Credentialing Technology & Biometrics

Transcription

1 Credentialing Technology & Biometrics 1

2 Course Overview Course Name: Credentialing Technology & Biometrics Credits: 0.6 CEU Duration: 1 day Certification: 2

3 Course Objectives By the end of this course, you will be able to: Describe the biometric technologies supported by OnGuard Configure OnGuard for use with Access Panel and SmartCard based template storage Configure, verify, and troubleshoot the installation of supported biometric readers (both with and without the LNL-500 Biometric Gateway) Differentiate the capabilities of various SmartCard technologies 3

4 Course Objectives Course objectives (continued) Select the most appropriate SmartCard technology for a customer Describe and demonstrate various biometric encoding and verification methods in ID Credential Center and Alarm Monitoring as evidenced by successful completion of all course modules, active participation in class discussions/examples, and 90% attendance to all class sessions. 4

5 Course Agenda Biometrics Biometric Technologies Fingerprint Hand Geometry Iris Recognition System Administration Biometric Template Capture Biometric Reader Configuration Smart Card Formats / Encoding Alarm Monitoring Biometric Events 5

6 Credentialing Technology & Biometrics Biometrics 6

7 Biometrics BIO (relating to life, living organisms) METRIC (a system of related measures that facilitates the quantification of some particular characteristic) In the context of access control: The automated use of physiological or behavioral characteristics to determine or verify identity International Biometrics Group - 7

8 Biometric Technology Supported by OnGuard Fingerprint Optical Cross Match Safran (formerly Morpho, formerly L-1 Identity Solutions) Bioscrypt readers) Capacitance/Radio Frequency Safran Hand Geometry Optical Schlage Recognition Systems (formerly RSI) Iris Recognition Optical Iris ID (formerly LG Iris) IrisAccess system 8

9 Fingerprint - Optical Fingerprint Template Captured Using Digital Imaging Technology Uses a charged coupled device (CCD) to convert dark ridges and light valleys into a digital signal Brightness is adjusted automatically to create a usable image Strengths time-tested technology, withstands temperature fluctuations, less expensive, good resolution Drawbacks surface area, latent prints, no liveness detection 9

10 Fingerprint Optical (Basic) LED Source: L-1 Identity Solutions Image Sensor 10

11 Fingerprint - Capacitance Fingerprint Template Captured Using Silicon Technology and DC Capacitance Uses a charged silicon chip as one side of a capacitor and a finger as the other The capacitance between the silicon platen and the finger is converted to an 8-bit grayscale digital image Strengths better quality, smaller surface area, very detailed image, liveness detection Drawbacks more expensive, durability yet to be proven in harsh conditions 11

12 Fingerprint - Capacitance Source: 12

13 Fingerprint - Capacitance This is a UPEK fingerprint reader that can be integrated in laptops for authentication. This is a capacitive sensor that does not require as much surface area of the finger as optical sensors The fingerprint image is stitched together to form the biometric template 13

14 Fingerprint Recognition There are two primary methods of fingerprint recognition: Pattern-based algorithms Minutiae-based algorithms 14

15 Fingerprint - Patterns The patterns below make up the Henry classification system. Developed by Sir Edward Henry, it is the basis for AFIS (Automated Fingerprint Identification System), used by many law enforcement agencies. Arch Pattern Loop Pattern Whorl Pattern 15

16 Fingerprint Minutiae Minutiae Small, precise, or minor detail. Source: 16

17 Using Minutiae Pros: Used in AFIS applications Well-known and well-researched method Algorithm is well suited for 1-many matching Source: 17

18 Using Minutiae Cons: Cannot be used with all fingerprint sensor technologies, since it puts high demands on sensor resolution and sensor size. People with no or few minutia points (special skin conditions) cannot enroll or use the system. Can be confused by false minutia points (areas of obfuscation that appear due to low-quality enrollment, imaging, or fingerprint ridge detail). 18

19 Using Pattern Matching Pros: Works well with all known fingerprint sensor types All fingerprints possible to capture can be enrolled, even those with no or very few minutia points Well suited for implementations with scarce computing resources e.g. a smart card. Source: 19

20 Using Pattern Matching Cons: Cannot make use of existing AFIS databases (can use raw images though) Not optimized for identification (1 to many searches in a database) 20

21 Hand Geometry Hand Geometry Template Captured Using Digital Imaging Technology Uses CCD (charged coupled device) digital camera to measure the length, width, thickness, and surface area of the hand Takes over 90 measurements from the top and side of hand three separate times for enrollment Strengths fast measurements, lower FTE (failure to enroll) rates, relatively accurate Drawbacks widely varying scores, hand inconsistency (rings), not as unique as other biometrics 21

22 Hand Geometry Source: 22

23 Iris Recognition Iris Code Template Captured Using Digital Imaging Technology Based on visible qualities of the trabecular meshwork in the iris (colored ring around the pupil) of the eye Permanently formed by the 8 th month of gestation through a process called chaotic morphogenesis The estimated chance of any two irides being alike is 1 in Visible characteristics are converted into a digital Iris Code template Strengths very fast verification, almost everyone can use the technology, iris patterns exhibit long-term stability Drawbacks expensive 23

24 Iris Recognition Iris Pupil Source: 24

25 Identification vs. Verification Identification The biometric system will ask who is this? Referred to as 1:N, or 1 to many method. Verification The biometric system will ask Is this person who they claim to be? Referred to as 1:1 method. 25

26 Identity Verification Three Methods of Verifying Identity What you have Badge What you know Pin Who you are Biometric Template 26

27 Biometric Verification All Biometric Products Supported by Lenel are Verification Devices Cardholder cannot gain access without first presenting a badge, entering a PIN, or both 27

28 Biometrics OnGuard Supports Two Types of Credential-based Biometric Access Control: Access Panel-based Templates Template(s) stored in OnGuard database Template stored on access panel (Primary only) LNL-2000, LNL-2220, LNL-3300 or LNL-4420 ISC required LNL-2000 may require additional panel memory to store templates LNL-2210 ISDC supports storage of Bioscrypt fingerprint templates Hand Geometry not supported Allows for all downstream RS 485 (panel based) biometric devices Smart Card-based Templates Template(s) stored in OnGuard database for encoding Template(s) stored on smart card No additional panel memory required Any Lenel ISC can be used 28

29 Biometric Devices Access Panel-based Biometric Verification Hand geometry Schlage Recognition Systems Handkey CR Handkey ID3D Fingerprint recognition Safran BIO-V-Pass-FX (3G) - legacy 4G V-Flex BIO-Vstation (Base) 4G-Vstation (Base) 29

30 Biometric Devices Smart Card-based Biometric Verification Schlage Recognition Systems Handkey II MIFARE iclass Safran BIO-V-Smart-G MIFARE (3G) BIO-V-Smart-H iclass (3G) BIO-V-Station-G MIFARE (3G) BIO-V-Station-H iclass (3G) 4G V-Station iclass 4G V-Station MIFARE 30

31 Biometric Devices Smart Card-based Biometric Verification HID bioclass iclass IrisAccess icam iclass DESFire 31

32 Capture Licensing Biometric capture has been individually separated from the image and signature capture Capture licensing enabled based on biometric product license SWG-1400 OnGuard RSI Hand Geometry Interface Global Software Option for OnGuard SWG-1402 Bioscrypt and HID Smart ID (formerly Integrated Engineering) Interface SWG-1407 CrossMatch/Sagem-Morpho (OpenCapture) SWG-LG IrisAccess Software Interface User permissions control access to biometric capture 32

33 Capture Permissions 33

34 Access Panel-Based Template Storage Solutions 34

35 Access Panel Configuration One or more biometric Access Panel options must be configured for all Access Panel-based template storage solutions Access Panel/Options Select the box for each Biometric solution being used Choose which OSDP biometric templates are being stored INCITS 378 small templates at 320 bytes per template INCITS 378 large templates at 640 bytes per template 35

36 Access Panel Configuration 36

37 System Configuration The following system options must be configured for all Access Panel-based template storage solutions System Options/Biometrics tab Configure maximum number of templates to be stored on the ISC Configure default minimum score/security level Store minimum score/security level per template 37

38 System Configuration 38

39 Biometric Score Schlage Hand Geometry Schlage Recognition Systems Biometric Score Lower score requires more accurate biometric match Increases the required read accuracy range Typical settings would be from depending on accuracy required May be configured For all cardholders Individually for each cardholder Requires 1-2 extra bytes of access panel storage per badge 39

40 Biometric Score Safran Safran Security Levels Very low >> Very high 5 user assignable levels of security Use global security level Uses the default security level configured in OnGuard No security Verification security not enforced May be configured For all cardholders Individually for each cardholder 40

41 Biometric Score Safran No Security SecureAdmin software from Safran may be used to configure the behavior of the reader when this security level is chosen No finger required Will not request finger be presented Finger required Will request finger, but will not enforce any security 41

42 Biometric Score Safran Reader will use lower of the reader and the template security level Very High security level will be automatically configured in the reader security level when reader communicates with the ISC for the first time Template stored in access panel contains security level information configured as part of the fingerprint capture 42

43 Biometric Score OSDP Biometrics OSDP Biometrics OSDP, also known as Open Supervised Device Protocol, is another method of data transmission between an access panel and a reader. One of OSDP s advantages is it supports a larger data transfer size, which allows it to better support biometric data such as fingerprints As with the other two biometric technologies, the storage of the OSDP biometric templates are managed both on the System Options page and on the Access Panel options page 43

44 Biometric Score OSDP Biometrics OSDP Biometrics Like the other biometric systems, the OSDP templates have a minimum score, above which an access granted event will be generated. The higher the score, the more exacting the match must be 44

45 OSDP Secure Channel Secure Channel is the encrypted communications that takes place between reader port and reader over OSDP AES 128 bit encryption The panel generates the random key that will be used for the encryption during the pairing process No key management is required Secure Channel communication is supported between OSDP readers and following Access Series Hardware LNL-1300e onboard reader connected to TB3 only LNL-2210 onboard reader connected to TB2 only LNL-2220 onboard readers 1 and 2 LNL-4420 onboard readers 1 and 2 45

46 OSDP Secure Channel OSDP Secure Channel communication option, is enabled using the General reader form 46

47 OSDP Secure Channel HID SE readers are supported for this Secure Channel functionality Other reader manufactures may be implementing SC in the future HID Readers are not set to support Secure Channel (SC) from the factory A configuration card must be ordered from Lenel Enables OSDP Secure Channel on the reader Resets Secure Channel into install mode Alarm monitoring is then used to pair the reader to the reader port by right clicking on the reader from the System Status window, and selecting Remote Link Mode>>Start 47

48 Biometric Gateway LNL-500B Biometric Reader Interface for Access Panel-based Template Storage Solutions LNL-500B Gateway supports up to 8 readers of the same type from the same manufacturer Optional for Safran Bioscrypt readers As of OnGuard LNL-500B Biometric Gateway has been discontinued as of OnGuard but still supported 48

49 Biometric Gateway LNL-500B LNL-500B device address range is 0-31 LNL-500B reader addressing Port 2: Readers numbered 0-3 Port 3: Readers numbered 4-7 Biometric reader addressing in OnGuard Port The ISC port connected to the LNL-500B Address The physical Dip Switch address of the LNL-500B Reader Number The actual address assigned to the Biometric device 49

50 Biometric Gateway LNL-500B 50

51 Biometric Gateway LNL-500B Firmware Download The LNL-500B gateway firmware must be manually downloaded from the Alarm Monitoring program Right-click mouse on the first biometric reader which will show the Gateway firmware revision and select Download Reader Firmware The Reader type configured for the 1st gateway reader (Reader 0) determines which biometric firmware will be downloaded to the gateway All additional readers configured must be same reader type Note: The LNL-500 Access Panel cannot be converted to a LNL-500B gateway 51

52 Allegion s Schlage Handkey Readers Schlage HandKey CR No door position switch (DPS) or strike relay contained on unit Used with access panel based biometric solutions Schlage HandKey II DPS and strike relay not supported by Lenel Used with smart card based biometric solutions 52

53 Allegion s Schlage Handkey Readers Reader used for biometric hand geometry verification with standard ID cards and/or PIN Hand template stored in database and ISC Reader interfaces via RS-485 communication LNL-500B used as reader interface gateway Configured as an alternate reader 53

54 Allegion s Schlage HandKey CR Readers Reader Configuration LNL-500B (HandKey biometric gateway) is chosen as a reader type for each HandKey CR reader Handkey CR readers must be associated with a primary reader Handkey II does not because it is a smart card biometric reader solution 54

55 Logical Link The association between the primary reader and biometric device creates a logical link in the OnGuard software The primary reader controls the door hardware and configurations are made on the primary reader (card format, online mode, strike and held times, etc.) 55

56 Handkey Keypad The keypad on the Handkey reader may be utilized for access control PIN entry Leading zeros in PIN not supported Requires the correct firmware to support this feature Current LNL-500B firmware Schlage Recognition Systems firmware 121 or greater is required Replace EPROM to upgrade from older versions Pressing the * key ten times will access the on screen menu to display current firmware version Note: Refer to the Hardware Installation Guide for details on how to enable PIN functionality in the RSI reader 56

57 Handkey Virtual Reader Reader may be installed for PIN and Biometric Verify operation only No card reader, or virtual reader A primary reader interface module must be installed and is used to interface to door hardware DPS, strike, REX Primary reader configuration: Reader Type Single or Dual/Any data format Keypad configuration not used Primary reader must be set to Biometric Verify mode A reader license is used for each virtual reader configured in OnGuard 57

58 Handkey Virtual Reader 58

59 Enrollment Reader Configuration Enrollment Hardware The Handkey reader is set up as an RS-232 device connected to an ID CredentialCenter workstation Requires Lenel enrollment kit HK-CR-EK Captures one hand geometry template Each handprint template requires 20 bytes of allocated memory Two additional bytes (22 bytes total) required per template if individual reject threshold is captured with the template 59

60 Hand Template Capture 60

61 Biometric Verify Mode Biometric Verify Mode for all Access Panel-based template storage solutions may be enabled/disabled for the Primary reader On the Reader settings tab Automatically from the Timezone/Reader mode configuration Manually from the Alarm Monitoring System Tree 61

62 Biometric Verify Mode 62

63 Alarm Monitoring Biometric events are filtered by default in Alarm Monitoring, and must be added to the filter list 63

64 Alarm Monitoring Biometric score may be displayed as a column for devices that will transmit biometric information to the host 64

65 Alarm Monitoring There are many possible Alarm Monitoring display options. The three most common are: Biometric score accepted The cardholders biometric data was within the threshold of the template data on the card or the access panel Biometric score rejected The cardholders biometric data was not within the threshold of the template data on the card or the access panel No Biometric template data available The cardholder is not enrolled for that Biometric device 65

66 Alarm Monitoring 66

67 Safran 4G V-Flex Utilizes the Secugen Optical or UPEK TCS1 fingerprint sensor 67

68 Safran Safran readers are used for biometric fingerprint verification with standard ID cards and/or PIN Two fingerprint templates may be captured, but only one can be accessed with Access Panel storage Fingerprint templates stored in DB Primary template stored on ISC Enrollment reader interfaces via USB or RS-232 communication, depending on model RIM used as reader interface gateway (RS-485) Configured as alternate reader 68

69 SecureAdmin SecureAdmin software must be used to initially setup a Safran reader 69

70 SecureAdmin Biometric settings for global security threshold, verification enable/disable, and other settings can be configured from the unit parameters page in SecureAdmin Security Threshold Uses lowest of System, Reader or Individual threshold setting Device Mode Verify and 1:1 TEM required for integrated solution 70

71 SecureAdmin Biometric settings for global security threshold, verification enable/disable, and other settings can be configured from the unit parameters page in SecureAdmin Device ID References reader number Setting based on connection Baud Rate & Protocol RS 485, 38,400 baud rate Serial-232 (enrollment) 57,600 baud rate 71

72 Safran V-Pass FX Reader Configuration V-Pass FX reader is configured as an alternate reader and must be associated to a primary reader Can be connected to a RIM No longer needs to be connected to a LNL-500B as of OnGuard

73 Enrollment Reader Configuration BIO-V-Flex reader set up as USB device connected to ID Credential Center workstation API part of the capture dialog USB connection No serial port required on enrollment PC as of OnGuard USB to Serial port translation software must be installed on the enrollment PC. This software is included on the CD that comes with each new Bioscrypt reader 73

74 Fingerprint Capture Captures 2 fingerprint templates Primary and Secondary used for Smart Card storage only Select template security level for each before capturing Captures fingerprint image (optional) Visual reference Must select Store Image before capturing Each Safran fingerprint template requires 348 bytes of allocated memory 74

75 Fingerprint Capture 75

76 Fingerprint Capture Safran duress function The second fingerprint template capture may be used to generate an access granted under duress alarm Additional configurations must be done with the card formats and enabling the duress function via SecureAdmin 76

77 Fingerprint Capture 77

78 Alarm Monitoring Biometric mismatch with Safran (Bioscrypt) smart card readers By default there is no indication that there is a biometric mismatch with the Safran (Bioscrypt) iclass or MIFARE readers In order to display mismatch events in Alarm Monitoring, the readers have to be programmed to send a fail code 78

79 Biometric Mismatch The following changes have to be made to the Safran (Bioscrypt) units A custom Wiegand card format needs to be defined for the reader The User Field for Failure Site Code must be set to

80 Biometric Mismatch SecureAdmin 80

81 Biometric Mismatch 81

82 Smart Card-Based Template Storage Solutions 82

83 Smart Card Formats MIFARE DESFire iclass 83

84 Why use smart cards? Smart Card Biometrics Processing power Application Memory Additional applications can be stored on the smart card Access Control Other non-onguard applications Application areas secured with encryption keys Less reader licensing required Any Access Panel can be used No additional panel memory required Templates are encoded on the smart card Access Panel-based Biometrics Bio Verify is an option to enable / disable Uses more access panel memory as fingerprints are stored on the access panel Limited to what access panel are deployed 84

85 What to consider when using Smart Cards The amount of smart card memory required for access control, biometrics and other applications Using the Card Serial Number (CSN) as the badge ID as an option to provide more sector memory for other applications CSN is created at the time of manufacturing CSN is not secured by encryption keys CSN can be used for MIFARE, DESFire and iclass smart cards The appropriate access control card format will need to be created to determine what is encoded and read 85

86 Configuring a Smart Card format All Smart Card readers output Wiegand data Wiegand card formats are utilized for the following To provide data to the smart card format for encoding sector application data To interpret access control data that is securely stored on the card To interpret the data output from the reader Sector application data Card serial number 86

87 Configuring a Smart Card format The properties of the smart card include Access control card format Security key Data mapping Optional biometric data The properties of the card format differ for MIFARE, DESFire and iclass smart cards 87

88 MIFARE International Standard for Contactless Smartcards Developed by Mikron Mi-fare Collection System Purchased by Philips in 1998 ISO Part 1/2/3 Communications Available with 1K/16 sector or 4K/40 sector storage for applications Support for Access Control, Biometrics, Payment Cards (Oyster Card) 88

89 Access Control Card Format MIFARE readers output Wiegand data The appropriate access control card format will need to be created to determine what is encoded and/or read A card format used to interpret the MIFARE serial number The MIFARE card serial number is 32 bit binary data Valid Badge ID range is (10 digits) decimal Some readers will include an even and odd parity bit making the data output 34 bit See price book for details on data output 89

90 Types of MIFARE Smart Cards Types of MIFARE Card Formats Bioscrypt (MIFARE) HandKey (MIFARE) HID Access Control (MIFARE) Lenel (MIFARE) Open Encoding Standard (MIFARE) SmartID (MIFARE) Keys for MIFARE smart cards vary by card format 90

91 Bioscrypt (MIFARE) These card formats are used for Safran s Bioscrypt readers Application was previously referred to as V-Smart (MIFARE) Keys for Bioscrypt (MIFARE) During the programming of the reader, the Site Key defined in SecureAdmin must also match the Site Key for OnGuard s Bioscrypt (MIFARE) smart card format 91

92 Bioscrypt (MIFARE) Card layout consists of several components Block 0 Sector 0 Reserved for MAD Directory User data Configurable location Optional Biometrics Fingerprint Hand templates 92

93 Handkey (MIFARE) Used with Allegion s Schlage HandKey readers Keys for HandKey (MIFARE) Application Key A (hex) Automatically populated with a default key Application Key B (hex) Added security key to protect the access control data Store Reject Threshold If checked, the card stores the reject threshold determined in the Multimedia Capture in OnGuard 93

94 HID Access Control (MIFARE) Readers that use MIFARE technology LNL-MT11 LNL-MT15 LNL-MT15K Access Control Format Any Wiegand format is supported Sector Only sectors 1-15 can be selected as only 1K cards can be used 94

95 HID Access Control (MIFARE) Key A and Key B Key Type Options (12 hexadecimal digits) HID Each individual MIFARE application has default keys that will be used to secure the card during encoding These same keys are stored on the reader and are used to access the data on the MIFARE smart card Key value is populated automatically Custom Custom keys require an optional OnGuard license HID Custom Key Software Option SWG-1490 HID Custom Key Generator Software Option includes the ability to create site specific custom iclass/mifare keys for customer cards encoded with HID Access Control or HID MIFARE applications, it also includes the ability to create HID Corporate 1000 site specific formats. This cost is on a per card encoding basis 95

96 Lenel (MIFARE) Used with ILS (Integrated Locking System) locks Application Keys are 12 hexadecimal digits 96

97 Open Encoding Standard (MIFARE) Application settings Access control format Any Wiegand format OES Extensions Future support Create Key Card Used to update the reader with a key 97

98 Open Encoding Standard (MIFARE) Configure button to configure the keys Must use custom security key that is site specific No default key available Key Card must be utilized the update the reader with the custom key Optionally, the reader may be set back to the factory default with an un-key card Key A Required to secure card at defined start sector location Key B Optional for added security Start sector Determines where the access control application will be written 98

99 SmartID (MIFARE) Used with HID SmartID readers formerly Integrated Engineering IE readers discontinued but still supported Application settings Access control format Any Wiegand format Encoding layout IE Strict parity checking between card and reader Non-IE parity not enforced at reader 99

100 SmartID (MIFARE) Allows a custom security key to be defined that is then site specific Configuration card must be utilized to update the reader with the custom key Optionally the custom key may be updated back to the reader factory default with an un-key card Keys used MAD Key B The MAD (MIFARE Application Directory) defines common data structures for card application directory entries, allowing terminals to identify the right memory sector within the card without the need to perform a comprehensive search through all of the cards memories until the appropriate application is found Application Keys A and B Key A Required to secure card at defined start sector location Key B Optional for added security 100

101 SmartID (MIFARE) Configuration Default sector 1 to 39 Determines where the access control application will be written 101

102 DESFire DESFire Data Encryption Standard, Fast, Innovative, Reliable, and Secure An enhancement to MIFARE technology Multiple Key (triple DES) protection for Application folders ISO Part 4 Communications 4K/40 sector application storage A DESFire card can support 28 applications, each with 16 files with individual security (read, write, modify) Support for Access Control, Biometrics and other Applications 102

103 DESFire DESFire technology is used primarily by the US Government. As with other card formats, it is continually evolving to meet the higher security needs of these organizations. OnGuard supports DESFire with Safran Bioscrypt readers Open Encoding Standard DESFire DESFire (TWIC 1.02 Data Model) Uses three 32 hexadecimal digit keys DESFire EV1 with custom data objects 103

104 DESFire Custom Data Objects Configure Custom Data Object (DESFire) card formats using a DESFire card template XML file The template is used to specify keys, key settings, and file access rights The contents of the files to be encoded consist of access control data (Wiegand, badge ID, issue code, facility code), UDFs (User Defined Fields) as well as biometric and binary data, and static text that can be customized based on how your data is structured Import the XML template file into the Card Template on the Custom Data Object (DESFire) Card Format form or Export the template with the keys 104

105 DESFire Custom Data Objects Custom Data Object Allows you to import an XML file in order to Create Credentials compatible with major DESFire EV1 Readers Reference the OnGuard Documentation which includes a PDF called DESFire Card Template XML Specifications 105

106 iclass An open platform technology developed by HID HID factory key management or custom key management 2K,16K, 32K memory with support for 2 to 32 (16 per book) applications Book 1 (second 16K of data space) encoding support added in OnGuard A wide assortment of credentials and readers are available 106

107 Types of iclass Applications Types of iclass Applications Bioscrpyt (iclass) GSC (iclass) HandKey (iclass) HID Access Control (iclass) IrisAccess (iclass) Lenel (iclass) Keys for iclass smart cards vary by applications 107

108 Access Control Card Format iclass readers output Wiegand D1/D0 data A custom card format used in encoding and interpreting access control data securely stored in the card sector The appropriate access control card format will need to be created to determine what is encoded and/or read A Wiegand card format is used to interpret the iclass card serial number The iclass card serial number is 64 bit binary data Only the first 56 bits of the 64 can be used to represent the badge ID because OnGuard supports Badge ID length of 18 digits max Some readers will only read a limited bit number from the card (Example Casi 55 bit) 53 bits of ID plus Even and Odd Parity 108

109 iclass Card Formats and Keys GSC (iclass) Uses default GSC (U.S. Government Smart Cards) Master Key or Custom key defined in OnGuard HandKey (iclass) Uses a 16 hexadecimal digits key to secure application areas IrisAccess (iclass) Key used to secure the iris template Option in OnGuard to remove Iris data after successful encoding Lenel (iclass) Used with ILS (Integrated Locking System) locks Uses a 16 hexadecimal digits key to secure application areas 109

110 Bioscrypt (iclass) Card Format & Keys Application was previously referred to as V-Smart (iclass) This is the card format selected during the encoding process Site Key that is programmed into SecureAdmin is also programmed into OnGuard 110

111 Safran (Bioscrypt) Reader Site Key The Bioscrypt SiteKey is shared between the card and the reader. The initial SiteKey MUST be entered through SecureAdmin Secure Admin configuration OnGuard Card Format configuration 111

112 Safran (Bioscrypt) Reader Card Layout Smart Card Manager Setting used to configure card layout for smart card readers Must be set on each verification reader being used 112

113 Keys for HID Access Control (iclass) Each iclass application has Public Transport Keys Provided by HID Prior to OnGuard 6.6, INSIDE keys were used by HID INSIDE Secure is a company that provides secure platforms and digital security for software applications INSIDE Secure makes the chip that goes inside the iclass cards Public Transport Keys are stored in OnGuard and used to access the iclass smart card application areas to write applications (access control, biometrics, etc.) which are then secure with additional keys 113

114 Keys for HID Access Control (iclass) Once the card is accessed using the Public Transport Key, the application areas used for access control, biometrics is secured one of three ways HID Secret Key Known by HID and PRGL device that is used to program readers The HID Secret Key is built in the PRGL device The PRGL device is used to encode the HID Access Control application and secure it with the proprietary HID secret key Readers come programmed with the HID Secret Key Book 0, Page 0, Application Area 1 is reserved for HID Access Control application Lenel Key Must use Configuration Card to program readers with the key HID Custom Key SWG-1490 license required SWG-1490 HID Custom Key Generator Software Option includes the ability to create site specific custom iclass/mifare keys for customer cards encoded with HID Access Control or HID MIFARE applications, it also includes the ability to create HID Corporate 1000 site specific formats. Key customizable by customer and readers are programmed by HID with the customer s custom key Must use configuration card to program readers with the custom key 114

115 Keys for HID Access Control (iclass) If Card Type selected is Access Control with BioClass then only two key options for BioClass Key type Custom key Lenel key 115

116 HID Access Control (iclass) Configuration Application settings Access control format Any Wiegand format Access Control Key HID secret key Lenel proprietary key Custom Memory Configuration 16K/16 App, 16K/ 2 App and 2K/2 App Always programmed to Book 0, Page 0, App Area 1 Configuration Card Available with Lenel or Custom Keys 116

117 HID iclass cards may be purchased in three ways Blank Configured Programmed 117

118 Determining what to order Non-configured (blank) cards Can only be purchased through Lenel Can be ordered as 2k, 16k or 32k (32k same as 16k for configuration) Card is empty and layout is configured (formatted like a drive) and programmed during the encoding process Allows for complete customization of the card Cards will need to be configured using OnGuard and a PRGL device 118

119 Determining what to order When programming non-configured (blank) cards Application areas are configured and secured with the HID Public keys The HID Public Key is hard coded in OnGuard The PRGL device is used to encode the HID Access Control application and secure it with one of the following The proprietary HID secret key Lenel Key Custom Key 119

120 Determining what to order Configured Can be programmed but layout already defined at time of order Configured cards may be programmed with the appropriate application using OnGuard and PRGL device (or a device such as a Bioscrypt V-Station with iclass) HID Public Transport Keys or INSIDE Secure keys will need to be used for initial access Application areas further secured with HID Secret Key, Lenel Key, or HID Custom Key 120

121 Determining what to order Programmed Cards are ordered and ready for use with the HID Access Control application Access Control data already exists as well as card configuration Pre-programmed iclass data is specified at time of order New applications may be added or existing modified if keys are known 121

122 Bioscrypt (iclass) and HandKey (iclass) Smart Card Layout Card layout consists of several components Book 16K,2K single Book 0 32K w/book 0 & Book 1 Pages 16K per book Configurable location Application Area Secured per Application Book 0, Page 0 App Area 1 Reserved for HID Access Control Data 122

123 iclass Key Rolling Cards Key Rolling Cards are available from HID for readers using the standard master key Used to secure the readers after a security breach of the old master key The Key Rolling card will allow each reader to be updated manually by presenting the manufacturer provided card to the reader Once the reader has been updated, each individual access control card will be updated with the new master key as they are used at the reader 123

124 HID Corporate 1000 Writes complete corporate 1000 format including special parity Badges created in OnGuard will be identical to badges produced by HID Format can only be written to: HID iclass Access Control Application HID MIFARE Access Control Application OES (DESFire) HID Corporate 1000 format must be secured by the HID secret key (written by OnGuard) - Lenel or custom keys not allowed with this encoding When HID key is selected in OnGuard in conjunction with HID Corporate 1000 special Parity, a license dialog is presented to the user, asking them to consent to the terms from HID. This should be viewed as confirmation that you are creating TRUE corporate 1000 badges. Corporate 1000 format requires SWG-1490 license 124

125 HID Corporate 1000 When purchasing the HID Corporate 1000 cards, the correct type must be selected when creating the Wiegand card HID Corporate bit The number of individual card numbers available is 1,000,000 HID Corporate bit Introduced March 2015 due to high demand on the Corporate bit The number of individual card numbers available is 8,000,

126 Smart Card Readers Schlage Recognition Systems HandKey readers HID readers Safran (Bioscrypt) readers IrisID readers 126

127 Allegion s Schlage Handkey II MIFARE iclass 127

128 Allegion s Schlage Handkey II Readers come preconfigured for 26 Bit Wiegand format Any other format must be custom ordered Consult Lenel Inside Sales before ordering these products 128

129 HID bioclass HID RWKLB575 reader Combines iclass smart card reader LCD display PIN Keypad Finger sensor Uses a Sagem Morpho sensor Uses HID bioclass card format PIV not available 129

130 HID bioclass Card Format Configuration HID Access control application card type options HID Access control only Access control with bioclass Add bioclass Adds fingerprint to existing HID iclass access control smart card 130

131 HID bioclass Card Format Configuration Uses two 16 digit hexadecimal keys HID Access Control Application HID Lenel Custom bioclass Biometric Lenel Custom Smart card memory configurations 16 KB / 2 or 16 application areas Configuration card Available only when using Lenel or custom access control key types 131

132 Open Capture Allows for the open interchange of fingerprint templates in compliance with the ANSI 378 standard Currently supported Open Capture devices Cross Match Verifier 300 Sagem Morpho MSO series Fingerprints for the HID RWKLB575 reader are captured using an Open Capture device 132

133 Open Capture Sagem Morpho MSO Cross Match Verifier

134 Open Capture The layout of this form has been improved to be more intuitive. The boxes that display each fingerprint are now logically displayed from left to right for left and right hands 134

135 Open Capture 10 Print Slap 500 ppi image capture INCITS 378 ANSI 378 template format (generated from image) PK_COMP v2 Sagem Morpho template 135

136 Safran s Bioscrypt Readers V-Flex (Smart) and V-Station (Smart) Contactless smart card fingerprint readers* Verifies fingerprint locally at reader Standard Wiegand communications with Lenel reader interface modules LNL-1300, LNL-1320, LNL-2220, LNL-2210, LNL-1300e, LNL Two fingerprint templates may be captured and encoded on a Smart Card for alternate fingerprint verification Fingerprint templates stored in database Fingerprint templates stored on Smart Card *Refer to the Hardware Installation Guide for details on how to configure readers 136

137 Safran s Bioscrypt readers 4G Units Replaceable sensors Cannot change technology (i.e. optical to capacitance) Backwards compatible with legacy 3G devices Backwards compatibility - Devices can operate in a mixed environment 137

138 Safran s Bioscrypt 3G (legacy) BIO-V-Smart-G MIFARE BIO-V-Smart-H iclass MV1610 fingerprint sensor Sensor and reader are a matched set based on serial number. They CANNOT be swapped No longer sold but still supported 138

139 Safran s Bioscrypt 4G Readers Bioscrypt 4G V-Flex Secugen Optical sensor MIFARE, DESFire, iclass readers available Bioscrypt 4G V-Station WR Weather Resistant 139

140 Safran s Bioscrypt 4G Readers Bioscrypt 4G V-Station Includes keypad and LCD Screen Bioscrypt 4G V-Station WR Weather Resistant 140

141 Safran s Bioscrypt 4G Bioscrypt 4G V-Flex Lite Bioscrypt 4G V-Station Lite Fingerprint reader with Secugen Optical sensor Capable of reading MIFARE, DESFire, iclass smart cards 141

142 Safran (Bioscrypt) Passcode Bioscrypt Passcode is an optional security feature Must be enabled in the reader using the SecureAdmin program Passcode is verified locally in the reader not at the access panel OnGuard PIN stored on smart card as part of template Card must be re-encoded if OnGuard PIN is changed Standard Wiegand communications with Lenel reader interface modules LNL-1300, LNL-1320, LNL-2220, LNL-2210, LNL- 1300e, LNL

143 Safran (Bioscrypt) Reader Configuration Smart Card based biometric readers are configured the same as standard proximity card readers 143

144 Safran (Bioscrypt) Topology 144

145 Safran (Bioscrypt) Duress Finger Support These Smart card readers support duress finger Must use smart card based templates Access panel based templates not supported Two fingers must be captured The primary will be designated as the primary non-duress finger The secondary will be designated as a duress finger The OnGuard smart card format(s) must be configured to store two fingerprint templates The reader must be configured using SecureAdmin to read the two templates 145

146 Duress Finger Support Configuration to be made in SecureAdmin 146

147 Duress Format - Configuration Reports duress events when a duress card format is received Supported for both Magnetic and Wiegand card formats Configuration to be made in OnGuard 147

148 Duress Finger Support 148

149 Iris ID s IrisAccess icam 3000 and icam 4000 units are both legacy units. icam 3000 units are end of life as of OnGuard and icam 4000 units are end of life as of OnGuard Both units require a separate enrollment and verification reader 149

150 icam 4000 Series icam4000 Reader icam4100 Reader The icam 4000 series readers include TCP/IP communications Motorized height adjustment Audio and visual cues during verification iclass and DesFire Smart Card support A keypad and 40 character display on the 4100 model 150

151 icam 4000 Series Adjustable height / angle The distance for a proper read is between 10 and 14 inches When looking at the reader, the person will see an amber dot like this When the person is at the proper distance, the amber dot turns to a green dot like this Both audio and visual indicators will guide the person 151

152 Identification Control Unit (ICU) ICU4300 Each unit supports up to four icams Supports both 4000 and 3000 icams Four Wiegand output channels 152

153 Iris Templates using icam7000 The use of the LG IrisAccess 7000 product is supported in OnGuard This product is implemented in 4000/4000V mode icam connected to ICU network or icam stand alone mode No encoding can be performed using the icam 7000 The unit contains a Omnikey encoder currently unsupported in OnGuard The PIN on the icam unit functions to provide multifactor authentication Card (including Iris verification) PIN then Card may be used, but this is not recommended This is due to the 15 seconds timeout between PIN and Card data received 153

154 icam IrisAccess 7000 GPIO The icam 7000 supports the ability to use the onboard relays to fire based the verification status. This can be used to control local green/red indicators or be wired to OnGuard alarm panel inputs for; Verification pass Verification fail Useful green light/red light scenario OnGuard will receive no data from the device when the iris verification fails The onboard relays may be used to control local green/red indicators or be wired to OnGuard alarm panel inputs The LG IrisAccess device provides no event to OnGuard if iris verification fails 154

155 icam IrisAccess 7000 Modes The icam 7000 supports 3 modes of operation Mode 1 Used for enrollment or when connected to an ICU 4000 Mode V Mode used for standalone operation (no ICU needed) EOL for development in 2014 Mode 3 Standalone or used with Iris Admin software Preferred operation mode for standalone configuration All future features and support will be built for Mode 3 155

156 Iris Access Topology Examples Legacy icam topology with the icam4000 units Mixed environment with an ICU and icam4000 along with icam7000 devices where the 7000 units do not need to interact with the ICU 156

157 icam Enrollment Reader To configure log into the icam 7000 using any supported web browser. Username= icam7000 Password=iris

158 icam Enrollment Reader icam 7000 web interface menu options 158

159 icam Enrollment Reader The icam 7000 must be configured in the web interface and set to Mode 1 No other changes are needed for enrollment 159

160 IrisAccess icam Capture Specify IP Address of icam and click Connect 160

161 IrisAccess icam Capture Once connected, the background image of the room will appear in the Preview window 161

162 IrisAccess 4000 Capture Click on Capture Fake eye detection and Store images is optional 162

163 IrisAccess Biometrics Image and Iris data template types are captured for the cardholder 163

164 icam Verification Reader The icam 7000 must be configured in the web interface and set to Mode 3 for standalone use IrisServer IP only needed when using IrisID software Security ID is used to secure the connection between the ICU and icam (not needed for standalone mode) use all 1s for placeholder data 164

165 icam Verification Reader Configuration The icam Settings menu option Recognition Mode needs to be set to Iris+SmartCard Verification Timeout is the time between a card read and the start of the verification process Eye Selection is used to determine if both or either template will be matched during the verification process 165

166 icam Verification Reader Configuration The icam Wiegand Settings menu option Wiegand In and Wiegand Out must be enabled Bypass the input signal through Wiegand In into the output, this allows the pass through of wiegand data from the card to the access control system 166

167 icam Verification Reader Configuration The icam Smart Card Settings Smart Card Reader Interface needs to be USB for internal reader Serial for attached iclass serial RS-232 reader Book 0 for 1st 16K or Book 1 for 2 nd 16K on iclass card Authentication Key needs to be a 16 character hexadecimal key that must match entry in programming software 167

168 icam Verification Reader Configuration The icam GPI & Relay Settings menu option Select a system to check users access rights - Access Control System must be selected for integration with OnGuard software Relays Configured for verification pass or failures for local notification or wired back to access control system for failed notifications Note: Iris Access icam7000/icam4000 do NOT send back failed verification attempts (mismatch alarms) to the access control system 168

169 IrisAccess Encoding IrisAccess ID application (templates) supports encoding to Book 1 of a 32K iclass card Requires the HID access control application to be present on the card in the standard location 169

170 What is required when encoding a badge? Badge Type Encoder Workstation Badges 170

171 Badge Types Badge Type must be configured for encoding Selects which Card Formats may be used for encoding Select Badge Type Add Card Formats to be encoded Smart Card format Magnetic format for stand-alone encoding of magnetic stripe cards Inline Encode (Card printers w/built in encoder) 171

172 Badge Types 172

173 Encoders Encoders must be configured for a specific Workstation before they will be available to encode a badge Configure the Workstation Configure the Encoder for that Workstation 173

174 Encoders 174

175 Encoders 175

176 Smart Card Encoding The Encode button will allow encoding of the smart card Cardholder must have an active badge Select badge ID to be encoded if multiple active badges exist Badge type must be configured for smart card encoding Encoder must be installed on a configured workstation 176

177 Smart Card Encoding Select Badge and Click Encode Button Select Card Format and Encoder Click Encode button Follow On-Screen Instructions 177

178 Smart Card Encoding 178

179 Smart Card Encoding 179

180 Smart Card Encoding Smart Card encoding will include any or all of the following dependent on the Biometric technology: Biometric template(s) Badge information Facility code, Badge ID and Issue Code Cardholder s personal information First and last name PIN number 180

181 Smart Card Encoding Be sure that you have the correct encoder for the Smart Card technology that you are using (Hardware Installation Guide) Examples: HID iclass A programmer must be used to encode the HID iclass application 6121BKN0000PRGL» Programmer cannot be used as a smart card reader Bioscrypt iclass Use the V-Smart BIO-Desktop-VT1 for encoding and fingerprint enrollment Bioscrypt MIFARE Use the V-Smart BIO-Desktop-VT for encoding and fingerprint enrollment 181

182 OAAP One to Many (1/N) Biometric only solution 182

183 OAAP OAAP Open Access Alliance Program Build Specific Allows third party manufacturers to write integrations for use with the OnGuard software API Integrations include Facial Recognition, 1 to Many fingerprint (Bio Only), Video Management, Visitor Management and more Entertech Systems Suprema Readers are certified with OnGuard 6.5, 6.6, 7.0, 7.1 Refer to the specifics of the integration with OnGuard and Suprema readers in the OAAP section of 183

184 Student Transcripts Thank you for attending this course! Student transcripts (including records of CEUs issued) are available online through the Lenel Training Portal at all times and can be viewed or downloaded at any time. Official Transcripts can also be sent via through the Lenel Training Portal. 184