Access Control for. Part 2 of 4. Brought to You by. Presented by Video Security Consultants

Transcription

1 2008 Video Security Consultants Brought to You by Presented by Part 2 of 4 A1

2 Part 2 of 4 Hardware Choices MADE EASY Security contractors have layers of technology to consider when designing an electronic access control system. Depending on end user needs and budget constraints, solutions will involve entry point controls, multitechnology credentials, system configuration concerns and more. BY STEVEN O. GIBBS W elcome to the latest of Security Sales & Integration s acclaimed D.U.M.I.E.S. series: Access Control for D.U.M.I.E.S. Brought to you by Pelco, this four-part series has been designed to educate readers about electronic access control system (EACS) design and implementation. D.U.M.I.E.S. stands for dealers, users, managers, installers, engineers and salespeople. In Part 1 of this year s series (see Rudiments of System Design in the March issue), we covered the goals of system design, the process of preparing an accurate site survey, considerations for system communications, along with some discussion of final design end-product documents. The second installment of this series will explore the hardware components of an EACS, including system controllers, credential readers and entry point locking devices. Our discussion will center on the fictional small facility floor plan ( American Products, Pomona Facility ) introduced in Part 1. It would be beneficial to visit SSI s Web site ( and download the site survey describing this facility from the D.U.M.I.E.S. series section in the Special Reports link. A2

3 Small Facility Floor Plan Employee entrance Shipping/receiving storeroom Production Servers Sales Conference Administration Main (visitor) Entrance Depicted is a layout and operations within a modest-sized facility. When devising an electronic access control system (EACS), systems integrators should always account for the likelihood the end user will one day request the solution be expanded. Problems occur when the EACS can only support a limited number of access points. KEEP SYSTEM EXPANSION IN MIND Before selecting any EACS hardware, the systems integrator should consider system expansion. It is not uncommon for an EACS to grow from a four- or 16-door system to a 50- or 100-door system within a very short time frame. In fact, many systems continue to grow beyond the 500-reader mark. Even the American Products, Pomona Facility example application has demonstrated expansion opportunities. And what happens if American Products purchases another firm or adds more production facilities around the country? Expansion is normally a good thing for the systems integrator as the end user will be returning again and again asking for additions, usually in small increments, to the system. The problem occurs when the systems integrator implements an EACS hardware (or software) solution that can only support 32, 64, or 128 access points. Try explaining to the end user that in order to add one more card reader all of the existing intelligent control panels will need to be replaced. Ideally, the systems integrator will select a hardware platform that is not restricted in the physical number of devices supported on one system. This has the added benefit of becoming proficient with a single type of system suitable for the smallest to the largest project reducing training and support expenses within the systems integrator s firm. Software platforms are also sensitive to expansion, so we ll discuss this again in Part 3 of this series. THE BASICS OF SYSTEM CONFIGURATION In its simplest form, an EACS can consist of a single credential reader designed to be programmed with a user PIN, credential number or biometric template, and operate independently of any other device. If several standalone devices are placed throughout the facility, the system manager will need to take a programming device to each unit in order to update the database of authorized credential holders. Additional feature sets can be added to the standalone credential reader to allow the unit to store transactions associated with the granting or denying of access to the entry point. In very basic systems, the system manager must visit each entry point to upload transactions to the programmer or memory card that can later be connected to a PC for review and storage. In more advanced standalone devices, a printer output can be connected to a remotely located transaction logging printer. Very recently, entry control devices have become available with a Web server application built into the controller. Utilizing TCP/IP and either a control panel network or the corporate enterprise network, these controllers can be administered with any PC connected to that same network and running any popular Web browser application. Bear in mind, even if several standalone controllers were placed on the same network, they would still be considered operating in standalone mode since each device would have to be administered independently. For instance, a new credential number would need to be added by establishing a connection to each device, one at a time. However, when entry control devices are connected together, and programmed with some form of software solution capable of administering a global database and downloading appropriate data to each controller, the result is a configuration known as host system with distributed processing. How does this explanation of system configuration, and our previous discussion about system expansion, apply to the example facility in the Small Facility Floor Plan diagram above? Assume as a systems integrator you are approached by the future system manager at American Products to provide a very basic EACS. The end user wants to apply entry control to the employee entrance and storeroom door. As a seasoned integrator you recognize several other entry control points that would benefit from a larger EACS application, however, the end user s budget is limited and they are only interested in T o view the fictional small facility floor plan American Products, Pomona Facility, visit Security Sales & Integration s Web site ( and download it from the D.U.M.I.E.S. series section in the Special Reports link. A3

4 two doors. Here it becomes very important to select and implement a system that can be easily expanded. You recommend a solution consisting of two standalone readers with a handheld programmer. The system manager programs the employee entrance to accept all employees during regular business hours and a limited number 24/7. The storeroom door is programmed to allow access to limited employees only. Very shortly after the system is installed and operational, the facility manager thinks it would be a great idea to add a gate operator and card reader in the parking lot to create an executive parking area. Suddenly money becomes available and you are called back to expand the system. Now the system manager goes out to the gate to program the card numbers of the six or eight managers and supervisors working at American Products. Soon the production manager sees how effective controlling access to the production area can im- prove management of this vital area and contacts you to add another reader. Then the sales manager makes a request for another reader, and so on. Is the picture becoming clear? Along about here the system manager is complaining about having to go to each door to make programming changes, let alone the time it takes to upload transactions in order to audit who went where and when. The systems integrator is called back in, this time to develop a comprehensive plan. Since the system selected and installed can be networked, it becomes fairly easy and inexpensive to move this system from several standalone readers to a host-based system with distributed processing. RIDING THE ICP WORKHORSES The real workhorses in any standalone or host system with distributed processing are the intelligent control panels (ICPs). During the past two decades when system data, transaction 2-Reader/Door Intelligent Control Panel 4-wire comm. loop ROM (firmware) RAM (database) 4-wire comm. loop Intelligent control panels (ICPs) make local decisions on access requests and can store or upload transaction records back to a programming device or host computer. At one time the most popular configuration for an ICP was the two-reader/door panel. decision-making, and transaction processing first moved from host mini computers out to the field devices (distributed processing), ICP configurations and processing power have evolved to result in several general formats. Since each of the major configurations are still produced and operational (and many out of production are still operating in legacy systems), we will discuss them all. In the earliest form, the ICP contained a central processing unit (), operating system loaded in firmware (ROM), and random access memory (RAM) storage allowing EACS configuration data such as time zones, holidays, scheduled events and credential numbers to be downloaded in the ICP memory. With this information the ICP can make local decisions on access requests and store or upload the transaction record back to the programming device or host computer. Until about 10 years ago the most popular configuration for an ICP was the two-reader/door panel. The readers could either be in/out devices on a single entry control point or two, nearby entry control points (see 2-Reader/ Door Intelligent Control Panel, left). Keeping the ICP relatively close (under 500 feet) from the entry control point is important because of the number of conductors (usually in separate ) needed between the ICP and the entry control point in order to operate the lock, monitor door status, and with the credential reader. ICPs communicate with the host computer using a two- or four-wire control panel network (CPN) such as RS485 or 20ma current loop. In recent years, ICPs have sprouted Ethernet ports in order to connect to the corporate LAN/WAN. Further discussion of this trend will take place in Part 4 of this series. As systems expanded to include greater numbers of entry points clustered closer together, ICPs controlling eight, 16 or 32 entry points from a central location became available. Since multiple from this central box A4

5 ICP With Reader/Door Interface Panels Ethernet LAN/WAN 2-or-4-Wire RS485 panel network ROM (firmware) RAM (database) and programming with the EACS host computer connected to the same network. Edge devices also incorporate power over the Ethernet (PoE) capabilities to eliminate the need for a power supply at the entry control point. So which configuration is right for the American Products commercial setting (see Small Facility Floor Plan on page A3)? In order to make that determination, the systems integrator must take the following factors into consideration: Component costs Wiring/cabling costs support Ease of expansion The systems integrator must become familiar with how each of the possible configurations of ICPs will impact the above factors, then make a system selection based on the best solution for the project. Door 1 Door 2 to each entry point can be expensive, the next logical form of ICP configuration places an ICP that can process transactions from up to 64 entry control points in a central location and communicates on an EACS subnetwork with less intelligent reader/door panels located near each entry control point (see ICP With Reader/Door Interface Panels, above). This reduces cabling requirements and allows for easy expansion. In most cases, a single panel will support one or two readers and doors. Additional panels contain input points for monitoring other devices or relay outputs for controlling auxiliary functions. Door (up to 64) As systems expanded to include greater numbers of entry points, ICPs controlling eight, 16 or 32 entry points from a central location became available. Up to 64 entry control points became possible with the deployment of subnetwork s. The latest evolution of the ICP comes to us in the form of the edge device. This term (borrowed from the IT world) simply means that the processing work of the ICP has been pushed out right to the edge of the EACS. Edge-style ICPs contain much (but not all) of the processing power of a typical ICP along with the credential reader and door lock relay to control a single entry point (see Edge Devices on page A6). Edge devices are equipped with an Ethernet port and TCP/IP communication capability so they can be connected directly to an existing local or wide area enterprise network (LAN/ WAN) allowing remote administration CREDENTIAL READERS TO CONSIDER So far, we have not yet discussed where the rubber meets the road in the EACS: credential readers. Volumes have been, and are yet to be, written about the virtues of both existing and evolving personal credential technologies. The discussion that follows should be considered only an introduction to the subject, using generalities rather than specifics. First, understand that the choice of card and reader technology is mostly irrelevant to the aspects of system configuration and hardware technology explained so far. This is in large part due to the popularity of one of the first card formats developed specifically for the then emerging access control industry more than 30 years ago Wiegand. In the early days of access control it was not uncommon for a manufacturer to offer only one type of card technology with their product, which would communicate in a proprietary way only with their ICP. However, Wiegand technology and readers, licensed for use and A5

6 manufactured by a third party, became a very popular choice for both EACS manufacturers to include with their systems and end users to implement. It only made sense that developers of new readers and card technologies, including biometric readers, would incorporate the Wiegand into their products. Simply put, a device using a Wiegand or format will present its data to the ICP or reader/door panel in a form that looks like a card read from a Wiegand reader and card. This not only allows retrofitting of new credential reader technologies to an existing EACS, but also allows new EACS hardware to utilize an ever-growing selection of credential readers (even those not yet imagined) and provides the systems integrator a way to better match system configuration and credential technology to the end user s needs. Following is a more detailed look at credential technologies: Magnetic stripe Although considered by some to be unsecure, advancements in the past 15 years have made magnetic stripe (magstripe) technology popular due to its ability to provide reliable, end-user encoded photo Edge Devices switch ID access cards at reasonable cost to large cardholder systems. However, as a contact technology the magnetic stripe will eventually wear out and require replacement. Wiegand Wiegand cards and readers are popular due to a balance between encoding security and cost. Although this is a swipe technology, the Wiegand module of twisted and tuned wires is embedded between the card laminates resulting in a pseudo contactless read process for much longer card life. Unfortunately, early encoding implementations resulted in a limited number of unique customer/facility codes and unique card numbers within each of those codes. This problem has been resolved in newer cards and readers by increasing the number of bits available for encoding data. Proximity In recent years the popularity of proximity or RFID (radio frequency identification) card technology has grown tremendously, and a wealth of new products and formats have been introduced to meet demand. Although proximity readers almost exclusively use the Wiegand to connect to ICPs, the Ethernet network backbone Edge-style intelligent control panels (ICPs) contain the majority of the processing power of a typical ICP, plus the credential reader and door lock relay to control a single entry point. Ethernet ports allow for connection to an existing LAN or WAN. Database Database Database wide variation in operating characteristics makes it necessary to describe this technology in only the most general terms. Proximity cards use a very highly secure encoding method that improves security, although they are generally more expensive than magnetic stripe or Wiegand cards. Smart Card New smart card products seem to appear on the market every day. Again, in general terms, a smart card contains a computer chip allowing some degree of onboard processing. In one example, the smart card will determine if the device trying to access its embedded information is actually a secure device on an authorized EACS. If not, it will refuse to provide data to the reader. This data might even include the cardholder s biometric template. Smart cards are available with either a contact or contactless and many times both s are available on the same card to work with multiple applications. Biometric Readers Even more has been written about the very technical aspects of biometric readers. However, this discussion will focus on application rather than technical operation. Systems integrators, in general, should apply biometric readers to entry control points where the true identity of the individual (rather than just the name of the person assigned to the credential) must be verified. Due to the decreasing cost of some biometric technologies, it may be tempting to install biometrics at every entry control point. Nevertheless, biometric readers still have a lower throughput rate than most card-only technologies. This relegates the devices impractical for high throughput points such as parking gates, employee entrance turnstiles and busy department doors. The fact that most biometric readers use the Wiegand is good news for systems integrators. Both card and biometric readers can be used on the same hardware platforms, A6

7 allowing placement of the more secure biometric device on entry control points where a security compromise can not be tolerated. MERGING CREDENTIAL TECHNOLOGIES In most cases, a single credential technology is used throughout the entire EACS. But this is not always true. It is becoming common for a systems integrator to merge two (or more) technologies onto a single credential. One example: An end user wishing to upgrade to another card technology but unable to replace all of the existing card readers and cards in a single budget cycle. New readers are installed while new, multitechnology cards are issued to all new cardholders and reissued to those needing access to the specific entry control points using the new technology. This allows for a planned crossover to a new technology, while all new readers and existing legacy readers are gradually replaced over time. Another example: Company A has a large EACS using proximity cards. Company B has a smaller EACS using magnetic stripe cards. Company A acquires Company B. The systems integrator provides a dual technology card to be issued to employees of the new, joint operation who need to travel between the two facilities, eliminating the need for them to carry two cards until the two systems are fully integrated. INTEGRATING EACS, PHYSICAL DEVICES Although electronic access control is the generic term for the technology discussed so far, almost without exception the EACS will need to control mechanical devices such as locks, doors, gates and turnstiles. Normally the majority of the entry control points will be doors and they will be controlled with some type of locking device that can be controlled with the application or removal of power. Although magnetic locks are relatively easy to install and are especially useful on pairs of doors with no center mullion, they do fall under the access controlled egress doors requirement. Therefore, additional functionality must be specified to meet basic lifesafety code requirements. Magnetic locks are considered fail-safe so they will release and allow access to controlled areas during a power failure. In most cases, this would be serious breach of security. If an electric strike will work, use it. No additional features will be required and the reliability of a good quality strike will provide years of service. Two important factors must be remembered: First, if the door is fire-rated, then the strike must carry a similar rating; second, to avoid problems with other codes the strike must be fail secure to ensure the door will stay latched (not necessarily locked) during a fire. When a door is part of an opening in a smoke or fire partition (wall), the door must remain closed and latched (again not necessarily locked) at all times. When an electric strike is used and the door is unlocked for extended periods by the EACS, the door is, in fact, not latched. Electric latch sets and knob sets operate by releasing the knob or handle on the locked side of the door to allow access by retracting the latch. Because of this operation, any time the door is closed it is latched whether it is locked or not. These devices are normally the only proper way to control a stairwell door. TURNSTILES ARE STILL EFFECTIVE Turnstiles have been used for almost 100 years to control crowds. Their primary purpose is to prevent traffic from flowing in two directions. In other words, when a door is opened for someone to exit, another person may enter just as easily. A turnstile prevents this two-way effect from occurring. Hip-high turnstiles (above) allow large volumes of traffic to move quickly through an access point. When coupled with an entry control device, many turnstiles can be lined up in a row and control access with very little Hip-high turnstiles allow large volumes of traffic to move quickly through an access point. Coupled with an entry control device, many turnstiles can be lined up in a row and control access with little supervision. supervision. However, some supervision is, of course, necessary to prevent unauthorized persons from simply hopping over the turnstile. Full height turnstiles provide excellent protection at remote entry points to parking areas and building perimeters. They should not be mistaken for an anti-tailgating device since several persons may move through the turnstile at the same time. START PUTTING IT INTO EFFECT As a practical exercise, review what has been discussed in Parts 1 and 2 of this series. Use the fictitious American Products, Pomona Facility site survey and floor plan and begin to expand on it by specifying in more detail of the EACS hardware and entry point controls required to meet the end user s needs. Don t be surprised if you decide on a different ICP configuration. Part 3 of this series will explore the various software solutions available to develop a complete EACS for this example application. Steven Gibbs has more than 30 years experience in access control systems, performing installation, system design, project management and training functions. He can be contacted at (248) or steve@dvdrvtravel.com. A7