Patent Grant
7475812
The present invention relates to a security system (and method) using smart card badges for controlling access to areas of facilities, and particular to a security system using smart cards as badges having improved authentication of cardholders at readers in the system. The invention is especially useful as smart cards and improved authentication of the present invention can be readily adapted into existing infrastructures of access control systems by modifying of hardware and software at readers and at workstations for enrolling badges to personnel, thereby avoiding the need for new hardware/software at the central or distributed access controllers which makes access decisions in the system.
Security systems for access control in facilities typically use a central access controller or multiple distributed access controllers, which are coupled to readers associated with locking mechanisms at doors. Security systems with a central access controller are described for example in U.S. Pat. Nos. 4,839,640, 4,816,658, 4,544,832, and 4,218,690. A security system with a distributed access controllers is described in U.S. Pat. No. 6,738,772. Personnel are provided badges or cards encoded with badge information that can be read by a reader, and then passed by the reader to an access controller, which makes an access decision according with the badge information and any additional authentication data (e.g., pin number and/or biometric(s)) received.
Badge information is encoded on badges magnetically (e.g., magnetic strip), optically (e.g., bar code), or wirelessly (e.g., RF tag), in a manner such that readers can access such information from the badges when presented to readers. Traditionally, the information encoded represents at least a badge number and an issue code. The badge number is a unique number or code assigned to the owner of the badge, while the issue code identifies each reissue of the badge. For example, when a badge is first issued to a person the issue code may be set to one. If the badge is later reissued to the person, which often occurs as badges can be damaged or lost, the issue code is set to two or other number indicating it is a different badge from the one damaged or lost. This avoids unauthorized use of the old badge.
One problem is that badges can be forged enabling unauthorized access by copying badge information from an existing badge onto a new badge. Such forging is possible by the use of similar technology to that used in creating badges in the system. Unauthorized access can risk both personnel and protected property of a company, university or other establishment relying on its security system. Moreover, even a user reporting a lost badge does not protect against the sophisticated forger who can modify the stored badge information on the lost badge with a new reissue code, thereby forging a new badge. This problem is often exacerbated by the absence of additional authentication, such as provided by pin number entry and/or biometrics capture, at the reader, which could assist in avoiding unauthorized access by a forged badge.
Thus, an improved security system is desirable which reduces the risk of unauthorized access using a forged badge, and adds improved authentication of badges, even at a reader which lacks additional authentication by use of a pin number entry and/or biometrics. It is further desirable that such improved security system can be readily implemented in an existing security system infrastructure (hardware and software) without requiring the expense of new or retrofitted access controller(s), or purchase of a new access control security system.
It is an object of the present invention to provide an improved access control security system using smart cards as badges, and enhanced authentication of such badges at readers.
It is another object of the present invention to provide an improved access control security system which can readily be adapted to an existing security system by use of readers capable of reading smart cards, and data encryption without requiring modification of access controller(s) or their databases used to stored information for making access decisions.
Briefly described, the present invention is based on an access control security system having at least one access controller with a database storing at least badge numbers and associated issue codes and access privileges data, and one or more readers associated with the access controller. The system uses smart cards as badges (referred to as smart card badges), which each have a unique Smart Card Serial Number stored in their memory. When enrolled in the system a Credential Identifier is stored (or encoded) on the smart card badge, and an Authentication Code (or HMAC) is generated by encrypting the Smart Card Serial Number and Credential Identifier using as a seed a Site Secret Key. The Credential Identifier along with the encrypted Authentication Code is then stored in the database of the access controller as the badge number and issue code, along with access privileges data. Each reader has memory storing the Site Secret Key, and when presented with a smart card badge, reads the badge's Smart Card Serial Number and Credential Identifier, generates an Authentication Code by encrypting the Smart Card Serial Number and Credential Identifier using as a seed the Site Secret Key, sends a request to the access controller with a badge number and issue code set as the read Credential Identifier and generated Authentication Code, respectively. The access controller makes an access control decision based on its database in response to the received badge number and issue code of the request matching that stored in its database, and access privileges data associated with the badge number, and then sends a response to the reader with an access decision.
If one or more readers are capable of obtaining additional authentication data, such as pin number (e.g., via a keypad on the reader) and/or biometrics (e.g., reader imager or scanner capable of face, fingerprint, or retina, or reader audio circuitry for voice data capture), such authentication data entered or captured by the reader is also sent in the request to the access controller. After authentication of the badge number and issue code (i.e., Credential Identifier and encrypted Authentication Code) is of a valid cardholder in its database, the access controller may further compare authentication data from the request with previously stored data in its database in determining the access decision.
The present invention further embodies a method for access control in a system using smart card badges having at least one access controller and one or more readers coupled to the access controller. The method has the steps of: storing in a database of the access controller for each of the smart card badges at least a Credential Identifier and an encrypted Authorization Code as badge number and issue code, respectively, and access privilege data for the smart card badge; presenting one of the smart card badges to a reader; reading at the reader the Credential Identifier and Smart Card Serial Number from the smart card badge; generating at the reader an encrypted Authorization Code based on the read Credential Identifier and Smart Card Serial Number, and a Site Secret Key; sending a request to the access controller with the read Credential Identifier and generated Authorization Code; receiving at the access controller the request in which the access controller construes the Credential Identifier and the Authorization Code as a badge number and issue code, respectively; and comparing at the access controller the badge number and issue code with the badge number and issue code for the smart card badges stored in the database of the access controller; and granting access at the reader when the badge number and issue code matches that store in the database of the access controller and the smart card badge has access privileges at the reader sending the request.
A badging workstation may also be provided for a security system using smart card badges having a computer system with memory storing at least a Site Secret Key, and a smart card reader/writer coupled to the computer system for reading a Smart Card Serial Number from a smart card badge. The computer system determines a unique Credential Identifier for the smart card badge, generates an encrypted Authorization Code based on the Credential Identifier and Smart Card Serial Number, and the Site Secret Key, and provides to another computer system (e.g., computer server) the Credential Identifier and encrypted Authorization Code as the badge number and issue code for download to one or more access controller.
The foregoing objects, features and advantages of the invention will become more apparent from a reading of the following description in connection with the accompanying drawings in which:
The present invention is an improvement of the security system and method for access control described in U.S. Pat. No. 6,738,772, which is herein incorporated by reference.
A badging workstation 12 is provided representing a computer system with a memory storage unit (such as a hard or optical disk drive) providing a database. This database is referred to herein as an external database as it represents a different database from the central database, and to use terminology set forth in the above-incorporated patent. The external database stores at least employee information, and badge information at least to the extent of the Badge Number and Issue Code associated with badges used by employees, contractors, or other persons, to access areas of one or more buildings or sites controlled by the system. Employee information represents demographic information relevant to all employees, contractors, or any person who may be issued a badge, such as name, site, status, department, phone, employee ID, employee picture, and the like. Badging information may additionally include pin number which may be needed by one or more readers having keypads for enter of a pin number. Badging information may further include biometric data which may be needed by one or more readers having means for capture of biometric characteristics, such as voice, fingerprint, face, retina, or other type, of recognition of an individual. Peripheral devices may be coupled to the badging workstation for capturing biometric information, such as digital imagers (e.g., cameras) or scanners to input fingerprint, face, or retina of the person, or audio circuitry for input of a voice password. The badging workstation can process such input into data useful for biometric authentication of a person, as typical of software for biometric identification/recognition.
For example, the badging workstation 12 may be located in the human resource department of a company, university, or other institution for maintaining personnel records and management of badges. The badging workstation provides for assigning or changing badges for employees in the system. Although the term employee is used herein it generally refers to any person in the organization regardless as to whether the organization is a company, university, hospital, or other institution. Additions or changes in the external database of badging workstation 12 are provided in transaction data, which are download by computer server 13 into central database 14 by mapping the transaction data received from the external database of badging workstation 12 into records of one or more tables of the central database 14, as described in the above incorporated patent.
The system has multiple access controllers which are each coupled to readers 18. For purposes of illustration, one such access controller 16 is illustrated in
When the information downloaded into the central database 14 affects access to areas, the computer server 13 automatically distributes security information from the central database to the access controllers. The security information represents badge data and access privilege data for storage in the database of the access controller, and is used by the access controller in making decisions in response to requests from readers 18. Since the mapping of transaction data to the central database, tables, and downloading of security information is described in the above-incorporated patent, a detailed discussion of such is not provided.
Improved authentication in system 10 is provided by the use of smart cards as badges 20 (referred to hereinafter as smart card badges) and readers 18 for reading such smart cards, and data encryption utilizing a Site Secret Key. Each reader represents a microprocessor or micro-controller based device operating in accordance with a program stored in memory of the reader, and has mechanical, optical, magnetic, or RF interface for reading smart cards, in which the smart card memory is read via such interface when received or in proximity to the reader. As stated earlier, one or more of the readers 18 may also have keypads for entry of pin numbers associated with the badges, and/or imagers or scanners for input of biometric information, if needed.
Smart cards may represent an electronic card or unit having memory which can be read by reader 18. For example, the smart cards may be DESFire Smart Cards manufactured by Phillips Semiconductor, Inc. Such smart cards may have a controller for controlling interface (wired or wireless) and management of memory of the card, but may be passive memory cards. Each smart card when manufactured has a unique Smart Card Serial Number stored in its memory or embedded in the card, which cannot be easily forged or duplicated. The particular electronics and data structure of the smart cards, and the electronics and software (e.g., commands, data, or addressing) used by readers to access such memory depends on the type of smart cards being used as badges. Each smart card may have other information stored, but at a minimum has a Smart Card Serial Number or other code unique to each different smart card for identification of the cards.
Both the badging workstation 12 and the readers 18 perform data encryption as will be described in
Referring to
The badging workstation 12 generates a Credential Identifier (ID) by concatening three numbers (i) an Agency Code, (ii) a System Code, and (iii) a Credential Number (step 27). The concatening of the three numbers is based on FASC-N (Federal Agency Smart Credential Number) ID Generation, such as described in document GSC-IS 2.1 available from the Smart Card Alliance web site at www.smartcardalliance.org. The Agency Code is a number representative of the company or organization having the security system. The System Code is a unique number associated with the particular computer server 13 of the system 10. For example, multiregional security systems, such as described in U.S. Pat. No. 6,233,588, may have a number of computer servers, each having a unique System Code. The System Code is assigned by a system administration and stored in the central database 13, the badging workstation 12 is also provided with the System Code in its external database by accessing the code from the central database 14 via computer server 13. The Credential Number is a number sequentially generated by the badging workstation 12 for each cardholder. For example, the Credential Identifier may be 97000021100001, where the Agency Code is 9700, the System Code is 0021, and the Credential Number is 00001, and the next Credential Identifier when generated would be 97000021100002, and so forth.
Next, a smart card badge is inserted (or otherwise presented) to interface with the badge reader and writer 19 and the unique Smart Card Serial Number is read from the badge by the badging workstation (step 28). The badging workstation 12 creates an HMAC (Hashed Message Authentication Code) from the Credential ID and the Smart Card Serial Number using a Triple DES (Data Encryption Security) algorithm using the Site Secret Key as the encryption seed. Triple DES algorithm is a standard encryption algorithm, such as set forth in FIPS201 and is also described at the above-cited web site. The HMAC for example may be a 32-bit number, and is unique to the cardholder.
As stated earlier, transaction data stored in the external database of the badging workstation 12 is downloaded to the computer server 13. The transaction data includes data fields for the demographic and biometric data entered at step 26, as well as other data fields for entry of the generated Credential ID, stored as the Badge Number, and the HMAC, stored as the Issue Code for the badge. The storage in the Badge Number and Issue Code data fields enables the use of the invention in existing security systems and equipment (e.g., access controller(s)) thereof that utilize Badge Numbers and Issue Codes in making access decision.
When the transaction data is read and mapped by the computer server 13, the demographic information is mapped and stored by the computer server in a record of the Employee Table of the central database, and the Badge Number and Issue Code are mapped and stored by the computer server as part of a record of the Badge Table. Further, if a pin number and/or biometric data were captured by the badging station 12 for use by reader, such data is also provided in the transaction data, and read and mapped by the computer server into appropriate data fields of the same record of the Badge Table (step 31). Further, access privileges are assigned by the computer server 13 in a record of the Access Level Table for the badge based upon the demographic data of the cardholder. The demographic data and biometric data may be stored in record(s) of the external database of the badging station along with the generated Credential Identifier and HMAC as the Badge Number and Issue Code, respectively.
The Badge Number and Issue Code along with other access privilege data defining access privileges for the cardholder (and with any pin number and/or biometric data associated with card holder), are automatically downloaded into the database of the access controller 16, as described in the earlier incorporated patent (step 32). To each access controller 16 the downloaded Credential ID and HMAC appear as a Badge Number (or ID) and Issue Code, respectively. The badging workstation 12 then stores the Credential ID onto the smart card badge, via badge reader/writer 19, from which the Smart Card Serial Number was read earlier (step 33). Steps 32 and 33 may occur is parallel or in different order than shown in the figure.
With the database of each access controller 16 now updated with Badge Number and Issue Code along with other access privilege data defining access privileges for the cardholder (and with any pin number and/or biometric data associated with card holder), the smart card badge can be used at one of readers 18 to attempt access to an area protected those readers.
The reader 18 then sends a request with the Credential Identifier and generated HMAC to the access controller which interprets them as the Badge Number and Issue Code (step 38). The request may have other data, such entered pin number and/or biometric data captured at the reader. The access controller 16 compares the incoming Badge Number and Issue Code with those stored in its database (step 39). If a match is found (step 40), the access controller 16 determine whether the badge has access permission at the reader in accordance with the access privileges data stored for the Badge Number in the database of access controller memory, and if additional authentication data is provided in the request, that such data matches (or matches within an acceptable tolerance) stored data for the cardholder in the access controller's database (step 40). If so, an access grant message is sent to the reader (step 44), otherwise an access denied message is sent to the reader (step 43). If no match is found at step 40, an access denied message is also sent to the reader (step 43). The locking mechanism controlled by the reader is unlocked to permit entry to or exit from an area of a building if an access grant message is received.
Although the triple DES encryption is used, other encryption techniques may also be used at the reader at step 37, so long as the same are used at the badging station at step 20 of
Further such readers are not limited to readers for use with doors of facilities, but may be readers associated with information systems, such as computer systems, or computer networks, or other information resources or environments in which user authentication is desired. An information system may be connected to a smart card badge reader, and operate similar to reader 18 to control access to such information systems in response to an access controller. This can be done at user login in which the information system waits for a signal or message from the smart card badge reader that access is granted, in addition to, or instead of a password entry for a user, and until signal or message is received access is denied.
One advantage of the invention is that the hardware and software of the central database, computer server 13, and access controllers 16 do not require modification to use the improved authentication described above, since it operates as if the Credential Identifiers and HMACs were the Badge Numbers and associated Issue Codes. Each access controller 16 operates in the same manner as described in the incorporate patent, since it compares Badge Numbers and Issue Codes in making access decisions in response to reader requests. The potential forger of a smart card badge cannot easily forge a new badge based on an existing badge, since the new badge will have a different Smart Card Serial Number, and thus will generate a different HMAC by the reader. Further, if a smart card badge is damaged or lost, the Credential Identifier of the cardholder may not change, at when the new badge is generated at the badging station it will have a new HMAC code as a result of the new Smart Card Serial Number, and such will be downloaded as the new Issue Number by the central server from the external database to the central database and access controller database. Thus, authentication in accordance with the present invention assures that the data on the smart card badge was generated from the correct source, i.e., a badging workstation of system 10, rather than an unauthorized source.
Authentication may be further enhanced by periodically changing the Site Secret Key in system 10. This can be done automatically at the computer server 13 where the badge records are modified to include a data field for the Smart Card Serial Number associated with Badge Number (i.e., Credential Identifier), and such Serial Number is transferred into this data field by the download and mapping of transaction data from the external database to the central database. The computer server 13 thus for each cardholder is programmed to automatically encrypts a new HMAC based on the Badge Number and Smart Card Serial Number stored in the central database using the new Site Secret Key, and replaces the old Issue Code for each cardholder with the new HMAC code to be associated with the Badge Number of the cardholder. A new configuration card is then used to reprogram the readers with the new Site Secret Key.
From the foregoing description, it will be apparent that there has been provided an improved security system for access control using smart card badges. Variations and modifications in the herein described system and method in accordance with the invention will undoubtedly suggest themselves to those skilled in the art. Accordingly, the foregoing description should be taken as illustrative and not in a limiting sense.
| Number | Name | Date | Kind |
|---|---|---|---|
| 4218690 | Ulch et al. | Aug 1980 | A |
| 4544832 | Young et al. | Oct 1985 | A |
| 4816658 | Khandwala et al. | Mar 1989 | A |
| 4839640 | Ozer et al. | Jun 1989 | A |
| 5163097 | Pegg | Nov 1992 | A |
| 5629981 | Nerlikar | May 1997 | A |
| 6233588 | Marchoili et al. | May 2001 | B1 |
| 6317834 | Gennaro et al. | Nov 2001 | B1 |
| 6536665 | Ray et al. | Mar 2003 | B1 |
| 6738772 | Regelski et al. | May 2004 | B2 |
| 6839840 | Cooreman | Jan 2005 | B1 |
| 7111321 | Watts et al. | Sep 2006 | B1 |
| 7137553 | Register et al. | Nov 2006 | B2 |
| 7159778 | Kochevar et al. | Jan 2007 | B1 |
| 7303120 | Beenau et al. | Dec 2007 | B2 |
| 20030212894 | Buck et al. | Nov 2003 | A1 |
