is activated periodically to listen (probe) for signals. of beacon.

One way to reduce the power consumption of the portable authentication device during the activation process is for the portable authentication device to use two-phase detection, an example of which is illustrated in Figure 8. A first phase of transceiver detection of the portable authentication device can be used to carry out a first step that simply involves checking an RSSI level. For example, the transceiver in the portable authentication device may periodically perform a brief RSSI check by polling the beacon channel, using only the RF front-end of the transceiver, for example for a first period of less than a few milliseconds, preferably a fraction of a millisecond, for example around 0.5 milliseconds, and then return to its idle state if the detected RSSI level is below some preset threshold. If the detected RSSI level is above the threshold, the wearable authentication device briefly listens for a synchronization word from the disarming node, for example, for a second period of a few milliseconds, for example, less than 10 milliseconds, for example, 5 ms. If no sync word is detected, the transceiver returns to its idle state. But if a synchronization word is detected, the transceiver starts the entire radio receiver which remains on, for example, for a third period of between plus and minus 8 and 16 ms, for example 10 ms, to receive the complete activation packet. Each packet will typically last on the order of 220 gis, and the disarming node can transmit for 2 to 4 seconds, for example, for 3 seconds - meaning that the portable authentication device should be able to receive 20 to 30 packets. Obviously, the choice of the length of the various periods is a compromise between power consumption, user experience and accuracy, but the times indicated represent a reasonable compromise as a starting point that can be adjusted as necessary.

RSSI detection can be achieved by powering only the front-end components of the transceiver, avoiding the need to power up the entire transceiver. If the detected RSSI level is below a threshold, the portable authentication device determines that valid data is unlikely to be available and stops its RSSI check until the next cycle. The cycle period determines the time for which the disarming node needs to transmit its beacon and also sets a lower limit on how quickly hands-free disarming is likely to occur on average. The activation interval of the wearable authentication device, which is controlled by a clock on the wearable authentication device, will typically be chosen based on the duration of the disarm node beacon. For example, if the disarm node transmits its beacon for 2 seconds, then a portable authentication device activation interval of one second would provide a good probability that a portable authentication device within range of a transmitting disarm node could activated and retrieve the necessary information from the beacon signal. A portable authentication device activation interval (period between polling events) of 2 seconds will often be frequent enough when the disarming node is configured to transmit its beacon signal for 3 seconds. The activation interval of the portable authentication device can be conveniently set between one quarter and two thirds of the duration of the beacon. By having the portable authentication device check the RSSI for a very short period, such as a few milliseconds, at each polling event, good battery life can generally be achieved. A shorter relative cycle time is not technically problematic, but is likely to use proportionally more battery power and therefore proportionally shorten battery life. The cycle time could be greater than half the life of the beacon, provided that the system allows the wearable authentication device to capture the beacon quickly after being activated, so that the wearable authentication device can retrieve the necessary special identification ( if used).

The disarming node transmits a beacon signal, on the beacon channel, which preferably includes the special keyword (shown as ID in Figure 8) received from the control unit for this hands-free disarming event. Typically, the beacon signal will consist of a sequence of packets, each of which will begin with a preamble, followed by a synchronization word, and then an identifier which is the special ID coming from the central unit. Preferably, each packet includes a countdown value, which decrements by one in each successive packet (down to zero in the last packet in the sequence) and indicates the number of packets until the end of the packet sequence.

The beacon signal is recognized as such by the portable authentication device, because it is the only message of that class with the relevant format on that channel, causing the portable authentication device to transmit a response including the special keyword (special ID). .

By including sequence information in the beacon from the disarming node, it becomes possible for the wearable authentication device to determine when the beacon transmission will end. Using this information, the portable authentication device can delay transmitting its response to the central unit until the disarming node has finished transmitting, making it easier for the central unit to detect the response coming from the authentication device. portable without local interference. This means that the transmission power of the portable authentication device can be kept low, prolonging the battery life of the portable authentication device, while still allowing the control unit to receive the response from the portable authentication device. Additionally, when the wearable authentication device captures beacon packets, it can estimate how much time will pass before the sequence ends. If the captured packets are at the beginning of the sequence, the portable authentication device can "sleep" or shut down while waiting for the sequence to complete, and then wake up again to transmit its response to the central unit just after the sequence ends. finish the sequence.

The portable authentication device will listen for multiple packets so that it can use statistics to obtain a reliable RSSI cipher, and can report the RSSI cipher for each detected packet.

As an improvement, the wearable authentication device controller 375 may use motion information from the motion sensor 379 embedded in the wearable authentication device to control polling of the wearable authentication device transceiver 377. That is, polling may be suspended in the event that the processor deems that the wearable authentication device is stopped - for example, if the motion sensor detects no motion and the processor determines that a count since the last time it was determined that the wearable authentication device was in motion is greater than a predetermined threshold, the wearable authentication device is considered stopped and polling may be suspended entirely or the polling frequency may be reduced (the preferred option, as it means that the wearable authentication devices "lost" laptops can announce themselves the next time they poll). For example, the polling frequency can be reduced to one-half to one-twentieth, or less, of the usual frequency. Conversely, if the processor determines that the portable authentication device is still moving or has recently been moving (so that the portable authentication device is not considered to be stopped), the normal polling rate is maintained. The processor of the wearable authentication device can be configured to stop generating the count of the time since the wearable authentication device was last in motion after the count of the time since the keychain was last in motion. reach the default threshold value, as this can reduce the power consumption of the portable authentication device, which is good for improving battery life.

To reduce the effective range of the radio beacon, it is transmitted from the disarming node at low power (e.g. -20dBm or less) with a high data rate (e.g. 250kbps or more, say 400kbps) and with a low modulation index, to achieve an effective range of no more than about 5 meters. Using a suboptimal modulation index we achieve three things: quickly send many packets, reduce sensitivity to reduce range, and adjust to the given spectrum. We limit the power output of the disarm node to limit the range. To make reception from a greater distance difficult we have a high data rate and a low modulation index. However, the main reason is not the low budget of the link, but the speed. The higher the bitrate, the more packets can be used for estimation. The sensitivity is in the range of around -90 dBm in this configuration and we try to be line of sight, which means the distance from the transmitter is given by the channel fade with distance, using the Friis formula.

Encryption, for example, based on shared keys, is preferably used for all transmissions to and from the control unit in each of the embodiments of the invention.

As mentioned above, another option to improve security, which can be used with any or all of the preceding options to further improve system security, is for the portable authentication device to include in the response message sent to the unit control details the results of the RSSI determinations made by the portable authentication device. In particular, the disarming node may be configured to send a series of activation messages upon request by the control unit to send a disarming instruction, preferably including a unique disarming transmission identifier, to the portable authentication device. And the portable authentication device can be configured to determine the RSSI level of each of the serial messages that are received from the disarming node. The portable authentication device can be configured to include in the disarm request sent to the central unit a report based on the determined RSSI levels. For example, the portable authentication device can be configured to send a summary of the measured RSSI levels, such as the number of messages/packets measured or measured above a certain level, maximum RSSI level, average RSSI level, etc.

The inclusion of RSSI data can be used by the system to reduce the system's susceptibility to "relay attacks" of the type used to fool passive entry systems (PES) in cars.

The wearable authentication device would report RSSI values such as max/min values. and an average, and the central unit could maintain factory preset values for a "real" disarm, and/or these could be supplemented or replaced by real world values obtained during commissioning/testing of the system.

Instead of the control unit verifying the identity of the portable authentication device, it would also be possible for the disarming node(s) to include a list of registered portable authentication devices and for the disarming node(s), rather than the control, will carry out verification of the identity of the authentication device upon receiving the response from the authentication devices to the activation signal/beacon. The disarming node would transmit an alarm disable message to the control unit in case of successful authentication. Such an approach would, of course, require the control unit to update the disarming node(s) with additions and deletions to the list of registered authentication devices. This is a less preferred approach due to the need to increase the burden of keeping the lists up to date on both the control unit and the disarming node(s).

Furthermore, although as described so far any disarm transmission identifier or event ID has been generated by the central unit and then transmitted to a disarm node for inclusion in a activation message from the disarm node , other alternatives are of course possible. For example, the disarm node could itself generate a disarm transmission identifier or event ID and provide it to the central unit so that it checks any received keychain transmission for the presence of the disarm transmission identifier or event ID. correct event, or check itself any received keychain transmission to verify the presence of the correct disarm transmission identifier or event ID and transmit the result of the check to the central unit. In general, it is preferable for the central unit to generate and check the disarm transmission identifier or event ID, rather than delegating one or both functions to a disarm node, as this reduces the risk of a malicious actor adopting the appearance of a disarming node to fool the system.

Claims (20)

1. A security surveillance system including: a system controller; a video camera arrangement (50), coupled to a motion sensor (60), arranged to monitor a surveillance area; a portable token (370) that stores a token ID; the video camera (50) being configured so that, upon receiving a motion detection signal from the motion sensor (60), it sends an alert to the system controller; the system controller being configured so that, in the armed state, upon receiving an alert from the video camera (50), it starts an event timer and sends an instruction to the video camera (50) to emit an alarm signal. witness activation (370); the instruction including an event identifier; the video camera (50) being further configured to, upon receiving the instruction from the system controller, emit a witness activation signal (370) including the event identifier; the portable token (370) being configured to respond to the reception of a token activation signal (370) from the video camera (50) by issuing a response including the token ID and the event identifier; the system controller being further configured so that: upon receiving a response from the witness (370): comparing the event identifier included in the response with the event identifier included in the instruction to the video camera (50); comparing the witness ID included in the response with one or more stored witness IDs; and suspend the event timer if both comparisons provide a match; If no response is received or one or both comparisons do not provide a match, determine an alarm event upon expiration of the event timer. 2. A security surveillance system as claimed in claim 1, wherein the video camera (50) and the motion sensor (60) are arranged to monitor a surveillance area and the video camera (50) is configures to emit the token activation signal (370) as a radio signal that has an effective range that does not extend significantly beyond the surveillance area. 3. A security surveillance system as claimed in claim 1 or claim 2, wherein the portable witness (370) includes a processor coupled to a witness motion sensor (370), and the witness (370) is configured to respond to token activation signals (370) only if the processor determines that token (370) is moving. 4. A security surveillance system as claimed in any one of the preceding claims, wherein the RF communication means of the portable witness (370) includes a radio activation receiver, and the video camera (50) is configured to emit token activation signals (370) as radio activation signals to which the token (370) responds. 5. A security surveillance system as claimed in any one of the preceding claims, wherein the portable token (370) is configured to include RSSI data in its response to the token activation signal (370) from the camera. video (50). 6. A security surveillance system as claimed in claim 5, wherein the system controller is configured to use the RSSI data included in the response of the token (370) to determine whether to trust the received response. 7. A security surveillance system is claimed in claim 6, wherein the system controller is configured to consider the response from the token (370) as invalid if the RSSI data included in the response from the token (370) suggests that the response comes from outside the normal range of the camera's radio signals. 8. A security surveillance system as claimed in any one of the preceding claims, wherein the radio frequency transceivers (55) of the portable witness (370), the video camera (50) and the system controller are configured to operate in the industrial, scientific and medical, ISM radio bands. 9. A security surveillance system as claimed in any of the preceding claims, wherein the video camera (50) is configured, following instructions from the system controller, to transmit video images captured by the video camera ( 50) using Wi-Fi. 10. A security surveillance system as claimed in any one of the preceding claims, wherein the system controller is configured, in an armed state, to disarm the security surveillance system if both comparisons provide a match. 11. A security surveillance system as claimed in any one of claims 1 to 9, wherein the system controller is configured in an armed state, if both comparisons provide a match, to disarm the security surveillance system only regarding surveillance of the surveillance area. 12. A video camera (50) for use in a security surveillance system as claimed in any one of the preceding claims, the video camera (50) including an image sensor, a radio frequency transmitter, a receiver radio frequency, and a processor operatively connected to the image sensor, the radio frequency transmitter and the radio frequency receiver, the processor being configured, upon receiving a motion activation signal from a motion sensor (60) to: transmitting, using the radio frequency transmitter, an indicator signal to the controller of the security surveillance system; in response to receiving, by means of the radio frequency receiver, an instruction from the controller to cause the radio frequency transmitter to transmit a token activation signal (370). 13. The video camera (50) according to claim 12, wherein the witness activation signal (370) is a radio activation signal. 14. The video camera (50) as claimed in claim 12, wherein the motion sensor (60) forms part of the video camera (50). 15. The video camera (50) according to any of claims 12 to 14, wherein the radio frequency transmitter and the radio frequency receiver of the video camera are bands. 16. The video camera (50) as claimed in claim 15, wherein the radio frequency transmitter and the radio frequency receiver are configured to operate in the 868 MHz band. 17. The video camera (50) as claimed in any one of claims 12 to 16 further comprising an RF transmitter configured to transmit Wi-Fi signals. 18. The video camera (50) as claimed in claim 17, wherein the processor is configured, by instructions from the controller of a security facility, to activate the RF transmitter to transmit images via Wi-Fi. of video captured by the video camera (50). 19. A method of configuring a security surveillance system, the method comprising: providing a system controller; a remote video camera (50) coupled to a motion sensor (60); and a portable token (370) that stores a token ID; the video camera (50) being configured, upon receiving a motion detection signal from the motion sensor (60), to send an alert to the system controller; the system controller being configured, upon receiving an alert from the video camera (50), to start an event timer and to send an instruction to the video camera (50) to emit a witness activation signal (370 ), the instruction including an event identifier; the video camera (50) being further configured, upon receiving the instruction from the system controller, to emit a witness activation signal (370) including the event identifier; the portable token (370) being configured to respond to the reception of a token activation signal (370) from the video camera (50) by issuing a response including the token ID and the event identifier; upon receiving a response from the witness (370) to: comparing the event identifier included in the response with the event identifier included in the instruction to the video camera (50); comparing the witness ID included in the response with one or more stored witness IDs; and suspend the event timer if both comparisons provide a match; If no response is received or one or both comparisons do not provide a match, determine an alarm event upon expiration of the event timer. 20. A method of operating a security surveillance system, the security surveillance system including: a system controller; a video camera (50), coupled to a motion sensor (60), arranged to monitor a surveillance area; and a portable token (370) that stores a token ID; understanding the method: monitor the surveillance area using the video camera (50) and the motion sensor (60); When the video camera (50) receives a motion detection signal from the motion sensor (60), send an alert to the system controller; Upon receiving an alert from the video camera (50), the system controller starts an event timer and sends an instruction to the video camera (50) to issue a token activation signal (370), including the instruction an event identifier; The video camera (50), upon receiving the instruction from the system controller, emits a token activation signal (370) including the event identifier; The portable token (370) responds to the reception of the token activation signal (370) from the video camera (50) by emitting a response including the token ID and the event identifier; the system controller: upon receiving a response from the token (370), compare the event identifier included in the response with the event identifier included in the instruction to the video camera (50); comparing the witness ID included in the response with one or more stored witness IDs; and suspend the event timer if both comparisons provide a match; If no response is received or one or both comparisons do not provide a match, determine an alarm event upon expiration of the event timer.