Classifications

• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C1/00—Registering, indicating or recording the time of events or elapsed time, e.g. time-recorders for work people
  • G07C1/10—Registering, indicating or recording the time of events or elapsed time, e.g. time-recorders for work people together with the recording, indicating or registering of other data, e.g. of signs of identity
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/20—Individual registration on entry or exit involving the use of a pass
  • G07C9/22—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder
  • G07C9/23—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder by means of a password

Definitions

• the present disclosure relates generally to information security access and in particular, to integrated visualization of security information for an individual.
• systems exist in which remote badges are coupled to personnel to be located.
• the badges include transmitters for transmitting identification infonnation identifying the personnel.
• Receivers spaced throughout a facility are capable of receiving signals from the badges.
• a central processor is capable of receiving messages from the receivers for determining the location
• each of the badges uses such devices to allow for the movements of personnel to be tracked so that the activity of people within facilities can be regulated.
• data concerning the movements of employee personnel should be recorded, organized, analyzed and presented in such a way that security monitoring personnel can be alerted to suspicious behavior, even when such behavior is only identifiable by a small dataset within an immense flow of data.
• a security method including receiving data from devices and normalizing the received data based on uniquely identified objects.
• a programmed computer system including a system for receiving data from devices and a system for normalizing the received data based on uniquely identified objects.
• a computer recording medium including computer executable code, including code for receiving data from devices and code for normalizing said received data based on uniquely identified objects.
• Figure 1 A is a block diagram of a security monitoring system according to an
• Figure IB is a block diagram of a visualization display system according to an embodiment of the present disclosure.
• Figure 1C is a block diagram of a security monitoring system according to another embodiment of the present disclosure.
• Figure ID is a block diagram of another representation of the security monitoring system shown in Figure 1C;
• Figure IE is a flow chart for describing aspects of embodiments of the present disclosure.
• Figure IF is a flow chart further detailing one of the steps depicted in Figure IE;
• Figure 2 shows a three-dimensional display of an image of a building;
• Figure 3 is a three-dimensional display of an exploded floor plan of the building shown in Fig. 2;
• FIG. 4 is a block diagram of an Information Technology system
• Figure 5 A is an example of an IT access log
• Figure 5B is an example of a physical access log
• Figures 6-12 are various displays that can be presented to users of the present system
• Figure 13 is a graphical user interface
• Figure 14 is a flow chart for describing the creation of the physical access log
• Figure 15 is a block diagram depicting various exemplary types of office equipment to
• Figure 16 is a block diagram of an office equipment access log
• Figures 17A-17C are displays depicting office equipment usage
• Figure 18 is a block diagram of a video surveillance system
• Figure 19 is a display depicting usage of a video surveillance information.
• Fig. 1A depicts an overall block diagram of a system according to an embodiment of the present disclosure and is referred to generally as security monitoring system 1.
• Security monitoring system 1 includes a visualization display system 10 and a database 12 which may be located, for example, at a central monitoring station 4.
• Database 12 may actually be several databases provided at one location or at various locations. Data from database 12 can be accessed, processed and used to construct images displayed on a display associated with visualization display system 10. For example, as will be described on more detail below, various types of security information retrieved from database 12 can be displayed to a user of security monitoring system 1 via visualization display system 10.
• the visualized data provides a
• the system may also display various other types of information relating to the individual such as their Information Technology (IT) utilization habits and information relating to their office equipment usage, etc.
• IT Information Technology
• Various types of security data can be input and stored in database 12, including data from physical security devices 16 and data
• Database 12 may also store employee information 14 such as
• visualization display system 10 may include a display 2, a computer or processor 6, an input device 8 which may include one or more of a keyboard, mouse, etc. and a
• Storage device 9 for storing software including code for implementing the systems described in the present disclosure.
• Storage device 9 may be internal or external to processor 6.
• a physical security device 16 may be any type of device capable of providing information on the whereabouts of a person. Examples of physical security devices include access point systems that provide secure access to buildings, floors or rooms of buildings, etc. One type of access point system may require a person desiring to enter a building, floor or room of the building to present some type of identification prior to being granted or denied access. Access
• point systems may include badge reader systems in which an employee, for example, presents a badge prior to being granted or denied access to the building, room or floor.
• an access point system may simply consist of guards positioned at entry points at
• the identity of the individual can be determined by comparing the image or voice pattern to a database of known image or voice patterns.
• Another location determining type device might include the use of badges equipped with
• each badge can emit a low power signal, each coded differently for each individual. In this way, each individual can be monitored as they move throughout a building or into and out of specific rooms in the building or area.
• GPS Global Positioning System
• each employee might be given a
• GPS receiver and a transmitter which they are required to always have in their possession.
• the GPS receiver is capable of determining exactly where the employee is in the building. That
• each employee of a company is issued a badge.
• the badge includes various types of information.
• the badge might include the employee's name and/or other type of infomiation uniquely identifying the employee (e.g., an employee TD number).
• a contractor or visitor to the company may be issued a temporary badge uniquely identifying them.
• the employee's, contractor's or visitor's badge might also include information indicating the various portions of the building or grounds that the person holding the badge has access to. For example, an employee might be given broader access to various
• the infonnation on the badge might be visible on its face, or it might be stored on the badge electronically on a microchip or magnetically on a magnetic strip.
• the information might be coded for added security.
• the various types of access the person can be granted can be stored at one or more remote sites.
• Badge readers are located at various entrances to rooms or floors within the building.
• the badge When the person possessing the badge desires to enter an area, the badge is swiped through the badge reader.
• the badge reader is capable of reading information contained on the badge.
• the badge reader is connected to central monitoring station 4.
• the connection can be a hard-wire connection, a network connection, a wireless connection, etc.
• information is sent to the central monitoring station 4.
• the badge contains information indicating the badge holder's access privileges, that information can be sent to the central monitoring station 4.
• the information can then be compared with that individual's information which is stored in a database accessible by the central monitoring station 4. If the access privileges are confirmed at the central monitoring station 4, confirmation information is sent back to the badge reader system, indicating that access should be granted.
• the badge holder is then granted access to the area. For example, an electronic deadbolt on a door to the area can
• badge reader can not be confirmed, the individual is denied access to the room.
• a visual and/or audio indication such as a flashing red light, a buzzer, etc., may be provided on the badge reader to signify that access has been denied.
• Another type of badge reader system might store employee access privileges locally, and either grant or deny access to the area based thereon. For example, upon the badge being scanned, the badge reader can access a local or remote database and using the identity of the
• Each badge reader is capable of communicating information to database 12 via a hard
• the badge readers may be connected to each other and database 12 via a network. When a person presents their badge to the badge reader to attempt to access the area, the badge reader will send information to the database 12 located at the central monitoring station 4 identifying the room or floor the badge reader controls access to, identifying the person and detailing the date and time that the person was granted or denied access. Database
• Fig. 1C depicts an overall block diagram of a system according to another embodiment of the present disclosure. According to embodiments of this security monitoring system, statistical analysis may be performed on the data collected by the physical security devices and the IT
• each device communicates with the central monitoring station through a plug-in.
• a plug in is a computer program that enhances a primary program, supplying that primary program with enhanced functionality.
• the device plug-ins are a computer program that enhances a primary program, supplying that primary program with enhanced functionality.
• the central monitoring station will be able to interpret the data from the new devices with the aid of new plug-ins.
• a physical access log of information read from the badge such as the badge ID and the time, place and disposition of the reading may be sent to the corresponding badge reader plug-in 204.
• the disposition of the reading may be, for example, whether the person was granted access to the area the badge reader protects. This physical access
• log is then sent to the normalization loader 213.
• information such as the user's log-in ID, the computer's ID, the time, place and disposition of the log-in attempt will be sent to the IT equipment plug-in 205. This information is then sent to the normalization loader 213.
• Other equipment 203 such as a copy machine, fax machine, telephone, HVAC equipment, etc. may also be used to gather data.
• a personal identification number This number may generally be used to account for the equipment's usage or for billing purposes. However, this number also has security value because it helps to track where a person is and
• This information in the form of an access log, is then sent to
• the normalization loader 213 through an appropriate plug-in 206.
• various other external data sources may be used to provide information to the central monitoring station. These data sources are generally databases
• ODBC ODBC
• LDAP LDAP
• eTrust Audit and XML sources may all be used to provide information.
• An example would be a personnel database with employee infonnation such as name, title, date of birth, social security number, phone number, email address and residential address, etc.
• Three example data sources are illustrated 207, 208 and 209. Like the devices 201-203, each data source may have its own way of collecting and
• plug-ins may be used so the central monitoring station can interpret information from any source.
• Three examples of plug-ins are illustrated 210, 211 and 212.
• Infonnation derived from the data sources is sent to the normalization loader 213.
• the normalization loader 213 receives the physical access logs and raw data from the physical security devices and IT monitoring systems 210, 202 and 203 and from the data sources 207, 208 and 209 (see also Fig. IE, Step S40) and correlates or normalizes this data (Step S42).
• the data may be correlated according to many different categorizations.
• the normalization loader 213 identifies unique objects (Fig. 4F, Step S44) and correlates
• a unique object may be, for example, a
• the normalization loader 213 may receive employee information from a personnel database with the names, personal infonnation and personnel records of all employees located at the facility.
• the personal information may include badge IDs, computer log-in IDs and copy machine access personal
• the normalization loader 213 functions to take raw data from the various devices and data sources and present usable information pertaining to particular individuals and other unique objects. This information is then stored in a database of normalized information 214. Normalized infonnation can then be used by the 3D graphic user interface (GUI) to
• Fig. ID depicts a block diagram of another representation of the security monitoring system shown in Fig. lC.
• This block diagram illustrates examples of the ways in which embodiments of the present disclosure may process normalized information stored in the database 223. As illustrated in Fig. ID, information is collected from multiple sources. In this
• these sources are represented as security devices 227 and data sources 228, a
• Fig. ID data is collected from the security devices 227 and data sources 228 and sent to the normalization loader 224 for normalization. Normalized data is then stored to the database 223.
• the security monitoring system can be programmed to carryout certain jobs.
• jobs may be scripts that are written to direct the function of the security monitoring
• a job might be created that directs the central monitoring system to collect
• Jobs can be entered manually through the command line interface 219 or can be generated by using a job
• Nonnalized infonnation stored in the database 223 can be processed by the statistics engine 220.
• the statistics engine 220 performs statistical analysis on the normalized data. These statistics are then stored in the database 223 along with the normalized data. Statistics can be calculated by the statistics engine 220 by statistical grouping. More
• Statistics can be grouped by person, or by machine. Statistics calculated may include
• event totals the number of times an event occurs
• event frequency the number of times an event occurs within a set time period
• This statistic represents the time of the first security event of a day associated with a particular person. This security event may be, for example, the person swiping his or her badge
• the start of day statistic is averaged over a period of time to determine the mean start of day statistic. Additionally the standard deviation may be calculated.
• Another example of a statistic that can be calculated by the statistics engine 220 is the end of day statistic.
• This statistic represents the time of the last security event of a day associated with a particular person. This security event may be, for example, the person swiping his or her badge through a badge reader as he or she exits the building.
• the end of day statistic is averaged
• the mean end of day statistic may be determined. Additionally the standard deviation may be calculated.
• Another example of a statistic that can be calculated by the statistics engine 220 is the rate per user per day statistic (user statistic). This statistic is the total number of times a particular security event has occurred for a particular person for that day. For example, this statistic might be used to track the number of failed computer logins.
• user statistic is the rate per user per day statistic (user statistic). This statistic is the total number of times a particular security event has occurred for a particular person for that day. For example, this statistic might be used to track the number of failed computer logins. The mean and standard
• Another example of a statistic that can be calculated by the statistics engine 220 is the
• machine statistic This statistic is the total number of times a particular security event has occurred for a particular machine for that day. The mean and standard deviation of this statistic may be calculated as well. These statistics can also be calculated for particular days, for example for Mondays, for weekdays and for weekends. These statistics can be calculated per hour as well.
• Nonnalized infonnation and statistical information can be analyzed by the event correlation engine (ECE) 225.
• ECE event correlation engine
• the ECE 225 compares this information against defined rules 226
• Rules 226 may be predefined or may be custom built. Existing rules 226 may also be modified.
• a dynamic rale manager 230 can be
• Rules may be used to aid in the creation and modification of rules 226. Rules may be used to compare normalized infonnation against statistics or statistics
• a rale may be that every employee's start of day statistic must be within two standard deviations of that employee's average start of day statistic for the past month.
• Another rule may be that no employee may have more failed login attempts than two standard deviations above the average number of failed login attempts for all employees for the past month. Such rales would be useful in determining if an employee has substantially deviated from that employee's general routine or
• anomalies correspond with suspicious behavior.
• Anomaly information may be stored in the database 223 along with the normalized information and the statistical information.
• the job may dictate that anomalies automatically trigger the generation of an audit message.
• the job may also dictate that reports be generated.
• Reports are tables of information that can be read to alert security monitoring personnel
• Blank reports 222 are predefined templates for constracting a report. Normalized infonnation, statistical information and anomaly information is read from the database 223 by the report generator 221. The report generator 221 uses the input data to fill out the blank reports 222 requested by the job. The generated reports can be printed, displayed and
• a report might list all anomalies and provide the personal infonnation of the employee who has triggered the anomaly. Reports can also be generated to show job status, for example the status of jobs that are currently running or have
• An investigation is a job that relates specifically to collecting and analyzing data relating to a particular person or device.
• Current investigation reports display information
• Event reports report information about events arranged by machine, person, building and anomaly.
• Job reports list all of the jobs defined in the system. This report may also provide the start time, the number of times the job
• the security monitoring system may be organized into three separate sections.
• the security monitoring system server 232 may be organized into three separate sections.
• monitoring system server 232 is also responsible for processing jobs and generating reports.
• security monitoring server 232 can be monitored and controlled locally through the graphical user interface (GUI) 231.
• GUI graphical user interface
• a 3D GUI 217 is used to depict three-dimensional images as discussed below.
• a configuration GUI 218 is used to assist in the creation and editing of jobs, the setting of rales and the creation and editing of blank reports.
• a command line user interface 219 is also available for instantly monitoring and directing the operation of the security monitoring system. This command line user interface 219 can also be used to perform additional specialized operations.
• the security monitoring system server 232 can also be controlled and monitored through remote access 229. By using remote access, security management personnel can monitor the operation and results of the security monitoring system from a remote computer,
• the remote access 229 can also be in the form of
• Remote access 229 can additionally be used to automatically commence security measures, for example, restricting the access privilege of a particular employee when a particular anomaly has been observed.
• Fig. 2 depicts a three-dimensional image of a type of environment to which the present
• the environment is a corporate headquarters building X.
• a three-dimensional image of the corporate headquarters building can be displayed on display terminal 2 of visualization display system 10 (the 3D GUI 217). Double clicking on
• the building X presents a three-dimensional floor plan of the building X, as shown in Fig. 3.
• the building has multiple floors F1-F7. Each floor might have multiple rooms, as shown.
• various type of physical security devices might be used to secure the building X.
• the white dots labeled 01 - 24 represent security access points in the building, hi the following description these security access points are described as
• the security access points are specific locations in the building, usually entrances to a floor or room, at which each person must be
• security access point 01 is a badge reader located at the main entrance on floor F2 of building X.
• Floor F2 is the main floor of the
• main floor F2 may include access points 19 and 21 for gaining access to specific rooms on floor F2.
• the badge reader will automatically send information to central monitoring
• floor F3 has security access points 02 and 11 so that when a person exits the elevator at that floor, they are required to present their badge to gain access to the floor.
• Floor F3 also includes security access points 14-16 for gaining access to specific rooms on that floor. Each floor and each room on a floor having a security access point might require a
• Floor F3 might also have location detennining devices 31 and 32 for sensing a unique signal being emitted from each
• Floor F4 includes security access points 03 and 10 for gaining access to floor F4 and
• Floor F5 includes access points 04 and 09 for gaining access to floor F5 and access point 12 for gaining access to a room on that floor.
• Floor F6 includes access points 05 and 08 for gaining access to floor F6.
• Floor F6 also
• system 33 will capture the voice pattern and use it to determine the identity of the individual from a database of voice patterns. Appropriate information can then be sent to central monitoring station database 12 identifying the individual as well as identifying where and when
• Floor F7 includes access points 06 and 07 for gaining access to floor F7.
• Floor FI includes access points 22-24 for gaining access to rooms on that floor.
• the building and/or floors could also be depicted in two-dimensional fo ⁇ n or in a combination of two and three-dimensional forms.
• the system may be arranged so that the floors are originally displayed in three-dimensional form as shown in Fig. 3. If the user desires to view a
• the user clicks on the floor, and a two-dimensional image of the floor
• floor plan is displayed.
• the same information displayed on the three-dimensional image can also be displayed on the two-dimensional image.
• all floors are shown as being displayed on display 2, it will be appreciated that not all floors may be displayed at once.
• zoom in and zoom out controls may be provided, allowing the user to zoom in and out on floors which are of particular interest, providing the user with a more detailed floor plan and view as the user zooms in.
• the system may be arranged so that a floor is not displayed or is dimly displayed until it is required to show an access on that floor. In this way, extraneous information (e.g., floors that
• database 12 may also collect and store infonnation from IT monitoring system 18 for creating the IT assets logs. Companies today often us some sort of
• the company can thus have easy access to information for reporting and detecting unusual or malicious activities on the system. For example, a company might have different
• IT assets might be categorized as Sales, Accounting, Client Information, Human Resources, Development, Email, Web, etc.
• Each category of IT assets might normally only be accessible to certain individuals.
• information identifying the person attempting the access as well as the category of the access can be stored, for example, in database 12.
• the IT asset information might also be used to provide additional information for the physical access log. For example, when an employee logs onto a terminal, information identifying the terminal (and/or terminal's location) and information identifying the employee
• the IT system includes one
• Computer terminals 42a-42n may be provided throughout various rooms in the building.
• the terminals 42a-42n may be connected to the network 40 via, for example, a
• One or more Web IT Assets 46 such as, for example, web servers and one or more Email IT assets 49 such as email servers may be provided on the network, allowing employees access to the Internet and their email.
• Various types of Sales IT assets 50 might also be provided.
• the Sales IT assets might include servers, databases, specific applications, etc. dedicated to usage by those employees in the sales department.
• Client Information IT 54 might include one or more databases storing information on each corporate client. Client Information IT 54 might nonnally only be accessible by members of senior
• Human Resources IT assets 56 might include servers, databases, applications, etc. specific to the human resources department and accessible by only those employees in that department and managers of other departments.
• Development IT assets 58 might include servers, databases and applications for use by the development staff.
• the IT system 41 may have one or more ways of granting usage rights to an employee. For example, each employee might have a password which they enter at a terminal prior to being
• IT monitor 60 monitors the network and maintains a log of the usage of the various IT assets by each employee. For example, the IT monitor 60 may provide infonnation identifying the terminal an employee has used to log onto the network and detailing
• infonnation might include how long the employee was logged onto the computer terminal or network, etc. as well as information identifying what category of IT assets were
• FIG. 5A shows a block diagram of an IT access log and a physical access log.
• FIG. 5B shows a block diagram of an IT access log and a physical access log. These IT access logs and physical access logs can be collectively referred to as security access history infonnation.
• FIG. 5B shows that on March 1, 2002, employee "John Wey" entered the building at 7:55 am using the main entrance security access point 01 (see Fig. 3). At 8:05 am, the employee was then granted access to floor F5 via security access point 04.
• FIG. 5A it can be seen from the IT logs the employee then used a computer terminal having terminal ID 001 to access an IT asset categorized as Human Resources. The asset was accessed from 8:08 am to 8:30 am. The employee was then granted access to floor F7 via security access point 06 (see Fig. 5B) at 8:35 am. The employee then accessed a
• employee used security access terminal 05 to enter floor F6.
• employee used security access terminal 05 to enter floor F6.
• the employee access terminal 03 to again enter floor F4.
• the employee then accessed the email assets from 2:00 - 2:05 pm and again from 2:30 - 2:34 pm using the terminal having terminal JJD 002.
• the employee also accessed the Web server assets from 2:10 - 2:45 pm, from 2:50 - 2:59 pm, from
• security access point 04 to access floor F5. From 4:30 - 5:15 pm, the employee assessed development IT assets using tenninal 004. There are no more log entries for that day, indicating that the employee likely left for the day. Although shown herein as separate logs, it should be understood that the security access
• history information might actually consist of one log chronologically showing an employee's physical accesses as well as their IT accesses. Although it may not be too difficult to review these logs to determine where an employee was and what they were doing for any given day, it would be extremely time consuming and burdensome to view the logs in this manner over the course of a month or even a week. It would be very time consuming and burdensome to view the logs in this manner over the course of a month or even a week. It would be very time consuming and burdensome to view the logs in this manner over the course of a month or even a week. It would be
• the present system presents this information in a visual display that shows the employees movements throughout the building over the course of a set period of time, so that those movements can be easily tracked and analyzed.
• a visual display is also provided depicting the employee's IT access for any period of time, providing additional key information regarding the employee.
• the present system thus provides a way of effectively tracking employee movement through the building and/or usage of the company's IT systems.
• GUI graphical user interface
• the system retrieves the employee's security access history from the database 12 for that period of time, so that the information can be displayed on an easy to comprehend intuitive display format.
• the various types of information including generated reports, information from the physical security devices 16, the IT monitoring system 18 and the employee information 14 can be presented to the use in a display as shown in Fig. 6.
• the system presents the physical security
• the display can be controlled using VCR type controls.
• the video controllers At the bottom of the display are the video controllers allowing the user to scan forward or backward in time to observe employees movements throughout the building over the course of days, weeks, months, etc.
• Box 60 displays the earliest date for which log information is to be displayed. In this case,
• Box 61 displays the time of the first physical security log entry occurring on March 1. A user can also modify the earliest date and time by placing the
• Box 71 displays the end date input by the user. In this case, March 31, 2002 was entered by the user.
• Box 72 displays the time of the last physical security log entry occurring on March 31. A user can modify the last date and time by placing the curser in box 71 or box 72 and typing in the last date and time desired. The times may be displayed in military time or in ordinary time.
• Box 62 displays the date and box 70 displays the time currently being displayed. Clicking on fast rewind
• button 63 rewinds the display in one day increments.
• Clicking on rewind button 64 rewinds the display in hourly increments.
• Clicking on button 65 pauses the display.
• Clicking on button 66 starts the display moving forward and clicking on button 67 stops the display.
• Clicking on button 68 forwards the display in hourly increments.
• Clicking on button 69 fast forwards the display in daily increments or it can be used to fast forward the display between anomalies.
• a window 75 having personnel information pertaining to the employee being investigated.
• the infonnation may include the employee's picture, name, employee identification number (12345) and title (Developer).
• the infonnation might also include the employee's social security number, date of birth (DOB), home phone number, email address and their contact address where they can be reached.
• security access point 01 is highlighted indicating that the employee
• the display thus changes to the display as shown in Fig. 8, highlighting the path extending from point 04 to point 06. This continues for each of the physical security access points, until the user stops the display by clicking on stop button 67 or the end of the period to be displayed has been reached (March 31, 2002).
• the display automatically highlights the employee's routes or paths through the building incrementally, hour by hour, day by day, showing the paths that the employee follows.
• a path will be faded out, so that only paths which are out of the ordinary are highlighted. In this way, the user can quickly determine where the employee has strayed from his ordinary course of travel throughout the building.
• the system can use default values or user set values to determine when to fade out a path. For example, a fade value might be set to 10, indicating that if the same path occurs more than ten times over the course of the period of time being examined, the path will fade.
• a GUI can be
• the paths might begin as one color and as the path occurs more and more often, the color might change to another color or to different colors, depending on how often the
• a color key can be provided at the bottom of the display, indicating what
• each color means. While showing the path that the employee follows, anomalies that have been detected can be depicted. For example, an anomaly generated when an employee was repeatedly denied access to a particular area can be illustrated by a specific color or shape superimposed onto the shown path.
• Displayed in the lower left-hand comer of display 2 is a visualization of the employee's IT access history showing the categories of IT assets the employee accessed during the course of the day. For example, as shown in Fig. 9, on March 31, the employee did not access the Human Resource, Accounting, Client Information or Sales IT assets. However, the employee did access the Web IT assets and Email IT assets and to a lesser degree, the Development IT assets.
• the employee also accessed the Client Information IT assets.
• This employee can then be questioned regarding this matter, or can be watched more carefully for any suspicious activity.
• the user may be given the opportunity to flag the anomaly, so that it can easily be retrieved for viewing at a later time. For example, after clicking on the highlighted path, the user may be presented with a GUI asking the user if they desire to flag the anomaly. If the user
• the display 2 may also include a clock button CL 90, as shown in Fig. 10. Clicking on button 90, the user is presented with a clock dial 92 as shown in Fig. 11. Clock dial 92 includes 24 hour markings as shown. The clock shows the employee's
• Fig. 11 the physical access occurrences for each hour of that day (March 7, 2002) are seen on the dial face as vertical bars. Also shown in the bottom left hand comer of the display are the employee's IT asset access occurrences for that day. We see that in addition to having physical
• anomaly will be indicated by a color or symbol superimposed on the visual display. The user can then pull up specific statistical information about the anomaly by clicking on the anomaly
• Fig.14 is a flow chart for describing a system for obtaining physical access information
• Step SI a security access query is received from a security access
• this query can include the name of the party desiring to gain access to an area and or some other form of identification uniquely identifying the party (e.g., an employee ID).
• the security access query also includes location infonnation, identifying the location issuing the query.
• the central monitoring station at the central monitoring station 4.
• Step S3 If the party is entitled access to that area (YES, Step S5), information is returned to the security access station indicating that the person may be granted access (Step S9). If the security access station is in the form of a security guard, the guard can then allow the party to enter the area. If the
• security access station is in the form of a badge reader
• the badge reader will unlock the door in response to the information returned from the main monitoring station. If access has been denied
• Step S5 the party is not permitted access to the area and information is sent to the security access station indicating that access should be denied (Step S7).
• the guard can then inform the party that they are denied access.
• a badge reader a badge reader
• Step SI 1 The central monitoring station 4 also adds information to that employee's physical access log (Step SI 1) identifying the specific security access station that issued the query, the date and time of the query, and whether access was granted or denied.
• Various other types of information may also be used to monitor an individual's location and/or their usage habits of, for example, office equipment, etc. Buildings, offices, warehouses, airports, etc. often include multiple types of office equipment for use by employees.
• the office equipment may include facsimile machines, copy machines, telephone systems, etc.
• copy machines may require an operator to input certain types of information including a unique ID uniquely identifying the operator, prior to allowing the operator to use the
• Facsimile machines, phone systems, printers, etc. may also be configured to require the operator to input their ID prior to granting usage rights. These systems are often
• monitoring systems so that billing information, status and usage information and/or maintenance information can be gathered and monitored. This information may then also be used by the present monitoring system to provide additional information regarding the location of an individual as well as information regarding office equipment usage
• HVAC heating, vacuuming and air conditioning
• Fig. 15 depicts a block diagram of an office equipment system including various types of office equipment.
• the office equipment may include one or more facsimile machines 120a-120n, one or more copy machines 122a- 122n, one or more telephone units 124a-124n, etc.
• Usage information from each machine or unit is communicated to the one or more monitoring systems 126 for collecting information regarding the usage of each system. The information
• the information might also include information identifying the piece of equipment (e.g., a machine ID) and/or the location of the piece of equipment, as well as the date and time that usage was requested by the user and whether usage was granted or denied.
• the one or more monitoring systems 126 might be the same as the central monitoring station 4 described above, or might be separate therefrom. For example, monitoring system(s) 126 may simply provide data to central monitoring station 4 periodically or
• telephone units 124a-124n may be connected to a telephone exchange system
• the telephone system may then communicate access history information which may include information identifying the location
• This information can be forwarded to central monitoring station 4 in realtime, periodically or in response to a request from the central monitoring system 4.
• Log records can be compiled identifying what office equipment was accessed, when it
• the infonnation being stored with the log records may include information identifying the type of each piece of office equipment being accessed and/or its location.
• An example of an Office Equipment Access Log is shown in Fig. 16.
• Office Equipment Access Log 130 may include various types of information including
• identification infonnation 132 identifying the individual that requested usage of a piece of office equipment, hi this example, employee "John Wey's" office equipment access log is depicted. It
• each type of office equipment might have its own log.
• the office equipment log information might be
• Equipment ID 134 may be provided which uniquely identifies each piece of equipment.
• Type information 135 may be provided which identifies the actual type of equipment (facsimile, phone, copy machine, etc.)
• Location information 136 may be provided which identifies the location of the equipment.
• Time and Date information 138, 140 may be provided which identifies the date and time that the office equipment was attempted to be
• Access allowed/denied infonnation 142 may be provided for indicating whether the operator was granted or denied access to the office equipment.
• the office equipment usage information might also be used to provide additional information for the physical access log. For example, when an employee enters their LD code
• information identifying the copier, facsimile machine (and/or the location of the copier, facsimile machine, etc) and information identifying the employee can be sent to the central monitoring station 4 to be stored in the employee's physical access log.
• the Office Equipment Access Log information 130 can also be presented to a user of the present system in an easy to comprehend visual format, providing additional information for monitoring the whereabouts and/or equipment usage habits of an individual. For example, as shown in Fig. 17 A, this infonnation can be presented in a manner similar to the IT asset
• infonnation as described above. As shown, infonnation showing phone usage 160, information showing facsimile usage 162 and information showing copy machine usage 164 maybe
• Each bar graph displays a user's relative usage of each type of equipment for each day in question.
• moving cursor 200 and clicking on one of the bars 160-164 will present more detailed visual data.
• clicking on bar 160 will display a bar graph 165 as shown in Fig. 17B that
• Fig. 17C The same type of bar graph displays can be provided for each type of office equipment. This provides security personnel with valuable information which can be used to
• Video security cameras are often set up at key points throughout a building or area. The video cameras may provide
• This video data can be stored and then retrieved by the present system.
• the video data is time stamped so that it can be synchronized with the other data being displayed by the present system.
• the video from one or more video security cameras can be displayed in separate windows on display 2 along with the other information being displayed.
• the video can be presented as a full screen display, or as a small window on the display.
• FIG. 18 A block diagram of an example of a video monitoring system is shown in Fig. 18.
• One or more video camera units 180a-180n are provided at various key locations throughout a building or area. The video from each unit 180a-180n is communicated to one or more video storage
• FIG. 19 shows a display 2 including a video window 192 which displays a video feed.
• the operator used the GUI to select to view security monitor "LABA" which is provided in the main lab in the building. The operator is viewing in window 192, a segment of
• video for the selected video camera can be retrieved from storage 190 and when the user presses start button 66, video for that time period can be displayed along with the physical access information being shown on the rest of the display.
• the video data can also be displayed in real time along with one or more of the physical access information, IT access information and the office equipment usage information.
• the present system and method can also display the physical accesses and/or IT accesses and/or office equipment usage information and/or video data in real time as they occur, giving the security department a powerful tool for monitoring personnel in the building or area.
• the present system maybe arranged to display or visualize the use of any one or any combination of one or more of the various types of information described above.
• the present disclosure may be conveniently implemented using one or more conventional

Landscapes

• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Alarm Systems (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Priority Applications (5)

Applications Claiming Priority (2)

Publications (1)

Family

ID=34079277

Family Applications (1)

Country Status (8)

Families Citing this family (1)

Citations (4)

• 2004
  • 2004-07-09 WO PCT/US2004/021844 patent/WO2005008602A1/en active Application Filing
  • 2004-07-09 JP JP2006518890A patent/JP2007531070A/ja active Pending
  • 2004-07-09 KR KR1020047016721A patent/KR20060045312A/ko not_active Application Discontinuation
  • 2004-07-09 EP EP04759596A patent/EP1540598A1/en not_active Ceased
  • 2004-07-09 BR BR0403939-4A patent/BRPI0403939A/pt not_active Application Discontinuation
  • 2004-07-09 CA CA002511105A patent/CA2511105A1/en not_active Abandoned
  • 2004-07-09 CN CNA2004800002251A patent/CN1698074A/zh active Pending
  • 2004-10-14 IL IL16461704A patent/IL164617A0/xx unknown

Patent Citations (4)

Also Published As

Similar Documents

Legal Events