RU76734U1 - BIOMETRIC NETWORK SYSTEM OF ACCESS CONTROL AND MANAGEMENT - Google Patents

Abstract

The utility model is designed to protect various objects from the penetration of unauthorized persons and can be used to create high-speed network access control and management systems (ACS) based on biometric identification intended for corporate use. The system allows you to differentiate access for the organization’s employees within its territory, as well as keep records of events in real time and generate reports based on the received data on passes. The system consists of a biometric identification terminal (BIT) (10), including a fingerprint scanner (1), a scanner controller (2) with an external memory unit (3) for storing local fingerprints, and a central controller (4) with units connected to it ( 6) and (7) light and sound indication. The central controller (4) is connected via a digital interface (23) to the control panel (PCB) (11) and to the central server (24) via a high-speed Ethernet network interface (25). The following are connected to the control panel (11): actuators (14) with control objects (15), two additional access points using electronic card readers (17), two buttons (18) for opening doors, two end sensors (19) for doors and / or turnstiles, two Wiegand outputs (20, 21) for integrating the system with systems previously installed at the facility. In the PCB (11) there are built-in: a timer (12) and a memory unit (13) containing card numbers, additional information and an event log. The system is simple in design, has wide functional capabilities (it can work in the “without biometric identification terminal” mode). System performance in network mode is 100,000 fingerprint comparisons / sec. In the double identification mode, the comparison time is no more than 1 second with a database size of 10 ⁶ prints. 3 s P. f-ly, 3 ill.

Description

The proposed utility model relates to techniques for protecting various objects (offices and other closed guarded objects) from unwanted unauthorized persons and can be used to create high-speed network access control and management systems (ACS) based on biometric identification intended for corporate use. The system allows you to differentiate access for the organization’s employees within its territory, as well as keep records of events in real time and generate reports based on the received data on passes.

Identification using biometric technologies is currently one of the most promising, rapidly developing areas, among which methods and tools using fingerprints occupy one of the leading places.

The device PW-302, produced by the Elix group, Russia, is known [see Catalog “ACS. Antiterrorism - 2005 ”, p.63], which is intended for building network access control systems and is a network controller-reader compatible with standard Proximity cards Em-Marin or HID. PW-302 consists of a reader connected electrically to each other, installed near the controlled entrance, on a turnstile, gateway, etc., and a remote controller located inside the guarded room. Network ACS integrates up to 32 access points via the RS-485 bus. Programming of the PW-302 device (up to 998 codes, a buffer for 2048 events) is carried out both from the built-in keyboard and using a computer. Light and sound indication is controlled from an ACS or an integrated processor. Thus, the functional diagram of the known device is organized as follows

image: Server (control computer) - Network adapter - Access terminal - Executive device. The access terminal consists of a reader, a controller and a light and sound indication system. Server communicates with the terminals is carried out via standard interfaces Wiegand ^'26 RS-232 and RS-485. The described access control system has wide operational capabilities, for example, in case of danger, each user can enter the “pass under duress” code, which activates an alarm output, instead of an individual code, and if necessary (card loss, etc.), it is necessary to separately remove the code from the controller’s memory taken card. If you enter an unregistered code more than three times, the keyboard is locked for a programmed time interval. The Em-Marin or HID identifier standard is selected during programming. The new PW-106 readers, developed in 2004, with an increased reading range of up to 70 cm (for standard Proximity cards) allow it to be used in objects with high passage intensities. However, a disadvantage of the known ACS is the presence of an identifier-card, which can be copied, lost, transferred to another person or damaged mechanically. In case of loss of the card, it must be re-manufactured (that is, to incur material costs). The disadvantages of the system include the impossibility of organizing a high-speed access control system, which is due to the low speed of information transfer via standard RS-485 interfaces, as well as the limited amount of the event buffer.

Known network access control based on biometric identification [see RF patent for utility model No. 48656, IPC 8 G07C 11/00, publ. 2005.10.27]. Network ACS is designed to distinguish between the access of the organization’s employees and visitors to the site or to valuable information.

Known network ACS consists of a fingerprint scanning unit, a biometric information processing unit, a relay type actuator, a control object, and a server, which is a personal computer. The structure of the fingerprint scanner includes: a fingerprint scanner connected to the scanner controller, a light indication unit and an audible warning system connected to the fingerprint scanner controller. A network adapter is built into the biometric information processing unit, which is connected to the personal computer of the system using a high-speed interface (Ethernet). The fingerprint scanner controller is connected to the executive device of the system with a dedicated digital channel. Thus, in the well-known network access control system due to the use of individual biometric parameters determined during fingerprint scanning, as well as the possibility of combining systems into a network using a high-speed interface, the range of authorized access persons has been significantly expanded, the reliability of object protection has been increased, and the speed of information exchange between system units has been increased .

However, despite these advantages, the significant disadvantages of the known ACS should include:

- limited memory capacity of 10,000 prints;

- low identification speed;

- high power consumption of the system due to the presence of a personal computer in its composition;

- insufficient system reliability caused by the presence in the processing unit of the biometric information of the hard disk;

- the presence in the network ACS of an expensive commercial operating system;

lack of integration with systems previously installed at the facilities;

- a limited number of control outputs;

- lack of the ability to connect end sensors;

- the inability to connect system access points using the industrial RS-485 interface;

-lack of the possibility of using electronic plastic cards for access control, which continue to be widely used in traditional systems.

An attempt to eliminate these shortcomings was made in a biometric network ACS [see RF patent for utility model No. 62471, IPC 8 G07C 11/00, publ. 2007.04.10], which is the closest in its technical essence to the proposed utility model.

Known biometric network ACS contains a fingerprint scanner, consisting of a fingerprint scanner and connected to the scanner controller of the light indication unit and the sound notification unit. The network system also contains an information processing unit, a network adapter connected via a high-speed interface to a personal computer, and a relay-type actuator with a control object connected to it. The fingerprint scanner is connected to the scanner controller with high-speed communication. The information processing unit includes: a central controller, a control panel connected to a central controller, and a power supply connected to a control panel and a central controller. The information processing unit is based on the AWP processor with the LINUX operating system and software. An additional central server is added to the network system, connected to the central controller via a high-speed Ethernet interface. The control and reception unit is equipped with a relay-type actuator with a control object connected to it, an input for two additional access points using electronic card readers, an input for connecting two buttons designed to open doors, an input for connecting two end sensors

doors and / or turnstiles, and two Wiegand'26 exits. The information processing unit is also equipped with an output for connecting a digital interface, for example, the industrial interface RS-485. The network system is equipped with a second, identical to the first, fingerprint scanning unit connected to the information processing unit. An additional PC can be connected in parallel with the central server of the system. Biometric scanners of network ACS can be made optical or capacitive.

Thus, in the known utility model, by introducing into the information processing unit a central controller, a receiving-control unit with peripheral devices connected to it, performing the most important of the system functional units - the information processing unit based on the AWP processor with the LINUX operating system, failure from the hard drive, as well as due to the provision of high-speed communications between the main functional blocks, the reliability of protecting objects from unauthorized access is increased, the speed of operations is increased Wier in network mode from 10,000 to 65,000 comparisons / second, expanded functionality of the inventive system.

However, despite these advantages, the well-known ACS, selected as a prototype, has the following significant disadvantages.

In the well-known network ACS, the information processing unit is based on the AWP processor with the LINUX operating system. As a result, the loading time of the operating system increases significantly (about 1 minute), which in turn leads to an increase in the time required to prepare the system for work.

Updating the local user database, distributing access rights to access objects, setting up and managing equipment, as well as setting up and managing system operation modes takes

significant time during which the system does not work. This is also a significant drawback of the analyzed system.

In addition, the known system is characterized by a very low rate of local identification, which is 50 prints / sec. The reason for this is the structural complexity and cumbersomeness of the system (a large number of electronic units, and, consequently, the parts included in them, as well as the presence in the central controller of the information processing unit of the apparatus for mathematical comparison of fingerprint codes.

The objective of the claimed utility model is to increase the speed of the system while significantly simplifying the design, reducing the size and reducing material costs necessary for the manufacture of the system. Another task posed in the development of the claimed utility model is to enable independent autonomous use of the control and reception unit of the system without communication with a biometric identification terminal.

To solve these problems, a biometric network access control and management system is proposed, which, like the system closest to it, selected as a prototype, contains a fingerprint scanner and a fingerprint scanner controller connected to it with high-speed communication, a light indication unit, and an audio warning unit . The network system also contains a central controller, which is connected to the controller of the fingerprint scanner and is equipped with an output for connecting a digital interface. A central server is connected to the central controller via a network adapter via a high-speed Ethernet network interface. A controlling personal computer equipped with a scanner for recording fingerprints and a personal computer included in the local computer network of the enterprise are connected to the same network. The central controller is connected to the control panel equipped with an executive

a relay-type device with a control object connected to it, an input for two additional access points using electronic card readers, an input for connecting two buttons designed to open doors, an input for connecting two end sensors of doors and / or turnstiles, and two Wiegand outputs.

A feature of the proposed utility model that distinguishes it from the well-known network ACS taken as a prototype is that the light indication unit and the sound notification unit are connected to the central controller and form a common module with a fingerprint scanner and a fingerprint scanner controller - a biometric identification terminal. An external memory unit for storing local fingerprints is additionally introduced into the fingerprint scanner controller, and a timer and a memory unit containing card numbers, additional information and an event log are additionally built into the control and reception unit. Communication between the control panel and the central controller is carried out via a digital interface. The number of managing personal computers and personal computers included in the local area network of the enterprise is not limited. The number of control panels is also not limited. The biometric scanner of the system can be optical or capacitive.

As already mentioned above, when creating the proposed utility model, the following main tasks were set: increasing the speed of the system, simplifying the design, reducing the size and reducing material costs, as well as the possibility of autonomous use of the control panel of the system (without a biometric identification terminal).

The tasks set during the creation of a utility model, was made possible thanks to the following.

In the proposed utility model, in contrast to the prototype, a functional diagram of the system is constructed in a fundamentally new way. An information processing unit equipped with the LINUX operating system was removed from its composition, significantly slowing down the configuration, management of operating modes and equipment management.

An essential feature included in the utility model is the introduction of a new unit into the claimed network system - a biometric identification terminal, including: a fingerprint scanner, a fingerprint scanner controller, a central controller with a network adapter, light indication and sound notification units, as well as a newly introduced to the controller of the fingerprint scanner, an external memory unit designed to store local fingerprints. The biometric identification terminal is connected via a network adapter via a high-speed Ethernet network interface to a central server, where now, unlike the prototype, a fingerprint comparison procedure is performed, which has very high speed (up to 100,000 fingerprint comparison operations per second in method 1 mode of operation: N).

An important essential feature included in the utility model formula is the introduction of a timer in the control panel of the system, which serves to count the time in the system and a memory block containing card numbers, additional information and an event log. Equipping the control and reception unit with memory, which contains the card numbers and their affiliation, provides the possibility of autonomous operation of the control and reception unit of the system without communication with the biometric identification terminal.

The rest of the newly introduced essential features related to the new relationships between the blocks of the network system, ensure the functioning of the claimed system.

Thus, the combination of the above features allows us to solve the tasks.

The proposed utility model is illustrated by drawings.

Figure 1 presents an example of a functional diagram of the inventive biometric network ACS with connected peripheral devices;

figure 2 presents one of specific examples of the installation of equipment at an access point (door);

figure 3 is a structural diagram of a specific example of building a biometric network access control system with access points of various configurations.

On the functional diagram (see figure 1) introduced the following notation:

1 - fingerprint scanner;

2 - fingerprint scanner controller;

3 - a memory unit for storing local fingerprints;

4 - central controller;

5 - network adapter;

6 - light indication unit;

7 - block sound alerts;

8 is a high-speed interface connecting the fingerprint scanner 1 to the fingerprint scanner controller 2.

The fingerprint scanner controller 2 is connected to the central controller 4 via a digital interface 9.

The blocks listed above and the connections connecting them form a single common module - a biometric identification terminal 10. 11 - a control and reception unit, which includes:

12 - timer, used to count the time in the system;

13 - memory block, contains card numbers and their affiliation; provides accounting of ≈2000 events in real time

and generating reports based on obtained pass data. The reports contain:

- time of occurrence of the event (entry / exit of employees from the territory, opening / closing of the door, etc.);

- personal data of employees and visitors of the organization, as well as recorded events that occurred.

The composition of the control panel 11 includes two actuators 14 of the relay type, designed for direct control of control objects 15 (for example, locks, turnstiles, etc.) (see figure 2). Control objects 15 (locks, turnstiles, etc.) are designed to directly unlock or lock the door 16 to the secure room.

In addition, the control panel 11 is equipped with inputs for connecting two additional readers of electronic cards 17 in the Wiegand format. The control and reception unit 11 is also equipped with: an input for connecting two buttons 18, designed to close the actuators 14 of the relay type; an input for connecting two end sensors 19 of doors, turnstiles, gateways, etc., which are used in the system to determine the state: the door is open or closed; two integration outputs 20, 21, intended for integration of the claimed network access control system with other systems (for example, with systems previously installed at the facility) via the Wiegand interface.

The central controller 4 is equipped with an output 22 for connecting to the control panel 11 via a digital interface 23, for example, via an industrial RS-485 interface.

24 - a central server, which is a computer with installed server software;

25 is a high-speed interface (Ethernet) connecting the central controller 4 to the central server 24.

Figure 3 introduced the following notation:

26 ... N - control personal computers (PCs) with installed software (software), designed to add, delete, edit the user database, distribute access rights to access objects, configure and manage equipment, as well as to configure and control modes the operation of the system as a whole or by individual access points;

27 ... M - scanners for fingerprints;

28 ... K - PCs connected to the local computer network of the enterprise with software that allows configuration, system administration, remote monitoring of system modules, time tracking;

29, 30, 31 ... P - access points of the network biometric ACS with connected peripheral devices;

32, 33, 34 ... R - access points network ACS, which include only control panels 11 (biometric identification terminal 10 is missing).

Fingerprint scanner 1 is designed to scan a fingerprint image and transfer it via a high-speed interface 8 to the controller 2 of the fingerprint scanner and then through a digital interface 9 (for example, USB, RS-232) to the central controller 4. Central controller 4 through the network adapter 5 via a high-speed interface (Ethernet) 25 exchanges information (transmits an image) with the central server 24. The controller 2 of the fingerprint scanner has an external memory 3 designed to store local fingerprints. The central controller 4 also controls the system status indicators: the light indication unit 6 and the sound notification unit 7. Blocks 6 light indication and 7 sound alerts are used for visual and sound display of the state of the system, its mode of operation. On the digital interface 23, the Central controller 4 exchanges control commands with the control panel 11. Reception

the control unit 11 contains a timer 12 for counting time in the system and a memory unit 13 in which information about employees is stored: card numbers, additional information (for example, access cards containing information about whom, where and when access can be allowed), as well as an event log. The control and reception unit 11 receives information from readers 17 of electronic cards, buttons 18, end sensors 19 of doors, turnstiles, gateways, etc., controls through actuators of relay type 14 locks, turnstiles (15), integrates with others previously installed ACS through integration outputs 20, 21.

In the claimed utility model, both optical and capacitive sensors can be used as a fingerprint scanner 1: for example, optical sensors of the Chinese company Futronic, capacitive sensors of the company UPEK, Inc. (USA), built on a specialized TouchChip module, as well as optical sensors manufactured by NITGEN (South Korea). As card readers 17, any electronic card readers with a Wiegand interface can be used. The central controller 4 is made, for example, based on the AWP processor with software developed by the applicant organization of the proposed utility model. The fingerprint scanner controller 2, as well as the control and reception unit 11 can be made on the basis of ATmega8L-8MI (MLF32) microcircuits manufactured by ATMEL (USA), as well as other industrial microcircuits, for example, ADM101EARM (mSOIC), 74HC125D ( SO-14). Actuators 14 of the relay type, which are digital microcontrollers, are assembled on the basis of industrially manufactured ATmega8-16MI (MLF32) microcircuits manufactured by ATMEL (USA) and other industrially produced electronic components. The listed electronic components and their main technical

specifications are given on the websites: www.nitgen.com, www.upek.com, www.symmetron.ru. www.itis.spb.ru.

As locks, for example, electromagnetic locks ML-395A (Taiwan), ML-194 (Russia), electromechanical lock 3VD2 or their analogues can be used.

Biometric network access control system operates as follows.

A person with access rights places a finger on the window of the fingerprint scanner 1. Fingerprint scanning is in progress. The information obtained by the fingerprint scanner 1 through the scanner controller 2 via the interface 9, for example, USB is transmitted to the central controller 4. The fingerprint image is transmitted via the network adapter 5 via the interface 25 to the central server 24, which is a multiprocessor high-speed computer. The central server 24 converts the received fingerprint into a biometric code and compares it with a database of fingerprints registered in the user system. The identification result, as well as the prohibiting or allowing command from the central server 24, is transmitted back via interface 25 via the network adapter 5 to the central controller 4. If the authentication is successful, the central server 24 through the central controller 4 issues an enable signal to the light indication unit 6 (LED lights up green) and to the sound notification unit 7 (a short beep sounds). At the same time, the central controller 4 through the interface 23, for example, RS-485 sends a control command to the control unit 11, for example, to unlock the lock, lock the lock, lock, etc. For example, with positive identification, the control panel 11 through the actuator 14 of the relay type gives an enable signal to the control object 15 (for example, opening the lock). At the same time, via integration output 20 (21) via Wiegand interface to an external

the device (not shown in FIG.) gives the Wiegand code of the identifiable person specified during registration in the administration program.

If the identification fails, the central controller 4 gives a signal to the light indication unit 6 (the LED lights up red), and a long signal sounds through the sound notification unit 7. An enable signal is not supplied to the control object 15, and a code is issued through the interface output 20 (according to the Wiegand standard): 255-65535 (all bits are set to one). If the person is identified, but the number is not specified in his settings, or the control object 15 was triggered via button 27, then output 20 gives a signal: O-O (all bits are set to zero).

When the system is in network mode, on the fingerprint scanning unit 1, the LEDs of the light indication unit 6 are continuously lit in red.

The following describes the operation of network access control in the "without biometric identification terminal 10" mode.

If the control panel 11 is used without a biometric identification terminal 10, then it is autonomous. The database (DB) of the control unit 11 contains the numbers of user cards that can be passed through the access point, as well as information necessary for accessing. In addition, the access log contains information about when, where, and to whom access is allowed. The central server 24, upon request, from the host PC 26 or from any of the PC 28 ... K can receive (download) the event log, both in real time and at a specified interval. When the card is applied to the control panel 11 or another event occurs, for example, a button 18 is pressed or the end sensor 19 is triggered, a response command is generated in the control panel 11, for example,

opening the lock if the card is recognized. After that, an appropriate entry is made in the event log.

The proposed network access control system is equipped with software designed for working with a user database (registration, modification and deletion of employees and groups), distribution of access rights, as well as for maintaining an event log and creating reports based on received pass data. The right of access can be given full or restrict the passage according to the schedule (window mode of passage). Thus, each employee can clearly indicate the days of the week and the time at which he is allowed access through a specific passage point.

It is also possible to set periods according to a schedule during which it will be possible only to pass identification without permission to pass. This mode is convenient in time tracking systems.

In addition, you can set an account expiration date. For such employees, passage will only be possible until the due date. This mode is used to organize temporary guest access.

In practice, depending on the tasks set, two methods of user identification are used, namely:

- double sequential identification method (biometric verification);

- double identification method.

1. When identifying the first (sequential) method, the user first applies a card to the reader connected to the output 17 of the control and reception unit 11, and then the user puts a finger on the scanner 1 of the biometric identification terminal 10 (see figure 1). By the card number from the database (DB) stored on the central server 24, the biometric characteristics of the fingerprint corresponding to this number are selected and only they are compared with the presented fingerprint by the 1: 1 method.

The method is characterized by high speed. With a database of 10 ⁶ fingerprints, identification takes place in less than 1 second. With positive identification by the described method, the user's authenticity is determined with 100% certainty.

2. When identifying by the second method, a card is first applied, then a finger (or vice versa). The user is searched for by the card number in the database (its number in the database is determined). Then, using the fingerprint, comparing the database with the 1: N method, the user number corresponding to the fingerprint is searched. After comparing the two numbers found in the described way, when they coincide, it is concluded that the user has successfully passed the identification.

With positive identification using this method, user authenticity is also determined with 100% certainty.

Thus, in the claimed utility model by simplifying the overall construction of the functional diagram of the system (removing from the system information processing unit equipped with the "LINUX" operating system, which significantly slows down the configuration and management of operating modes), as well as creating a fundamentally new, compact, small-sized unit - biometric identification terminal there are significant advantages compared with the prototype, namely:

- increased system performance in network mode to 100,000 comparisons / sec (in the prototype, the maximum comparison speed is 65,000 comparisons / sec);

- the possibility of autonomous use of the control panel of the system without communication with the biometric identification terminal is provided.

Claims (4)

1. A biometric network access control and management system, comprising a fingerprint scanner and a fingerprint scanner controller connected to it by high-speed communication, a light indication unit, an audible warning unit connected to a fingerprint scanner controller and equipped with an output for connecting a digital interface to a central controller, to which a central server is connected via a network adapter via a high-speed Ethernet network interface, a managing personal is connected to the same network mpyuter equipped with a scanner for entering a fingerprint, and a personal computer on the local area network of the enterprise; a control and reception unit connected to the central controller, equipped with a relay-type actuator with a control object connected to it, an input for two additional access points using electronic card readers, an input for connecting two buttons designed to open doors, an input for connecting two end sensors doors and / or turnstiles and two Wiegand outputs, characterized in that the light indication unit and the sound notification unit are connected to the central controller and Coziness with a fingerprint scanner and a fingerprint scanner controller A common module is a biometric identification terminal, while an external memory unit for storing local fingerprints is additionally introduced into the fingerprint scanner controller, and a timer and a memory unit containing numbers are additionally built into the control panel cards, additional information and an event log, while communication between the control panel and the central controller is carried out via a digital interface. 2. The biometric network access control system according to claim 1, characterized in that the number of control personal computers and personal computers included in the local computer network of the enterprise is not limited. 3. Biometric network access control system according to claim 1 or 2, characterized in that the number of control panels is not limited. 4. The biometric network access control system according to claim 1 or 2, characterized in that the biometric scanner is optical or capacitive.