US20190251765A1 - Policy-managed physical access authentication - Google Patents
Policy-managed physical access authentication Download PDFInfo
- Publication number
- US20190251765A1 US20190251765A1 US14/823,201 US201514823201A US2019251765A1 US 20190251765 A1 US20190251765 A1 US 20190251765A1 US 201514823201 A US201514823201 A US 201514823201A US 2019251765 A1 US2019251765 A1 US 2019251765A1
- Authority
- US
- United States
- Prior art keywords
- access
- authentication
- user
- requirement
- access control
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/105—Multiple levels of security
-
- G07C9/00087—
-
- G07C9/00103—
-
- G07C9/00111—
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- G07C9/00—Individual registration on entry or exit
- G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
- G07C9/00896—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys specially adapted for particular uses
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/104—Grouping of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- G07C2209/00—Indexing scheme relating to groups G07C9/00 - G07C9/38
- G07C2209/04—Access control involving a hierarchy in access rights
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- G07C2209/00—Indexing scheme relating to groups G07C9/00 - G07C9/38
- G07C2209/14—With a sequence of inputs of different identification information
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/082—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying multi-factor authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
Definitions
- This disclosure relates to systems and methods for managing physical access to an access-controlled area and, more particularly, to systems and methods for managing physical access to an access-controlled area of a distributed site of an electric power delivery system in accordance with one or more policies.
- FIG. 1 illustrates an example of a physical access management architecture consistent with embodiments disclosed herein.
- FIG. 2 illustrates a diagram showing an example of a physical access management process consistent with embodiments disclosed herein.
- FIG. 3 illustrates a method of managing physical access to an access-controlled area consistent with embodiments disclosed herein.
- FIG. 4 illustrates a functional block diagram of a resource management system consistent with embodiments disclosed herein.
- Electrical power generation and delivery systems are designed to generate, transmit, and distribute electrical energy to loads.
- Electrical power generation and delivery systems may include a variety of equipment, such as electrical generators, electrical motors, power transformers, power transmission and distribution lines, circuit breakers, switches, buses, transmission and/or feeder lines, voltage regulators, capacitor banks, and/or the like.
- equipment may be monitored, controlled, automated, and/or protected using intelligent electronic devices (“IEDs”) that receive electric power system information from the equipment, make decisions based on the information, and provide monitoring, control, protection, and/or automation outputs to the equipment.
- IEDs intelligent electronic devices
- an IED may include, for example, remote terminal units, differential relays, distance relays, directional relays, feeder relays, overcurrent relays, voltage regulator controls, voltage relays, breaker failure relays, generator relays, motor relays, automation controllers, bay controllers, meters, recloser controls, communication processors, computing platforms, programmable logic controllers (“PLCs”), programmable automation controllers, input and output modules, governors, exciters, statcom controllers, access control systems, SVC controllers, OLTC controllers, and the like.
- PLCs programmable logic controllers
- IEDs may be communicatively connected via a network that includes, for example, multiplexers, routers, hubs, gateways, firewalls, and/or switches to facilitate communications on the networks, each of which may also function as an IED.
- Networking and communication devices may also be integrated into an IED and/or be in communication with an IED.
- an IED may include a single discrete IED or a system of multiple IEDs operating together.
- Certain equipment associated with an electrical power generation and delivery system may be distributed in one or more sites and/or locations.
- a variety of equipment e.g., IEDs, network equipment, and/or the like
- distributed sites of an electrical power generation and delivery system may be located in relatively remote and/or infrequently accessed locations.
- certain distributed sites may be accessed infrequently by individuals performing maintenance, diagnostic, and/or repair activities on equipment associated with the sites (e.g., utility and/or other service personnel).
- a distributed site may include one or more access control devices including, for example, locks (e.g., electromagnetic, mechanical, and/or solenoid locks), tamper protection devices, security-hardened buildings, enclosures, and/or utility boxes, alarm systems, and/or the like.
- An access control system in communication with the one or more access control devices may be configured to allow personnel wishing to access the distributed site to authenticate their identity and/or their rights to physically access an associated access-controlled area of the distributed site and/or associated equipment.
- the access control system may issue one or more control signals to associated physical access control devices configured to allow the personnel physical access to the access-controlled area of the distributed site and/or associated equipment (e.g., by issuing a control signal configured to disengage a solenoid lock, an alarm system, and/or the like).
- the access control system and/or associated devices may establish a secure access-controlled boundary associated with the distributed site.
- An organization managing a distributed site may wish to manage physical access to an associated access-controlled area based on one or more access rules and/or conditions.
- rules and/or conditions may be based, at least in part, on an identity, role, and/or other attribute of one or more associated users wishing to gain physical access to the access-controlled area.
- the organization may wish to enforce teamwork between one or more users, enforce certain physical presence requirements between one or more users, and/or vary access control authentication methodologies based on an identity, role, and/or attribute of the one or more users and/or other access conditions.
- an organization may wish to condition physical access based on access time periods (e.g., normal business hours) and/or roles and/or other identity attributes associated with users requesting physical access.
- rules and/or conditions relating to physical access to an access-controlled area of a distributed site may be implemented, at least in part, using one or more articulated access control policies.
- enforcement of such access control policies may be based on an identity, role, and/or other attribute of users wishing to gain physical access to an access-controlled area.
- a first user may provide an associated access control system with two types of credentials uniquely identifying the user to the access control system in accordance with a multi-factor (e.g., two-factor) authentication requirement.
- the access control system may subsequently accept single-factor authentication (i.e., one type of credential) from one or more second users authenticating their access in a certain period following the authentication of the first user.
- single-factor authentication i.e., one type of credential
- access control requirements to the access-controlled area may be managed based on an associated articulated policy.
- a software module or component may include any type of computer instruction or computer executable code located within a memory device that is operable in conjunction with appropriate hardware to implement the programmed instructions.
- a software module or component may, for instance, comprise one or more physical or logical blocks of computer instructions, which may be organized as a routine, program, object, component, data structure, etc., that performs one or more tasks or implements particular abstract data types.
- a particular software module or component may comprise disparate instructions stored in different locations of a memory device, which together implement the described functionality of the module.
- a module or component may comprise a single instruction or many instructions, and may be distributed over several different code segments, among different programs, and across several memory devices.
- Some embodiments may be practiced in a distributed computing environment where tasks are performed by a remote processing device linked through a communications network.
- software modules or components may be located in local and/or remote memory storage devices.
- data being tied or rendered together in a database record may be resident in the same memory device, or across several memory devices, and may be linked together in fields of a record in a database across a network.
- Embodiments may be provided as a computer program product including a non-transitory machine-readable medium having stored thereon instructions that may be used to program a computer or other electronic device to perform processes described herein.
- the non-transitory machine-readable medium may include, but is not limited to, hard drives, floppy diskettes, optical disks, CD-ROMs, DVD-ROMs, ROMs, RAMs, EPROMs, EEPROMs, magnetic or optical cards, solid-state memory devices, or other types of media/machine-readable medium suitable for storing electronic instructions.
- the computer or other electronic device may include a processing device such as a microprocessor, microcontroller, logic circuitry, or the like.
- the processing device may further include one or more special purpose processing devices such as an application specific interface circuit (“ASIC”), PAL, PLA, PLD, field programmable gate array (“FPGA”), or any other customizable or programmable device.
- ASIC application specific interface circuit
- FPGA field programmable gate array
- FIG. 1 illustrates an example of a physical access management 100 architecture consistent with embodiments disclosed herein.
- an access control system 102 may be associated with an access-controlled area 104 of a distributed site of an electric power generation and delivery system. Consistent with embodiments disclosed herein, the access control system 102 may be configured to manage physical access to the access-controlled area 104 and/or various equipment 106 located within the access-controlled area 104 . Although illustrated in connection with an access-controlled area 104 of a distributed site of an electric power generation and delivery system, it will be appreciated that embodiments of the disclosed systems and methods may be utilized in connection with a variety of access-controlled areas.
- the access-controlled area 104 may include a variety of equipment 106 associated with the electric power generation and delivery system including, for example, one or more IEDs, network communication equipment, electrical generators, electrical motors, power transformers, power transmission and distribution lines, circuit breakers, switches, buses, transmission and/or feeder lines, voltage regulators, capacitor banks, computer systems, and/or the like.
- the access-controlled area 104 may comprise a subset of equipment 106 associated with a distributed location of an electric power generation and/or delivery system (e.g., a portion of a distribution substation).
- the access-controlled area 104 may comprise a distribution substation of an electric power delivery system.
- the access-controlled area 104 may comprise a panel and/or utility box housing equipment associated with an electrical power generation and/or delivery system.
- the access point 108 may comprise a door to a building associated with the access-controlled area 104 .
- the access point 108 may include one or more panels and/or boxes facilitating access to equipment 106 housed therein.
- the access point 108 may be associated with a particular piece of equipment (e.g., an IED or the like) within the access-controlled area 104 .
- the access point 108 may comprise an access panel to a particular piece of equipment within the access-controlled area 104 .
- Physical access by one or more users 110 , 112 to the access-controlled area 104 using the one or more access points 108 may be managed by one or more access control devices 110 associated with an access point 108 .
- an access control device 110 may be controlled by the access control system 102 in response to one or more control signals.
- the access control devices 110 may comprise one or more locks (e.g., electromagnetic, mechanical, and/or solenoid locks), alarm systems, and/or the like.
- an access control device 110 may comprise an electronically actuated lock for a door.
- the one or more access points 108 may be associated with one or more sensors 140 providing sensor information 142 to the access control system 102 relating to the access points 108 .
- the sensors 140 may provide information relating to a status and/or state of an associated access point 108 to the access control system 102 via sensor information 142 .
- the sensor information 142 may comprise, without limitation, information relating to an open/close status of an access point, occupancy tracking information generated by the access point (e.g., information providing an indication regarding a number of users that have entered the access-controlled area 104 via the access point 108 ), and/or the like.
- the access control system 102 , an associated remote authentication service 116 and/or other associated systems may comprise any suitable computing system or combination of systems configured to implement embodiments of the systems and methods disclosed herein.
- the access control system 102 , the authentication service 116 , the equipment 106 and/or other associated systems may comprise at least one processor system configured to execute instructions stored on an associated non-transitory computer-readable storage medium.
- the access control system 102 , the authentication service 116 , the equipment 106 and/or other associated systems may further comprise secure execution space configured to perform sensitive operations such as authentication credential validation, policy management and/or enforcement, and/or other aspects of the systems and methods disclosed herein.
- the access control system 102 , the authentication service 116 , the equipment 106 and/or other associated systems may further comprise software and/or hardware configured to enable electronic communication of information between the systems 102 , 106 , 116 via one or more associated network connections (e.g., network 138 ).
- network connections e.g., network 138
- the access control system 102 , the authentication service 116 , the equipment 106 and/or other associated systems may comprise a computing device executing one or more applications configured to implement embodiments of the systems and methods disclosed herein.
- the control system 102 , the authentication service 116 and/or other associated systems may comprise a laptop computer system, a desktop computer system, an IED, a server computer system and/or any other computing system and/or device that may be utilized in connection with the disclosed systems and methods.
- the various systems 102 , 106 , 116 may communicate via one or more networks comprising any suitable number of networks and/or network connections.
- the access control system 102 may communicate with the authentication service 116 via network 138 .
- the network connections may comprise a variety of network communication devices and/or channels and may utilize any suitable communication protocols and/or standards facilitating communication between the connected devices and systems.
- the network connections may comprise the Internet, a local area network, a virtual private network, and/or any other communication network utilizing one or more electronic communication technologies and/or standards (e.g., Ethernet or the like).
- the network connections may comprise a wireless carrier system such as a personal communications system (“PCS”), and/or any other suitable communication system incorporating any suitable communication standards and/or protocols.
- PCS personal communications system
- the network connections may comprise an analog mobile communications network and/or a digital mobile communications network utilizing, for example, code division multiple access (“CDMA”), Global System for Mobile Communications or Groupe Special Mobile (“GSM”), frequency division multiple access (“FDMA”), and/or time divisional multiple access (“TDMA”) standards.
- CDMA code division multiple access
- GSM Global System for Mobile Communications or Groupe Special Mobile
- FDMA frequency division multiple access
- TDMA time divisional multiple access
- the network connections may incorporate one or more satellite communication links.
- the network connections may utilize IEEE's 802.11 standards (e.g., Wi-Fi®), Bluetooth®, ultra-wide band (“UWB”), Zigbee®, and/or any other suitable communication protocol(s).
- one or more users 110 , 112 may communicate with the access control system 102 via one or more physical access control interfaces 114 (e.g., keypads, buttons, biometric scanners, badge scanners, and/or the like) to authenticate physical access to the access-controlled area 104 .
- the interface 114 may comprise a touchscreen, a keyboard, a mouse, a track pad, and/or any other suitable interface associated with the access control system 102 .
- the interface 114 may comprise a physical key and/or electronic 10-digit key pad (e.g., a keypad displayed on a touchscreen interface).
- a user 110 , 112 may enter authentication credentials 118 , 120 for authenticating their rights to physically access the access-controlled area 104 .
- a user 110 , 112 may provide the access control system 102 with authentication credentials 118 , 120 such as a personal identification number (“PIN”) or the like via a keypad interface 114 .
- the authentication credentials 118 , 120 may comprise any type of numeric (e.g., a PIN), alphanumeric, symbolic, and/or other type of authentication credentials.
- the authentication credentials may comprise a biometric sensor input, information received from a security key or card in communication with the interface (e.g., using a near field communication (“NFC”) standard), and/or the like.
- NFC near field communication
- the access control system 102 may authenticate the validity of the credentials 118 , 120 using an authentication module 122 executing thereon to determine whether the user 110 , 112 has rights to physically access the access-controlled area 104 .
- the authentication module 122 may comprise software and/or hardware configured to authenticate the validity of the authentication credentials 118 , 120 provided to the physical access control system 102 , determine whether a user 110 , 112 associated with the credentials 118 , 120 has current rights to physically access the access-controlled area 104 , and/or issue one or more responses and/or control signals 124 in connection with the same.
- the credential authentication module 122 may compare a PIN included in the authentication credentials 118 , 120 with PINs associated with personnel having current access rights to the access-controlled area 104 . If the PIN included in the authentication credentials 118 , 120 is a PIN associated with personnel having current access rights to the access-controlled area 104 , the access control system 102 may issue a control signal 124 to an access control device 110 associated with an access point 108 of the access-controlled area 104 . In certain embodiments, the control signal 124 may actuate a lock associated with the access point 108 , may disable an alarm system associated with the access point 108 , and/or the like. In further embodiments, a response indicating a successful authentication of the authentication credentials may be communicated from the access control system 102 to an associated interface 114 and/or a remote authentication service 116 .
- certain aspects of a credential authentication process may involve a remote authentication service 116 communicatively coupled to the access control system 102 (e.g., via and/or network 138 ).
- communication between the access control system 102 and one or more other systems may be facilitated, at least in part, by a communication module 126 executing on the access control system 102 .
- the access control system 102 may communicate authentication credentials 118 , 120 provided by users 110 , 112 (e.g., via an interface 114 or the like) to the remote authentication service 116 .
- a remote service authentication module 128 may make an authentication decision based on the authentication credentials 118 , 120 and/or other user and/or policy information 130 managed by the authentication service 116 (e.g., PINs associated with personnel having access rights). For example, the authentication service 116 may compare a PIN included in the authentication credentials 118 , 120 provided by the user 110 , 112 with PINs associated with personnel having current access rights to the access-controlled area 104 . Based on the results of the determination, the authentication service 116 may communicate a response to the access control system 102 indicating whether the authentication credentials 118 , 120 were authenticated by the service 116 .
- PINs associated with personnel having access rights e.g., PINs associated with personnel having access rights
- the access control system 102 and/or the remote authentication service 116 may implement multi-factor authentication processes (e.g., a two-factor authentication process) in connection with managing physical access to the access-controlled area 104 .
- authentication processes consistent with embodiments disclosed herein may include, without limitation, knowledge factor authentication (e.g., demonstrating knowledge of a password, a passphrase, a PIN, a challenge response, a pattern, etc.), ownership or possession factor authentication (e.g., demonstrating possession of a security and/or an identification card, a security token, a hardware token, a software token, a security key, etc.), and/or inherence and/or biometric factor authentication (e.g., providing fingerprint, retina, signature, voice, facial recognition, and/or other biometric identifiers), and/or the like.
- knowledge factor authentication e.g., demonstrating knowledge of a password, a passphrase, a PIN, a challenge response, a pattern, etc.
- ownership or possession factor authentication e.
- physical access authentication to the access-controlled area 104 may be managed based on one or more access rules and/or conditions.
- access rules and/or conditions may be implemented using one or more articulated policies.
- Policies may be stored and/or managed by the access control system 102 , the remote authentication service 116 and/or any other associated system as part of policy information 130 , 132 , and may be enforced by a policy enforcement module 134 .
- policies may be utilized in connection with enforcing teamwork between one or more users 110 , 112 , enforce certain physical presence requirements between one or more users 110 , 112 , vary authentication requirements and/or processes between one or more users 110 , 112 (e.g., based on an identity, role, and/or attribute of the one or more users 110 , 112 ), and/or the like. It will be appreciated that a variety of other types of policies may be articulated, and that any type of policy may be utilized in connection with the disclosed embodiments.
- Exemplary policies utilized in connection with the disclosed embodiments may comprise, without limitation, identity-based policies, role-based policies, temporal-based policies, and/or condition-based policies. It will be appreciated that in some embodiments, an articulated policy included in policy information 130 , 132 may incorporate any suitable combination of identity, attribute, role, temporal, and/or condition-based elements in connection with physical access management consistent with the disclosed embodiments.
- an identity-based policy may associate a particular user with one or more of access authentication processes and/or requirements (e.g., types of access authentication processes and/or the like). For example, an identity-based policy may articulate that when a first user (e.g., “User 1 ” 110 ) attempts to gain physical access to the access-controlled area 104 , the user 110 may authenticate their access rights using a single-factor authentication process. Similarly, an identity-based policy may articulate that when a second user (e.g., “User 2 ” 112 , which may be a subsequent user) attempts to gain access to the access-controlled area 104 , the user 112 may authenticate their access rights using a multi-factor authentication process. In this manner, authentication requirements and/or processes to gain physical access to the access-controlled area 104 may be varied between one or more users 110 , 112 .
- first user e.g., “User 1 ” 110
- the user 110 may authenticate their access rights using a single-factor authentication process.
- a role-based policy may associate a particular attribute and/or set of attributes associated with a user with one or more access authentication processes and/or requirements.
- such an attribute may comprise, for example, group membership information, user role information (e.g., authorized service technician, seniority, supervisory rights, etc.), organization attribute information, and/or the like.
- attribute information may be stored and/or accessed in policy information 132 and/or other user information managed by the access control system 102 and/or in user and/or policy information 130 managed by the authentication service 116 .
- attribute information may be stored, included in, and/or otherwise be managed using a directory service for managing computing domain networks associated with the user(s) 110 , 112 and/or an organization managing the distributed site (e.g., an Active Directory service and/or the like).
- a directory service for managing computing domain networks associated with the user(s) 110 , 112 and/or an organization managing the distributed site (e.g., an Active Directory service and/or the like).
- a role-based policy may articulate that when a first user (e.g., “User 1 ” 110 ) associated with a first attribute (e.g., a senior technician attribute) authenticates their rights to gain physical access to the access-controlled area 104 , the user 110 may be granted access for a first period of time (e.g., 24-hours).
- a first user e.g., “User 1 ” 110
- a first attribute e.g., a senior technician attribute
- a role-based policy may articulate that when a second user (e.g., “User 2 ” 112 ) associated with a second attribute (e.g., a junior technician attribute) authenticates their rights to gain physical access to the access-controlled area 104 , the user 112 may be granted access for a second period of time different than the first period of time (e.g., during normal business hours). In this manner, access to the access-controlled area 104 may be managed based on an identity of an authenticating user. In further embodiments, authentication requirements and/or processes used to gain physical access to the access-controlled area 104 may be varied based on one or more attributes associated with authenticating users 110 , 112 .
- a temporal-based policy may relate one or more access authentication processes and/or requirements to a particular time and/or time period.
- a temporal-based policy may specify that physical access to the access-controlled area 104 may be authenticated using a single-factor authentication process during standard working hours, but that outside standard working hours, mutli-factor authentication may be required. In this manner, authentication requirements and/or processes used to gain physical access to the access-controlled area 104 may be varied based on one or more temporal conditions.
- a condition-based policy may relate one or more access authentication requirements and/or processes to the satisfaction of one or more conditions.
- a condition-based policy may specify that a user that has not previously authenticated their rights to physically access the access-controlled area be required to engage in a multi-factor authentication process and/or be required to provide a particular type of authentication credential (e.g., a biometric credential and/or the like).
- a condition-based policy may, at least in part, be used to enforce certain security requirements associated with a distributed site and/or the access-controlled area 104 (e.g., requirements requiring work within the access-controlled area be performed in teams of two or more people, teams including a supervisor, and/or the like).
- an access control policy may comprise a combination of identity, attribute, temporal, and/or condition-based elements for use in connection with managing physical access to the access-controlled area 104 .
- an access control policy may specify that for a user associated with a first attribute to be allowed physical access to the access-controlled area (e.g., a guest attribute or the like), another user associated with a second attribute (e.g., an escort attribute or the like) must have authenticated their physical access rights within a certain preceding time period.
- embodiments of the disclosed systems and methods may be utilized to enforce escorted guest requirements in an access-controlled area 104 through enforcement of associated access-control policies by the access control system 102 (e.g., using a policy enforcement module 134 executing thereon and/or the like).
- embodiments of the disclosed systems and methods may be utilized in connection with enforcing and/or allowing certain “piggybacking” activities in connection with authenticating physical access rights to the access-controlled area 104 (e.g., activities where an initial user may authenticate their access in one manner and subsequent users within a typical time period may authenticate their access in another manner).
- a policy may articulate that an initial user authenticating their rights to physically access the access-controlled area may be required to perform a multi-factor authentication process, while subsequent users authenticating their physical access rights within a certain time period following the initial user may only be required to perform a single-factor authentication process.
- a first user 110 may provide the access control system 102 with two types of credentials 118 uniquely identifying the user 110 in accordance with a multi-factor authentication requirement for authenticating access to the access-controlled area 104 .
- the access control system 102 may subsequently accept single-factor authentication (e.g., single-factor authentication credentials 120 ) from a second user 112 wishing to authenticate their physical access rights to the access-controlled area 104 within a certain time period following the multi-factor authentication of the first user 110 .
- policies relating to escorted access for visitors fulfillment of certain organizational requirements (e.g., union requirements) such as access hours, escort requirements (e.g., escorts by certified employees for safety and/or trained staff), regional and/or jurisdictional requirements, etc., role and/or conditional requirements including teamwork requirements (e.g., a lead engineer may be allowed to enter an access-controlled area 104 alone, whereas a less senior engineer may be required to authenticate their access in connection with another engineer), temporal and/or conditional requirements (e.g., a technician may be allowed to enter an access-controlled area 104 on a weekend only if they are accompanied by a security officer, and/or the like.
- organizational requirements e.g., union requirements
- escort requirements e.g., escorts by certified employees for safety and/or trained staff
- regional and/or jurisdictional requirements etc.
- role and/or conditional requirements including teamwork requirements (e.g., a lead engineer may be allowed to
- data relating to physical access to the access-controlled area 104 may be generated and stored by the access control system 102 , the authentication service 116 , and/or any other associated system (e.g., stored as audited access information 136 and/or the like).
- audited access information 136 may comprise, without limitation, information regarding which user 110 , 112 physically accessed the access-controlled area 104 , a time of such access, and/or any other information relating to such access.
- audited access information 136 may be utilized in connection with comprehensive physical and cybersecurity management activities relating to the access-controlled area 104 .
- FIG. 2 illustrates a diagram 200 showing an example of a physical access management process consistent with embodiments disclosed herein.
- the physical access management process may be used to manage physical access to an access-controlled area in accordance with one or more articulated policies.
- a physical access control interface 114 an access control system 102 associated with the access-controlled area, an access control device 110 , and/or a remote authentication service 116 may be utilized in connection with managing physical access to an access-controlled area consistent with embodiments of the disclosed systems and methods.
- a first user may enter authentication credentials (e.g., a PIN, password, and/or the like) via a physical access control interface 114 .
- the credentials provided by the first user may be in accordance with first authentication requirements and/or a first authentication process.
- the authentication credentials provided by the first user may be in accordance with multi-factor authentication requirements and/or an associated process enforced by the access control system 102 .
- the first user may provide the access control system 102 with a plurality of authentication credentials via one or more physical access control interfaces 110 (e.g., a knowledge-based credential such as a PIN and a possession-based credential such as a keycard and/or information obtained therefrom).
- a knowledge-based credential such as a PIN
- a possession-based credential such as a keycard and/or information obtained therefrom.
- the access control system 102 may perform a physical authentication process based on the authentication credentials and/or the authentication request. For example, the access control system 102 may compare a knowledge-based credential and a possession-based credential provided by the first user with information associated with users having current access rights to the access-controlled area. Based on a successful authentication of the credentials provided to the access control system 102 by the first user, the access control system 102 may authenticate the first user's rights to access the access-controlled area.
- the access control system 102 may issue one or more control signals to one or more access control devices 110 associated with one or more access points of the access-controlled area. For example, in some embodiments, the access control system 102 may transmit a control signal to actuate an access control device 110 comprising a lock, may disable an alarm of an access control device 110 comprising an alarm system, and/or perform any other action to effectuate an associated access control authentication decision (e.g., a successful authentication decision and/or the like). The access control system 102 may further transmit an indication of the authentication result to an interface associated with the first user (e.g., the physical access control interface 114 or the like).
- an interface associated with the first user e.g., the physical access control interface 114 or the like.
- the access control system 102 may engage in a policy identification process.
- this policy identification process may be a part of the physical access authentication process described above.
- an access authentication policy may be identified based, at least in part, on the credentials provided to the access control system 102 by the first user.
- the policy identification process may comprise a separate process.
- the policy identification process may identify a policy for use in connection with the physical authentication process.
- the policy may articulate one or more rules and/or conditions for allowing the first user access to the access-controlled area.
- the identified policy may articulate that the first user is required to provide authentication credentials satisfying a multi-factor authentication process prior to being allowed physical access to the access-controlled area.
- the identified policy may articulate one or more rules and/or conditions for allowing subsequent user's access to the access-controlled area (e.g., second authentication requirements).
- the identified policy may articulate that a subsequent user may be allowed physical access to the access-controlled area through satisfaction of a single-factor authentication process.
- a second user may subsequently enter authentication credentials (e.g., a PIN, password, and/or the like) via the physical access control interface 114 .
- the credentials provided by the second user may be in accordance with second authentication requirements and/or a second authentication process associated with an identified policy.
- the authentication credentials provided by the second user may be in accordance with single-factor authentication requirements and/or an associated process enforced by the access control system 102 .
- the second user may provide the access control system 102 with a single type of authentication credential via one or more physical access control interfaces 114 (e.g., a possession-based credential such as a keycard and/or information obtained therefrom) to authenticate their physical access to the access-controlled area.
- the access control system 102 may perform a physical authentication process based on the authentication credentials, the authentication request, and/or any applicable policy. Based on a successful authentication of the credentials provided to the access control system 102 by the second user in accordance with the applicable policy, the access control system 102 may authenticate the second user's rights to access the access-controlled area (e.g., transmitting an authentication response and/or one or more control signals to one or more access control devices to effectuate the access control decision). In some embodiments, audited access information relating to the user's interactions with the access control system may be generated and/or transmitted from the access control system 102 to the remote authentication service 116 and/or another service.
- FIG. 3 illustrates a method 300 of managing physical access to an access-controlled area consistent with embodiments disclosed herein.
- elements of the method 300 may be performed by an access control system associated with a distributed site of an electric power generation and/or delivery system.
- elements of the method 300 may be performed by a remote authentication system and/or any other suitable system and/or combination of systems.
- first authentication credentials may be received by an access control system from a first user (e.g., credentials provided via a physical access control interface).
- the first authentication credentials may comprise any of the types of credentials disclosed herein.
- An access control policy may be retrieved at 304 .
- the access control policy may specify one or more rules and/or conditions for allowing one or more user's access to an associated access-controlled area.
- the access control policy may articulate one or more authentication requirements and/or processes for allowing physical access to the access-controlled area to one or more users.
- the access control policy may comprise any suitable combination of identity, attribute, temporal, and/or condition-based elements associated with managing physical access to the access-controlled area.
- a first set of authentication requirements included in the access control policy retrieved at 304 may be identified.
- the first set of authentication requirements may articulate requirements relating authenticating rights to access the associated access-controlled area.
- the first set of authentication requirements may specify that the first user may be required to perform a multi-factor authentication process to authenticate their rights to access the access-controlled area and/or specify other aspects of an associated authentication process.
- the disclosed systems and methods may be utilized in connection with enforcing and/or allowing certain piggybacking activities in connection with authenticating physical access rights to an access-controlled area with multiple users. That is, embodiments of the disclosed systems and methods may be utilized to streamline and/or allow for different authentication requirements to be utilized by piggybacking users authenticating their physical access rights in a period following the authentication of an initial user.
- second authentication credentials may be received by the access control system from a second user at 312 (e.g., via a physical access control interface and/or like).
- the second authentication credentials may comprise any of the types of credentials disclosed herein.
- the second user may be a succeeding user to the first user, wishing to gain access to the access-controlled area subsequent to the first user and/or within a particular period of time following the first user.
- a second set of authentication requirements articulating requirements relating to authenticating rights to access the access-controlled area included in the access control policy received at 304 may be identified.
- the second set of authentication requirements may be different than the first set of authentication requirements.
- the second set of authentication requirements may specify that the a user (e.g., the second user) may only be required to perform a single-factor authentication process to authenticate their rights to access the access-controlled area and/or specify other aspects of an associated authentication process, if such a process is performed within a certain period of time following authentication of the first user.
- FIG. 4 illustrates a functional block diagram of an access control system 102 configured to manage one or more resources consistent with embodiments disclosed herein.
- the access control system 102 may comprise an IED.
- Embodiments of the access control system 102 may be utilized to implement embodiments of the systems and methods disclosed herein.
- the access control system 102 may be configured to manage physical access to an access-controlled area in accordance with one or more access control policies.
- the access control system 102 may include a communications interface 402 configured to communicate with a communication network.
- the communications interface 402 may comprise a wired and/or wireless communication interface configured to facilitate communication with a network, other systems and/or devices, and/or mobile devices.
- the access control system 102 may be configured to securely communicate with a physical access control interface in connection with receiving authentication credentials from a user, to communicate with devices in connection with issuing access control signals and/or receiving associated status information, and/or the like.
- a computer-readable storage medium 408 may be the repository of one or more modules and/or executable instructions configured to implement any of the processes described herein.
- a data bus 412 may link the communications interface 402 , a wireless communication interface 404 , and the computer-readable storage medium 408 to a processor 410 .
- the processor 410 may be configured to process communications received via the communications interface 402 .
- the processor 410 may operate using any number of processing rates and architectures.
- the processor 410 may be configured to perform various algorithms and calculations described herein using computer executable instructions stored on computer-readable storage medium 408 .
- the computer-readable storage medium 408 may be the repository of one or more modules and/or executable instructions configured to implement certain functions and/or methods described herein.
- the computer-readable storage medium 408 may include one or more access authentication modules 122 configured to perform embodiments of the physical access authentication methods disclosed herein, and/or one or more policy enforcement modules 134 configured to perform embodiments of the policy identification and/or enforcement methods disclosed herein.
- the computer-readable medium 408 may further include a communication module 126 , policy information 132 , user information 406 and/or audited access information 150 .
- the access authentication module 122 may perform physical access authentication processes consistent with embodiments disclosed herein. For example, as discussed above, in certain embodiments, the access authentication module 122 may implement a knowledge factor-based authentication process (e.g., a PIN authentication process) in connection with authenticating physical access to an access-controlled area of a distributed site. In certain embodiments, the physical access authentication module 122 may utilize authentication information (e.g., authentication credentials associated with individuals having current access rights) managed by the access control system 102 and/or an associated remote system in connection with authentication determination processes.
- a knowledge factor-based authentication process e.g., a PIN authentication process
- the physical access authentication module 122 may utilize authentication information (e.g., authentication credentials associated with individuals having current access rights) managed by the access control system 102 and/or an associated remote system in connection with authentication determination processes.
- a policy enforcement module 134 may identify one or more applicable access control policies (e.g., a policy included in policy information 132 or the like) and/or enforce such policy in connection with authentication activities performed by the authentication module 122 .
- the policy enforcement module 134 may identify one or more authentication requirements included in an applicable access control policy for a particular authentication event, and operate with the authentication module 122 to ensure such requirements are satisfied prior to granting physical access to an associated access-controlled area.
- a communication module 126 may include instructions for facilitating communication of information from the access control system 102 to other controllers, systems, devices (e.g., access control devices), resources, transient assets and/or other components in the electric power delivery system and/or a distributed site associated with the same.
- the communication module 126 may include instructions on the formatting of communications according to a predetermined protocol.
- the communication module 126 may be configured to issue one or more control signals to access control devices configured to effectuate a particular access control decision.
- the communication module 126 may be configured with subscribers to certain information, and may format message headers according to such subscription information.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Telephonic Communication Services (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
Abstract
Description
- This invention was made with U.S. Government support under Contract No.: DOE-OE0000680. The U.S. Government may have certain rights in this invention.
- This disclosure relates to systems and methods for managing physical access to an access-controlled area and, more particularly, to systems and methods for managing physical access to an access-controlled area of a distributed site of an electric power delivery system in accordance with one or more policies.
- Non-limiting and non-exhaustive embodiments of the disclosure are described, including various embodiments of the disclosure, with reference to the figures, in which:
-
FIG. 1 illustrates an example of a physical access management architecture consistent with embodiments disclosed herein. -
FIG. 2 illustrates a diagram showing an example of a physical access management process consistent with embodiments disclosed herein. -
FIG. 3 illustrates a method of managing physical access to an access-controlled area consistent with embodiments disclosed herein. -
FIG. 4 illustrates a functional block diagram of a resource management system consistent with embodiments disclosed herein. - The embodiments of the disclosure will be best understood by reference to the drawings. It will be readily understood that the components of the disclosed embodiments, as generally described and illustrated in the figures herein, could be arranged and designed in a wide variety of different configurations. Thus, the following detailed description of the embodiments of the systems and methods of the disclosure is not intended to limit the scope of the disclosure, as claimed, but is merely representative of possible embodiments of the disclosure. In addition, the steps of a method do not necessarily need to be executed in any specific order, or even sequentially, nor do the steps need be executed only once, unless otherwise specified.
- In some cases, well-known features, structures, or operations are not shown or described in detail. Furthermore, the described features, structures, or operations may be combined in any suitable manner in one or more embodiments. It will also be readily understood that the components of the embodiments, as generally described and illustrated in the figures herein, could be arranged and designed in a wide variety of different configurations. For example, throughout this specification, any reference to “one embodiment,” “an embodiment,” or “the embodiment” means that a particular feature, structure, or characteristic described in connection with that embodiment is included in at least one embodiment. Thus, the quoted phrases, or variations thereof, as recited throughout this specification are not necessarily all referring to the same embodiment.
- Electrical power generation and delivery systems are designed to generate, transmit, and distribute electrical energy to loads. Electrical power generation and delivery systems may include a variety of equipment, such as electrical generators, electrical motors, power transformers, power transmission and distribution lines, circuit breakers, switches, buses, transmission and/or feeder lines, voltage regulators, capacitor banks, and/or the like. Such equipment may be monitored, controlled, automated, and/or protected using intelligent electronic devices (“IEDs”) that receive electric power system information from the equipment, make decisions based on the information, and provide monitoring, control, protection, and/or automation outputs to the equipment.
- In some embodiments, an IED may include, for example, remote terminal units, differential relays, distance relays, directional relays, feeder relays, overcurrent relays, voltage regulator controls, voltage relays, breaker failure relays, generator relays, motor relays, automation controllers, bay controllers, meters, recloser controls, communication processors, computing platforms, programmable logic controllers (“PLCs”), programmable automation controllers, input and output modules, governors, exciters, statcom controllers, access control systems, SVC controllers, OLTC controllers, and the like. Further, in some embodiments, IEDs may be communicatively connected via a network that includes, for example, multiplexers, routers, hubs, gateways, firewalls, and/or switches to facilitate communications on the networks, each of which may also function as an IED. Networking and communication devices may also be integrated into an IED and/or be in communication with an IED. As used herein, an IED may include a single discrete IED or a system of multiple IEDs operating together.
- Certain equipment associated with an electrical power generation and delivery system may be distributed in one or more sites and/or locations. For example, a variety of equipment (e.g., IEDs, network equipment, and/or the like) may be associated with a distribution substation location of an electric power delivery system. In some circumstances, distributed sites of an electrical power generation and delivery system may be located in relatively remote and/or infrequently accessed locations. For example, certain distributed sites may be accessed infrequently by individuals performing maintenance, diagnostic, and/or repair activities on equipment associated with the sites (e.g., utility and/or other service personnel).
- To ensure the physical security of a distributed site and/or associated equipment, a distributed site may include one or more access control devices including, for example, locks (e.g., electromagnetic, mechanical, and/or solenoid locks), tamper protection devices, security-hardened buildings, enclosures, and/or utility boxes, alarm systems, and/or the like. An access control system in communication with the one or more access control devices may be configured to allow personnel wishing to access the distributed site to authenticate their identity and/or their rights to physically access an associated access-controlled area of the distributed site and/or associated equipment. Based on a successful authentication, the access control system may issue one or more control signals to associated physical access control devices configured to allow the personnel physical access to the access-controlled area of the distributed site and/or associated equipment (e.g., by issuing a control signal configured to disengage a solenoid lock, an alarm system, and/or the like). In some embodiments, the access control system and/or associated devices may establish a secure access-controlled boundary associated with the distributed site.
- An organization managing a distributed site may wish to manage physical access to an associated access-controlled area based on one or more access rules and/or conditions. In certain embodiments, such rules and/or conditions may be based, at least in part, on an identity, role, and/or other attribute of one or more associated users wishing to gain physical access to the access-controlled area. In further embodiments, the organization may wish to enforce teamwork between one or more users, enforce certain physical presence requirements between one or more users, and/or vary access control authentication methodologies based on an identity, role, and/or attribute of the one or more users and/or other access conditions. In yet further embodiments, an organization may wish to condition physical access based on access time periods (e.g., normal business hours) and/or roles and/or other identity attributes associated with users requesting physical access.
- Consistent with embodiments disclosed herein, rules and/or conditions relating to physical access to an access-controlled area of a distributed site may be implemented, at least in part, using one or more articulated access control policies. In certain embodiments, enforcement of such access control policies may be based on an identity, role, and/or other attribute of users wishing to gain physical access to an access-controlled area. For example, to authenticate rights to physically access an access-controlled area, a first user may provide an associated access control system with two types of credentials uniquely identifying the user to the access control system in accordance with a multi-factor (e.g., two-factor) authentication requirement. In accordance with an associated access control policy, the access control system may subsequently accept single-factor authentication (i.e., one type of credential) from one or more second users authenticating their access in a certain period following the authentication of the first user. In this manner, access control requirements to the access-controlled area may be managed based on an associated articulated policy.
- Several aspects of the embodiments described herein are illustrated as software modules or components. As used herein, a software module or component may include any type of computer instruction or computer executable code located within a memory device that is operable in conjunction with appropriate hardware to implement the programmed instructions. A software module or component may, for instance, comprise one or more physical or logical blocks of computer instructions, which may be organized as a routine, program, object, component, data structure, etc., that performs one or more tasks or implements particular abstract data types.
- In certain embodiments, a particular software module or component may comprise disparate instructions stored in different locations of a memory device, which together implement the described functionality of the module. Indeed, a module or component may comprise a single instruction or many instructions, and may be distributed over several different code segments, among different programs, and across several memory devices. Some embodiments may be practiced in a distributed computing environment where tasks are performed by a remote processing device linked through a communications network. In a distributed computing environment, software modules or components may be located in local and/or remote memory storage devices. In addition, data being tied or rendered together in a database record may be resident in the same memory device, or across several memory devices, and may be linked together in fields of a record in a database across a network.
- Embodiments may be provided as a computer program product including a non-transitory machine-readable medium having stored thereon instructions that may be used to program a computer or other electronic device to perform processes described herein. The non-transitory machine-readable medium may include, but is not limited to, hard drives, floppy diskettes, optical disks, CD-ROMs, DVD-ROMs, ROMs, RAMs, EPROMs, EEPROMs, magnetic or optical cards, solid-state memory devices, or other types of media/machine-readable medium suitable for storing electronic instructions. In some embodiments, the computer or other electronic device may include a processing device such as a microprocessor, microcontroller, logic circuitry, or the like. The processing device may further include one or more special purpose processing devices such as an application specific interface circuit (“ASIC”), PAL, PLA, PLD, field programmable gate array (“FPGA”), or any other customizable or programmable device.
-
FIG. 1 illustrates an example of aphysical access management 100 architecture consistent with embodiments disclosed herein. In certain embodiments, anaccess control system 102 may be associated with an access-controlledarea 104 of a distributed site of an electric power generation and delivery system. Consistent with embodiments disclosed herein, theaccess control system 102 may be configured to manage physical access to the access-controlledarea 104 and/orvarious equipment 106 located within the access-controlledarea 104. Although illustrated in connection with an access-controlledarea 104 of a distributed site of an electric power generation and delivery system, it will be appreciated that embodiments of the disclosed systems and methods may be utilized in connection with a variety of access-controlled areas. - The access-controlled
area 104 may include a variety ofequipment 106 associated with the electric power generation and delivery system including, for example, one or more IEDs, network communication equipment, electrical generators, electrical motors, power transformers, power transmission and distribution lines, circuit breakers, switches, buses, transmission and/or feeder lines, voltage regulators, capacitor banks, computer systems, and/or the like. In certain embodiments, the access-controlledarea 104 may comprise a subset ofequipment 106 associated with a distributed location of an electric power generation and/or delivery system (e.g., a portion of a distribution substation). For example, in some embodiments, the access-controlledarea 104 may comprise a distribution substation of an electric power delivery system. In further embodiments, the access-controlledarea 104 may comprise a panel and/or utility box housing equipment associated with an electrical power generation and/or delivery system. - Physical access to the access-controlled
area 104 and/orequipment 106 associated with the same may be facilitated via one or more access points 108. As illustrated, theaccess point 108 may comprise a door to a building associated with the access-controlledarea 104. In further embodiments, theaccess point 108 may include one or more panels and/or boxes facilitating access toequipment 106 housed therein. In yet further embodiments, theaccess point 108 may be associated with a particular piece of equipment (e.g., an IED or the like) within the access-controlledarea 104. For example, theaccess point 108 may comprise an access panel to a particular piece of equipment within the access-controlledarea 104. - Physical access by one or
more users area 104 using the one ormore access points 108 may be managed by one or moreaccess control devices 110 associated with anaccess point 108. In certain embodiments, anaccess control device 110 may be controlled by theaccess control system 102 in response to one or more control signals. Theaccess control devices 110 may comprise one or more locks (e.g., electromagnetic, mechanical, and/or solenoid locks), alarm systems, and/or the like. For example, in certain embodiments, anaccess control device 110 may comprise an electronically actuated lock for a door. - In some embodiments, the one or
more access points 108 may be associated with one ormore sensors 140 providingsensor information 142 to theaccess control system 102 relating to the access points 108. For example, in some embodiments, thesensors 140 may provide information relating to a status and/or state of an associatedaccess point 108 to theaccess control system 102 viasensor information 142. In some embodiments, thesensor information 142 may comprise, without limitation, information relating to an open/close status of an access point, occupancy tracking information generated by the access point (e.g., information providing an indication regarding a number of users that have entered the access-controlledarea 104 via the access point 108), and/or the like. - The
access control system 102, an associatedremote authentication service 116 and/or other associated systems (e.g., equipment 106) may comprise any suitable computing system or combination of systems configured to implement embodiments of the systems and methods disclosed herein. In certain embodiments, theaccess control system 102, theauthentication service 116, theequipment 106 and/or other associated systems may comprise at least one processor system configured to execute instructions stored on an associated non-transitory computer-readable storage medium. In some embodiments, theaccess control system 102, theauthentication service 116, theequipment 106 and/or other associated systems may further comprise secure execution space configured to perform sensitive operations such as authentication credential validation, policy management and/or enforcement, and/or other aspects of the systems and methods disclosed herein. Theaccess control system 102, theauthentication service 116, theequipment 106 and/or other associated systems may further comprise software and/or hardware configured to enable electronic communication of information between thesystems - The
access control system 102, theauthentication service 116, theequipment 106 and/or other associated systems may comprise a computing device executing one or more applications configured to implement embodiments of the systems and methods disclosed herein. In certain embodiments, thecontrol system 102, theauthentication service 116 and/or other associated systems may comprise a laptop computer system, a desktop computer system, an IED, a server computer system and/or any other computing system and/or device that may be utilized in connection with the disclosed systems and methods. - The
various systems access control system 102 may communicate with theauthentication service 116 vianetwork 138. The network connections may comprise a variety of network communication devices and/or channels and may utilize any suitable communication protocols and/or standards facilitating communication between the connected devices and systems. The network connections may comprise the Internet, a local area network, a virtual private network, and/or any other communication network utilizing one or more electronic communication technologies and/or standards (e.g., Ethernet or the like). In some embodiments, the network connections may comprise a wireless carrier system such as a personal communications system (“PCS”), and/or any other suitable communication system incorporating any suitable communication standards and/or protocols. In further embodiments, the network connections may comprise an analog mobile communications network and/or a digital mobile communications network utilizing, for example, code division multiple access (“CDMA”), Global System for Mobile Communications or Groupe Special Mobile (“GSM”), frequency division multiple access (“FDMA”), and/or time divisional multiple access (“TDMA”) standards. In certain embodiments, the network connections may incorporate one or more satellite communication links. In yet further embodiments, the network connections may utilize IEEE's 802.11 standards (e.g., Wi-Fi®), Bluetooth®, ultra-wide band (“UWB”), Zigbee®, and/or any other suitable communication protocol(s). - Consistent with embodiments disclosed herein, one or
more users access control system 102 via one or more physical access control interfaces 114 (e.g., keypads, buttons, biometric scanners, badge scanners, and/or the like) to authenticate physical access to the access-controlledarea 104. In certain embodiments, theinterface 114 may comprise a touchscreen, a keyboard, a mouse, a track pad, and/or any other suitable interface associated with theaccess control system 102. For example, theinterface 114 may comprise a physical key and/or electronic 10-digit key pad (e.g., a keypad displayed on a touchscreen interface). - Using one or
more interfaces 114 associated with theaccess control system 102, auser authentication credentials area 104. For example, auser access control system 102 withauthentication credentials keypad interface 114. Theauthentication credentials authentication credentials interfaces 114 may be used in connection with the disclosed embodiments. - After receiving the
credentials access control system 102 may authenticate the validity of thecredentials authentication module 122 executing thereon to determine whether theuser area 104. Theauthentication module 122 may comprise software and/or hardware configured to authenticate the validity of theauthentication credentials access control system 102, determine whether auser credentials area 104, and/or issue one or more responses and/orcontrol signals 124 in connection with the same. - For example, in certain embodiments, the
credential authentication module 122 may compare a PIN included in theauthentication credentials area 104. If the PIN included in theauthentication credentials area 104, theaccess control system 102 may issue acontrol signal 124 to anaccess control device 110 associated with anaccess point 108 of the access-controlledarea 104. In certain embodiments, thecontrol signal 124 may actuate a lock associated with theaccess point 108, may disable an alarm system associated with theaccess point 108, and/or the like. In further embodiments, a response indicating a successful authentication of the authentication credentials may be communicated from theaccess control system 102 to an associatedinterface 114 and/or aremote authentication service 116. - In some embodiments, certain aspects of a credential authentication process may involve a
remote authentication service 116 communicatively coupled to the access control system 102 (e.g., via and/or network 138). In certain embodiments, communication between theaccess control system 102 and one or more other systems (e.g.,remote authentication service 116,access control device 110, and/or equipment 106) may be facilitated, at least in part, by acommunication module 126 executing on theaccess control system 102. For example, theaccess control system 102 may communicateauthentication credentials users 110, 112 (e.g., via aninterface 114 or the like) to theremote authentication service 116. A remoteservice authentication module 128 may make an authentication decision based on theauthentication credentials authentication service 116 may compare a PIN included in theauthentication credentials user area 104. Based on the results of the determination, theauthentication service 116 may communicate a response to theaccess control system 102 indicating whether theauthentication credentials service 116. - In certain embodiments, the
access control system 102 and/or theremote authentication service 116 may implement multi-factor authentication processes (e.g., a two-factor authentication process) in connection with managing physical access to the access-controlledarea 104. In certain embodiments, authentication processes consistent with embodiments disclosed herein may include, without limitation, knowledge factor authentication (e.g., demonstrating knowledge of a password, a passphrase, a PIN, a challenge response, a pattern, etc.), ownership or possession factor authentication (e.g., demonstrating possession of a security and/or an identification card, a security token, a hardware token, a software token, a security key, etc.), and/or inherence and/or biometric factor authentication (e.g., providing fingerprint, retina, signature, voice, facial recognition, and/or other biometric identifiers), and/or the like. - Consistent with embodiments disclosed herein, physical access authentication to the access-controlled
area 104 may be managed based on one or more access rules and/or conditions. In some embodiments, such access rules and/or conditions may be implemented using one or more articulated policies. Policies may be stored and/or managed by theaccess control system 102, theremote authentication service 116 and/or any other associated system as part ofpolicy information 130, 132, and may be enforced by apolicy enforcement module 134. Among other things, policies may be utilized in connection with enforcing teamwork between one ormore users more users more users 110, 112 (e.g., based on an identity, role, and/or attribute of the one ormore users 110, 112), and/or the like. It will be appreciated that a variety of other types of policies may be articulated, and that any type of policy may be utilized in connection with the disclosed embodiments. - Exemplary policies utilized in connection with the disclosed embodiments may comprise, without limitation, identity-based policies, role-based policies, temporal-based policies, and/or condition-based policies. It will be appreciated that in some embodiments, an articulated policy included in
policy information 130, 132 may incorporate any suitable combination of identity, attribute, role, temporal, and/or condition-based elements in connection with physical access management consistent with the disclosed embodiments. - In some embodiments, an identity-based policy may associate a particular user with one or more of access authentication processes and/or requirements (e.g., types of access authentication processes and/or the like). For example, an identity-based policy may articulate that when a first user (e.g., “
User 1” 110) attempts to gain physical access to the access-controlledarea 104, theuser 110 may authenticate their access rights using a single-factor authentication process. Similarly, an identity-based policy may articulate that when a second user (e.g., “User 2” 112, which may be a subsequent user) attempts to gain access to the access-controlledarea 104, theuser 112 may authenticate their access rights using a multi-factor authentication process. In this manner, authentication requirements and/or processes to gain physical access to the access-controlledarea 104 may be varied between one ormore users - A role-based policy may associate a particular attribute and/or set of attributes associated with a user with one or more access authentication processes and/or requirements. In certain embodiments, such an attribute may comprise, for example, group membership information, user role information (e.g., authorized service technician, seniority, supervisory rights, etc.), organization attribute information, and/or the like. In some embodiments, attribute information may be stored and/or accessed in
policy information 132 and/or other user information managed by theaccess control system 102 and/or in user and/or policy information 130 managed by theauthentication service 116. In some embodiments, attribute information may be stored, included in, and/or otherwise be managed using a directory service for managing computing domain networks associated with the user(s) 110, 112 and/or an organization managing the distributed site (e.g., an Active Directory service and/or the like). - As an example, a role-based policy may articulate that when a first user (e.g., “
User 1” 110) associated with a first attribute (e.g., a senior technician attribute) authenticates their rights to gain physical access to the access-controlledarea 104, theuser 110 may be granted access for a first period of time (e.g., 24-hours). Similarly, a role-based policy may articulate that when a second user (e.g., “User 2” 112) associated with a second attribute (e.g., a junior technician attribute) authenticates their rights to gain physical access to the access-controlledarea 104, theuser 112 may be granted access for a second period of time different than the first period of time (e.g., during normal business hours). In this manner, access to the access-controlledarea 104 may be managed based on an identity of an authenticating user. In further embodiments, authentication requirements and/or processes used to gain physical access to the access-controlledarea 104 may be varied based on one or more attributes associated with authenticatingusers - A temporal-based policy may relate one or more access authentication processes and/or requirements to a particular time and/or time period. For example, in some embodiments, a temporal-based policy may specify that physical access to the access-controlled
area 104 may be authenticated using a single-factor authentication process during standard working hours, but that outside standard working hours, mutli-factor authentication may be required. In this manner, authentication requirements and/or processes used to gain physical access to the access-controlledarea 104 may be varied based on one or more temporal conditions. - A condition-based policy may relate one or more access authentication requirements and/or processes to the satisfaction of one or more conditions. For example, in certain embodiments, a condition-based policy may specify that a user that has not previously authenticated their rights to physically access the access-controlled area be required to engage in a multi-factor authentication process and/or be required to provide a particular type of authentication credential (e.g., a biometric credential and/or the like). In some embodiments, a condition-based policy may, at least in part, be used to enforce certain security requirements associated with a distributed site and/or the access-controlled area 104 (e.g., requirements requiring work within the access-controlled area be performed in teams of two or more people, teams including a supervisor, and/or the like).
- In certain embodiments, an access control policy may comprise a combination of identity, attribute, temporal, and/or condition-based elements for use in connection with managing physical access to the access-controlled
area 104. For example, an access control policy may specify that for a user associated with a first attribute to be allowed physical access to the access-controlled area (e.g., a guest attribute or the like), another user associated with a second attribute (e.g., an escort attribute or the like) must have authenticated their physical access rights within a certain preceding time period. In this manner, embodiments of the disclosed systems and methods may be utilized to enforce escorted guest requirements in an access-controlledarea 104 through enforcement of associated access-control policies by the access control system 102 (e.g., using apolicy enforcement module 134 executing thereon and/or the like). - In another example, embodiments of the disclosed systems and methods may be utilized in connection with enforcing and/or allowing certain “piggybacking” activities in connection with authenticating physical access rights to the access-controlled area 104 (e.g., activities where an initial user may authenticate their access in one manner and subsequent users within a typical time period may authenticate their access in another manner). For example, a policy may articulate that an initial user authenticating their rights to physically access the access-controlled area may be required to perform a multi-factor authentication process, while subsequent users authenticating their physical access rights within a certain time period following the initial user may only be required to perform a single-factor authentication process. Accordingly, as illustrated, a
first user 110 may provide theaccess control system 102 with two types ofcredentials 118 uniquely identifying theuser 110 in accordance with a multi-factor authentication requirement for authenticating access to the access-controlledarea 104. Pursuant to an associated access control policy, theaccess control system 102 may subsequently accept single-factor authentication (e.g., single-factor authentication credentials 120) from asecond user 112 wishing to authenticate their physical access rights to the access-controlledarea 104 within a certain time period following the multi-factor authentication of thefirst user 110. - A variety of other policies may be enforced in connection with embodiments of the disclosed systems and methods including, without limitation, policies relating to escorted access for visitors, fulfillment of certain organizational requirements (e.g., union requirements) such as access hours, escort requirements (e.g., escorts by certified employees for safety and/or trained staff), regional and/or jurisdictional requirements, etc., role and/or conditional requirements including teamwork requirements (e.g., a lead engineer may be allowed to enter an access-controlled
area 104 alone, whereas a less senior engineer may be required to authenticate their access in connection with another engineer), temporal and/or conditional requirements (e.g., a technician may be allowed to enter an access-controlledarea 104 on a weekend only if they are accompanied by a security officer, and/or the like. - In certain embodiments, data relating to physical access to the access-controlled
area 104 may be generated and stored by theaccess control system 102, theauthentication service 116, and/or any other associated system (e.g., stored as auditedaccess information 136 and/or the like). Such auditedaccess information 136 may comprise, without limitation, information regarding whichuser area 104, a time of such access, and/or any other information relating to such access. Among other things, auditedaccess information 136 may be utilized in connection with comprehensive physical and cybersecurity management activities relating to the access-controlledarea 104. - It will be appreciated that a number of variations can be made to the architecture and relationships presented in connection with
FIG. 1 within the scope of the inventive body of work. For example, without limitation, in some embodiments, some or all of the functions performed by theaccess control system 102 may be performed by theremote authentication service 116 and/or one or more other associated systems. Similarly, some or all of the functions performed by theremote authentication service 116 may be performed by theaccess control system 102 and/or one or more other associated systems. In further embodiments, physical access control and resource management consistent with the disclosed embodiments may be implemented in any combination of suitable systems including, for example, all-in-one door controllers. Thus it will be appreciated that the architecture and relationships illustrated inFIG. 1 are provided for purposes of illustration and explanation, and not limitation. -
FIG. 2 illustrates a diagram 200 showing an example of a physical access management process consistent with embodiments disclosed herein. The physical access management process may be used to manage physical access to an access-controlled area in accordance with one or more articulated policies. As discussed above, a physicalaccess control interface 114, anaccess control system 102 associated with the access-controlled area, anaccess control device 110, and/or aremote authentication service 116 may be utilized in connection with managing physical access to an access-controlled area consistent with embodiments of the disclosed systems and methods. - As illustrated, as part of a physical access authentication process for an access-controlled area, a first user may enter authentication credentials (e.g., a PIN, password, and/or the like) via a physical
access control interface 114. In certain embodiments, the credentials provided by the first user may be in accordance with first authentication requirements and/or a first authentication process. For example, as illustrated, the authentication credentials provided by the first user may be in accordance with multi-factor authentication requirements and/or an associated process enforced by theaccess control system 102. Accordingly, the first user may provide theaccess control system 102 with a plurality of authentication credentials via one or more physical access control interfaces 110 (e.g., a knowledge-based credential such as a PIN and a possession-based credential such as a keycard and/or information obtained therefrom). - Upon receipt of the authentication credentials, the
access control system 102 may perform a physical authentication process based on the authentication credentials and/or the authentication request. For example, theaccess control system 102 may compare a knowledge-based credential and a possession-based credential provided by the first user with information associated with users having current access rights to the access-controlled area. Based on a successful authentication of the credentials provided to theaccess control system 102 by the first user, theaccess control system 102 may authenticate the first user's rights to access the access-controlled area. - In response to a successful authentication of the first user, the
access control system 102 may issue one or more control signals to one or moreaccess control devices 110 associated with one or more access points of the access-controlled area. For example, in some embodiments, theaccess control system 102 may transmit a control signal to actuate anaccess control device 110 comprising a lock, may disable an alarm of anaccess control device 110 comprising an alarm system, and/or perform any other action to effectuate an associated access control authentication decision (e.g., a successful authentication decision and/or the like). Theaccess control system 102 may further transmit an indication of the authentication result to an interface associated with the first user (e.g., the physicalaccess control interface 114 or the like). - In some embodiments, in connection with authenticating the first user's rights to access to the access-controlled area, the
access control system 102 may engage in a policy identification process. In some embodiments, this policy identification process may be a part of the physical access authentication process described above. For example, in some embodiments, an access authentication policy may be identified based, at least in part, on the credentials provided to theaccess control system 102 by the first user. In other embodiments, the policy identification process may comprise a separate process. - In some embodiments, the policy identification process may identify a policy for use in connection with the physical authentication process. The policy may articulate one or more rules and/or conditions for allowing the first user access to the access-controlled area. For example, the identified policy may articulate that the first user is required to provide authentication credentials satisfying a multi-factor authentication process prior to being allowed physical access to the access-controlled area. In further embodiments, the identified policy may articulate one or more rules and/or conditions for allowing subsequent user's access to the access-controlled area (e.g., second authentication requirements). For example, the identified policy may articulate that a subsequent user may be allowed physical access to the access-controlled area through satisfaction of a single-factor authentication process.
- A second user may subsequently enter authentication credentials (e.g., a PIN, password, and/or the like) via the physical
access control interface 114. In certain embodiments, the credentials provided by the second user may be in accordance with second authentication requirements and/or a second authentication process associated with an identified policy. For example, as illustrated, the authentication credentials provided by the second user may be in accordance with single-factor authentication requirements and/or an associated process enforced by theaccess control system 102. Accordingly, the second user may provide theaccess control system 102 with a single type of authentication credential via one or more physical access control interfaces 114 (e.g., a possession-based credential such as a keycard and/or information obtained therefrom) to authenticate their physical access to the access-controlled area. - Upon receipt of the authentication credentials from the second user, the
access control system 102 may perform a physical authentication process based on the authentication credentials, the authentication request, and/or any applicable policy. Based on a successful authentication of the credentials provided to theaccess control system 102 by the second user in accordance with the applicable policy, theaccess control system 102 may authenticate the second user's rights to access the access-controlled area (e.g., transmitting an authentication response and/or one or more control signals to one or more access control devices to effectuate the access control decision). In some embodiments, audited access information relating to the user's interactions with the access control system may be generated and/or transmitted from theaccess control system 102 to theremote authentication service 116 and/or another service. -
FIG. 3 illustrates amethod 300 of managing physical access to an access-controlled area consistent with embodiments disclosed herein. In certain embodiments, elements of themethod 300 may be performed by an access control system associated with a distributed site of an electric power generation and/or delivery system. In further embodiments, elements of themethod 300 may be performed by a remote authentication system and/or any other suitable system and/or combination of systems. - At 302, first authentication credentials may be received by an access control system from a first user (e.g., credentials provided via a physical access control interface). In certain embodiments, the first authentication credentials may comprise any of the types of credentials disclosed herein.
- An access control policy may be retrieved at 304. In some embodiments, the access control policy may specify one or more rules and/or conditions for allowing one or more user's access to an associated access-controlled area. For example, the access control policy may articulate one or more authentication requirements and/or processes for allowing physical access to the access-controlled area to one or more users. Consistent with the disclosed embodiments, the access control policy may comprise any suitable combination of identity, attribute, temporal, and/or condition-based elements associated with managing physical access to the access-controlled area.
- At 306, a first set of authentication requirements included in the access control policy retrieved at 304 may be identified. The first set of authentication requirements may articulate requirements relating authenticating rights to access the associated access-controlled area. For example, the first set of authentication requirements may specify that the first user may be required to perform a multi-factor authentication process to authenticate their rights to access the access-controlled area and/or specify other aspects of an associated authentication process.
- A determination may be made at 308 regarding whether the authentication credentials received at 302 satisfy the first set of authentication requirements. For example, a determination may be made whether the authentication credentials are associated with a user having current physical access rights to the access-controlled site and/or whether the credentials satisfy other authentication requirements (e.g., whether a plurality of types of authentication credentials are provided to satisfy a multi-factor authentication requirement, whether particular types of required authentication credentials are provided, and/or the like). If the first set of authentication requirements are satisfied, the
method 300 may proceed to 310, where physical access to the access-controlled area may be granted to the first user (e.g., by generating one or more control signals effectuating the grant of access and/or the like). Otherwise, themethod 300 may proceed to 320, where audited access information may be generated. - In certain embodiments, the disclosed systems and methods may be utilized in connection with enforcing and/or allowing certain piggybacking activities in connection with authenticating physical access rights to an access-controlled area with multiple users. That is, embodiments of the disclosed systems and methods may be utilized to streamline and/or allow for different authentication requirements to be utilized by piggybacking users authenticating their physical access rights in a period following the authentication of an initial user.
- In connection with such a piggybacking implementation, second authentication credentials may be received by the access control system from a second user at 312 (e.g., via a physical access control interface and/or like). In certain embodiments, the second authentication credentials may comprise any of the types of credentials disclosed herein. In some circumstances, the second user may be a succeeding user to the first user, wishing to gain access to the access-controlled area subsequent to the first user and/or within a particular period of time following the first user.
- At 314, a second set of authentication requirements articulating requirements relating to authenticating rights to access the access-controlled area included in the access control policy received at 304 may be identified. In some embodiments, the second set of authentication requirements may be different than the first set of authentication requirements. For example, the second set of authentication requirements may specify that the a user (e.g., the second user) may only be required to perform a single-factor authentication process to authenticate their rights to access the access-controlled area and/or specify other aspects of an associated authentication process, if such a process is performed within a certain period of time following authentication of the first user.
- A determination may be made at 316 regarding whether the authentication credentials received at 312 satisfy the second set of authentication requirements. For example, a determination may be made as to whether the authentication credentials are associated with a user having current physical access rights to the access-controlled site and/or whether the credentials satisfy other authentication requirements (e.g., whether the credentials were provided within a certain time period following authentication of the first user and/or the like). If the second set of authentication requirements are satisfied, the
method 300 may proceed to 318, where physical access to the access-controlled area may be granted to the first user (e.g., by generating one or more control signals effectuating the grant of access and/or the like). Otherwise, themethod 300 may proceed to 320, where audited access information may be generated. In certain embodiments, data relating to physical access to the access-controlled area by the first and/or second users may be generated and stored at 320 (e.g., stored by the access controls system and/or an associated authentication service). -
FIG. 4 illustrates a functional block diagram of anaccess control system 102 configured to manage one or more resources consistent with embodiments disclosed herein. In some embodiments, theaccess control system 102 may comprise an IED. Embodiments of theaccess control system 102 may be utilized to implement embodiments of the systems and methods disclosed herein. For example, theaccess control system 102 may be configured to manage physical access to an access-controlled area in accordance with one or more access control policies. - The
access control system 102 may include acommunications interface 402 configured to communicate with a communication network. In certain embodiments, thecommunications interface 402 may comprise a wired and/or wireless communication interface configured to facilitate communication with a network, other systems and/or devices, and/or mobile devices. For example, in some embodiments, theaccess control system 102 may be configured to securely communicate with a physical access control interface in connection with receiving authentication credentials from a user, to communicate with devices in connection with issuing access control signals and/or receiving associated status information, and/or the like. - A computer-
readable storage medium 408 may be the repository of one or more modules and/or executable instructions configured to implement any of the processes described herein. Adata bus 412 may link thecommunications interface 402, awireless communication interface 404, and the computer-readable storage medium 408 to aprocessor 410. Theprocessor 410 may be configured to process communications received via thecommunications interface 402. Theprocessor 410 may operate using any number of processing rates and architectures. Theprocessor 410 may be configured to perform various algorithms and calculations described herein using computer executable instructions stored on computer-readable storage medium 408. - The computer-
readable storage medium 408 may be the repository of one or more modules and/or executable instructions configured to implement certain functions and/or methods described herein. For example, the computer-readable storage medium 408 may include one or moreaccess authentication modules 122 configured to perform embodiments of the physical access authentication methods disclosed herein, and/or one or morepolicy enforcement modules 134 configured to perform embodiments of the policy identification and/or enforcement methods disclosed herein. The computer-readable medium 408 may further include acommunication module 126,policy information 132, user information 406 and/or auditedaccess information 150. - The
access authentication module 122 may perform physical access authentication processes consistent with embodiments disclosed herein. For example, as discussed above, in certain embodiments, theaccess authentication module 122 may implement a knowledge factor-based authentication process (e.g., a PIN authentication process) in connection with authenticating physical access to an access-controlled area of a distributed site. In certain embodiments, the physicalaccess authentication module 122 may utilize authentication information (e.g., authentication credentials associated with individuals having current access rights) managed by theaccess control system 102 and/or an associated remote system in connection with authentication determination processes. - A
policy enforcement module 134 may identify one or more applicable access control policies (e.g., a policy included inpolicy information 132 or the like) and/or enforce such policy in connection with authentication activities performed by theauthentication module 122. For example, consistent with embodiments disclosed herein, thepolicy enforcement module 134 may identify one or more authentication requirements included in an applicable access control policy for a particular authentication event, and operate with theauthentication module 122 to ensure such requirements are satisfied prior to granting physical access to an associated access-controlled area. - A
communication module 126 may include instructions for facilitating communication of information from theaccess control system 102 to other controllers, systems, devices (e.g., access control devices), resources, transient assets and/or other components in the electric power delivery system and/or a distributed site associated with the same. Thecommunication module 126 may include instructions on the formatting of communications according to a predetermined protocol. In certain embodiments, thecommunication module 126 may be configured to issue one or more control signals to access control devices configured to effectuate a particular access control decision. Thecommunication module 126 may be configured with subscribers to certain information, and may format message headers according to such subscription information. - While specific embodiments and applications of the disclosure have been illustrated and described, it is to be understood that the disclosure is not limited to the precise configurations and components disclosed herein. For example, the systems and methods described herein may be applied to a variety of distributed sites of an electric power generation and delivery system. It will further be appreciated that embodiments of the disclosed systems and methods may be utilized in connection with a variety of systems, devices, and/or applications utilizing physical access control systems and methods, and/or applications that are not associated with and/or are otherwise included in an electric power delivery system. Accordingly, many changes may be made to the details of the above-described embodiments without departing from the underlying principles of this disclosure. The scope of the present invention should, therefore, be determined only by the following claims.
Claims (20)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/823,201 US10404714B1 (en) | 2015-08-11 | 2015-08-11 | Policy-managed physical access authentication |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/823,201 US10404714B1 (en) | 2015-08-11 | 2015-08-11 | Policy-managed physical access authentication |
Publications (2)
Publication Number | Publication Date |
---|---|
US20190251765A1 true US20190251765A1 (en) | 2019-08-15 |
US10404714B1 US10404714B1 (en) | 2019-09-03 |
Family
ID=67540585
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/823,201 Active 2038-01-03 US10404714B1 (en) | 2015-08-11 | 2015-08-11 | Policy-managed physical access authentication |
Country Status (1)
Country | Link |
---|---|
US (1) | US10404714B1 (en) |
Cited By (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2021076340A1 (en) * | 2019-10-17 | 2021-04-22 | Schweitzer Engineering Laboratories, Inc. | Token-based device access restriction systems |
US11171944B2 (en) * | 2016-01-29 | 2021-11-09 | Cable Television Laboratories, Inc. | Systems and methods for secure automated network attachment |
WO2021231005A1 (en) * | 2020-05-12 | 2021-11-18 | Microsoft Technology Licensing, Llc | Terminal access grant determinations based on authentication factors |
US11366451B2 (en) * | 2019-09-24 | 2022-06-21 | Rockwell Automation Technologies, Inc. | System and method for providing access to electrical circuitry based on operational status |
US11397419B2 (en) * | 2019-09-24 | 2022-07-26 | Rockwell Automation Technologies, Inc. | Electrical status indication system |
US20220358235A1 (en) * | 2021-05-05 | 2022-11-10 | EMC IP Holding Company LLC | Access Control of Protected Data Using Storage System-Based Multi-Factor Authentication |
US20230004679A1 (en) * | 2021-06-30 | 2023-01-05 | Lenovo (United States) Inc. | Role-based component access control |
US20230206371A1 (en) * | 2021-12-27 | 2023-06-29 | Rockwell Automation Technologies, Inc. | Using software encoded processing for a safety/security application to achieve sil rated integrity for retrieving authentication credentials |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11373470B1 (en) * | 2021-04-12 | 2022-06-28 | Toyota Motor Engineering & Manufacturing North America, Inc. | Systems and methods for unlocking a digital lock |
Family Cites Families (43)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7353396B2 (en) | 1995-10-02 | 2008-04-01 | Corestreet, Ltd. | Physical access control |
US6598161B1 (en) * | 1999-08-09 | 2003-07-22 | International Business Machines Corporation | Methods, systems and computer program products for multi-level encryption |
GB2353910A (en) | 1999-09-03 | 2001-03-07 | Ibm | Asset tracking using local beacons |
CN1239800C (en) | 1999-11-30 | 2006-02-01 | 博丁数字有限公司 | Electronic key device, system and method of managing electronic key information |
US7848905B2 (en) | 2000-12-26 | 2010-12-07 | Troxler Electronic Laboratories, Inc. | Methods, systems, and computer program products for locating and tracking objects |
US7676839B2 (en) | 2004-03-15 | 2010-03-09 | Xceedid | Systems and methods for access control |
US7205882B2 (en) | 2004-11-10 | 2007-04-17 | Corestreet, Ltd. | Actuating a security system using a wireless device |
US7571311B2 (en) | 2005-04-01 | 2009-08-04 | Microsoft Corporation | Scheme for sub-realms within an authentication protocol |
US7323991B1 (en) | 2005-05-12 | 2008-01-29 | Exavera Technologies Incorporated | System and method for locating and communicating with personnel and equipment in a facility |
US8296824B2 (en) | 2005-06-10 | 2012-10-23 | Microsoft Corporation | Replicating selected secrets to local domain controllers |
MY151605A (en) | 2005-07-28 | 2014-06-30 | Inventio Ag | Method of controlling access to an area |
US7437755B2 (en) * | 2005-10-26 | 2008-10-14 | Cisco Technology, Inc. | Unified network and physical premises access control server |
US8042151B2 (en) * | 2005-12-20 | 2011-10-18 | Microsoft Corporation | Application context based access control |
US8108914B2 (en) | 2006-04-25 | 2012-01-31 | Vetrix, Llc | Converged logical and physical security |
SE529849C2 (en) | 2006-04-28 | 2007-12-11 | Sics Swedish Inst Of Comp Scie | Access control system and procedure for operating the system |
US9269221B2 (en) | 2006-11-13 | 2016-02-23 | John J. Gobbi | Configuration of interfaces for a location detection system and application |
US9286481B2 (en) | 2007-01-18 | 2016-03-15 | Honeywell International Inc. | System and method for secure and distributed physical access control using smart cards |
US8035477B2 (en) | 2007-09-27 | 2011-10-11 | Gregory Paul Kirkjan | Energy-efficient electronic access control |
US20090153290A1 (en) | 2007-12-14 | 2009-06-18 | Farpointe Data, Inc., A California Corporation | Secure interface for access control systems |
WO2010067205A2 (en) | 2008-12-08 | 2010-06-17 | Sanjay Chadha | Facility security and emergency management system |
US20100201230A1 (en) | 2009-02-02 | 2010-08-12 | Schweitzer Iii Edmund O | Electric power system control system with selective enclosure |
WO2010151900A1 (en) | 2009-06-26 | 2010-12-29 | Cubic Corporation | Floating j-hooks between two bushings in housing with a single piston |
US8682245B2 (en) | 2010-09-23 | 2014-03-25 | Blackberry Limited | Communications system providing personnel access based upon near-field communication and related methods |
US20120208549A1 (en) | 2011-02-15 | 2012-08-16 | Microsoft Corporation | Automatic check-out upon location departure |
US9196104B2 (en) | 2011-03-17 | 2015-11-24 | Unikey Technologies Inc. | Wireless access control system and related methods |
US20120280789A1 (en) | 2011-05-02 | 2012-11-08 | Apigy Inc. | Systems and methods for controlling a locking mechanism using a portable electronic device |
EP2732579B1 (en) * | 2011-07-12 | 2020-06-24 | Assa Abloy Ab | Event driven second factor credential authentication |
US20140053234A1 (en) * | 2011-10-11 | 2014-02-20 | Citrix Systems, Inc. | Policy-Based Application Management |
US20130257589A1 (en) | 2012-03-29 | 2013-10-03 | Mohammad MOHIUDDIN | Access control using an electronic lock employing short range communication with mobile device |
US8494576B1 (en) | 2012-05-03 | 2013-07-23 | Sprint Communications Company L.P. | Near field communication authentication and validation to access corporate data |
DK2701124T3 (en) | 2012-08-21 | 2021-10-18 | Bekey As | Managing an access to a locality |
US20140121858A1 (en) | 2012-10-31 | 2014-05-01 | Shih-Yao Chen | Car Central Locking System Remote Control System |
US9679429B2 (en) | 2012-12-03 | 2017-06-13 | 13876 Yukon Inc. | Wireless portable lock system |
US8955076B1 (en) * | 2012-12-28 | 2015-02-10 | Emc Corporation | Controlling access to a protected resource using multiple user devices |
US9058702B2 (en) | 2013-03-12 | 2015-06-16 | Qualcomm Incorporated | Method for securely delivering indoor positioning data and applications |
US9396598B2 (en) | 2014-10-28 | 2016-07-19 | The Chamberlain Group, Inc. | Remote guest access to a secured premises |
CA2917708C (en) | 2013-07-25 | 2021-12-28 | Nymi Inc. | Preauthorized wearable biometric device, system and method for use thereof |
US20160014103A1 (en) | 2014-07-10 | 2016-01-14 | Schweitzer Engineering Laboratories, Inc. | Physical access control authentication |
US10021087B2 (en) * | 2014-09-15 | 2018-07-10 | Mansour Aaron Karimzadeh | Method and system for providing a secure communication channel to portable privatized data |
US9773363B2 (en) | 2015-08-11 | 2017-09-26 | Schweitzer Engineering Laboratories, Inc. | Transient asset management systems and methods |
US9922476B2 (en) | 2015-08-11 | 2018-03-20 | Schweitzer Engineering Laboratories, Inc. | Local access control system management using domain information updates |
US9779566B2 (en) | 2015-08-11 | 2017-10-03 | Schweitzer Engineering Laboratories, Inc. | Resource management based on physical authentication and authorization |
US20170046890A1 (en) | 2015-08-11 | 2017-02-16 | Schweitzer Engineering Laboratories, Inc. | Physical access management using a domain controller |
-
2015
- 2015-08-11 US US14/823,201 patent/US10404714B1/en active Active
Cited By (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11171944B2 (en) * | 2016-01-29 | 2021-11-09 | Cable Television Laboratories, Inc. | Systems and methods for secure automated network attachment |
US20220060468A1 (en) * | 2016-01-29 | 2022-02-24 | Cable Television Laboratories, Inc. | Systems and methods for secure automated network attachment |
US11924192B2 (en) * | 2016-01-29 | 2024-03-05 | Cable Television Laboratories, Inc. | Systems and methods for secure automated network attachment |
US11366451B2 (en) * | 2019-09-24 | 2022-06-21 | Rockwell Automation Technologies, Inc. | System and method for providing access to electrical circuitry based on operational status |
US11397419B2 (en) * | 2019-09-24 | 2022-07-26 | Rockwell Automation Technologies, Inc. | Electrical status indication system |
US11740610B2 (en) | 2019-09-24 | 2023-08-29 | Rockwell Automation Technologies, Inc. | Electrical status indication system |
WO2021076340A1 (en) * | 2019-10-17 | 2021-04-22 | Schweitzer Engineering Laboratories, Inc. | Token-based device access restriction systems |
US11245699B2 (en) | 2019-10-17 | 2022-02-08 | Schweitzer Engineering Laboratories, Inc. | Token-based device access restriction systems |
WO2021231005A1 (en) * | 2020-05-12 | 2021-11-18 | Microsoft Technology Licensing, Llc | Terminal access grant determinations based on authentication factors |
US20220358235A1 (en) * | 2021-05-05 | 2022-11-10 | EMC IP Holding Company LLC | Access Control of Protected Data Using Storage System-Based Multi-Factor Authentication |
US20230004679A1 (en) * | 2021-06-30 | 2023-01-05 | Lenovo (United States) Inc. | Role-based component access control |
US20230206371A1 (en) * | 2021-12-27 | 2023-06-29 | Rockwell Automation Technologies, Inc. | Using software encoded processing for a safety/security application to achieve sil rated integrity for retrieving authentication credentials |
Also Published As
Publication number | Publication date |
---|---|
US10404714B1 (en) | 2019-09-03 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10404714B1 (en) | Policy-managed physical access authentication | |
US10489997B2 (en) | Local access control system management using domain information updates | |
US10380815B2 (en) | Transient asset management systems and methods | |
US20160014103A1 (en) | Physical access control authentication | |
JP7051766B2 (en) | Self-provisioning access control | |
US11244524B2 (en) | System and method for managing electronic locks | |
US20200304999A1 (en) | Integrated physical and logical security management via a portable device | |
US20230154255A1 (en) | Modifying access control permissions | |
US10169937B1 (en) | Systems and methods for multifactor physical authentication | |
Fan et al. | Overview of cyber-security of industrial control system | |
US10839628B2 (en) | Virtual panel access control system | |
US20180359635A1 (en) | Securitization of Temporal Digital Communications Via Authentication and Validation for Wireless User and Access Devices | |
US11373472B2 (en) | Compact encoding of static permissions for real-time access control | |
US9779566B2 (en) | Resource management based on physical authentication and authorization | |
CN104272645A (en) | Industrial automation and control device user access | |
US20170046890A1 (en) | Physical access management using a domain controller | |
US20220014388A1 (en) | Virtual security guard | |
CN101090336A (en) | Command line interface authority hierarchical method for network equipment | |
Qureshi et al. | IoTFC: A Secure and Privacy Preserving Architecture for Smart Buildings | |
Shrestha et al. | Security Classification for Smart Grid Infra structures (long version) | |
US20230130876A1 (en) | System and method for electronic access control in mesh networked sites | |
US20220272073A1 (en) | Proxy And A Communication System Comprising Said Proxy | |
Mohamed et al. | ABACS: Attribute-Based Access Control System using digital keys | |
Patil et al. | Home Security Using Wireless Technology | |
Paul et al. | Cybersecurity Assessment for a Behind-the-Meter Solar PV System: A Use Case for the DER-CF |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: SCHWEITZER ENGINEERING LABORATORIES, INC., WASHING Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MASTERS, GEORGE W.;ROBINSON, KYLAN T.;SMITH, RHETT;AND OTHERS;SIGNING DATES FROM 20150625 TO 20150807;REEL/FRAME:036297/0589 |
|
AS | Assignment |
Owner name: ENERGY, UNITED STATES DEPARTMENT OF, DISTRICT OF C Free format text: CONFIRMATORY LICENSE;ASSIGNOR:SCHWEITZER ENGINEERING LABORATORIES, INC.;REEL/FRAME:038341/0038 Effective date: 20151105 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 |