MobileVerify User Guide

Transcription

1 MobileVerify User Guide PERPETUAL INNOVATION

2 Lenel OnGuard 2012 MobileVerify User Guide, product version 6.5 Item number DOC-1000, revision 2.003, December 2011 Copyright Lenel Systems International, Inc. Information in this document is subject to change without notice. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Lenel Systems International, Inc. Non-English versions of Lenel documents are offered as a service to our global audiences. We have attempted to provide an accurate translation of the text, but the official text is the English text, and any differences in the translation are not binding and have no legal effect. The software described in this document is furnished under a license agreement and may only be used in accordance with the terms of that agreement. Lenel and OnGuard are registered trademarks of Lenel Systems International, Inc. Microsoft, Windows, Windows Server, and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Integral and FlashPoint are trademarks of Integral Technologies, Inc. Crystal Reports for Windows is a trademark of Crystal Computer Services, Inc. Oracle is a registered trademark of Oracle Corporation. Other product names mentioned in this User Guide may be trademarks or registered trademarks of their respective companies and are hereby acknowledged. Portions of this product were created using LEADTOOLS LEAD Technologies, Inc. ALL RIGHTS RESERVED. OnGuard includes ImageStream Graphic Filters. Copyright Inso Corporation. All rights reserved. ImageStream Graphic Filters and ImageStream are registered trademarks of Inso Corporation.

3 MobileVerify User Guide Table of Contents Introduction...7 Chapter 1: Mobile Enterprise Overview...9 MobileVerify Limitations... 9 Conventions Used in this Documentation MobileVerify Setup...11 Chapter 2: Setting Up a Mobile Computer...13 Scenario A: MobileVerify Client on a Wired System Scenario B: MobileVerify Client on a Wireless System Scenario C: Wireless Without Connection Replication for MobileVerify Systems Scheduling Replication MobileVerify Software Configuration...19 Chapter 3: License and Permissions...21 License for MobileVerify Set Permissions to Use MobileVerify Chapter 4: FormsDesigner Configuration...23 Configuration Sequence Configuration Procedures Add a Force Protection Setting Page (Optional) revision 2 3

4 Table of Contents Add a Cardholder Force Protection Setting Field Create a Recommendation Label Create Recommendation Buttons Create a Current Gate Setting Label Create a Current Settings Label Save the Page MobileVerify Operator Procedures...37 Chapter 5: Access Control Configuration...39 Configuration Sequence Configuration Procedures Populate the Force Protection Setting List Configure the System s Force Protection Setting Configure Gates Configure Workstations Assign Force Protection Settings to Cardholders Chapter 6: Verification and User Procedures...47 Verification Sequence Verification Process Without Override Permissions Diagram Verification Process With Override Permissions Diagram Search for a Badge ID Search Using a Keyboard Wedge Reader Change a Workstation s Gate Association revision 2

5 MobileVerify User Guide Chapter 7: Change System Settings...53 Change the Gate a Cardholder is Associated With Chapter 8: MobileVerify Reports...55 Determine Occupancy for an Area Glossary...57 Index...59 revision 2 5

6 Table of Contents 6 revision 2

7 Introduction

8

9 MobileVerify User Guide Chapter 1: Mobile Enterprise Overview Mobile Enterprise is a seamlessly integrated, robust solution that transports virtually all OnGuard client functions to a wearable, portable computer. The wearable computer connects to the network and to the OnGuard server via B wireless Ethernet online. It is also available as a standalone solution that can be synchronized with the OnGuard server on an operational basis. MobileVerify is a feature specifically designed for Mobile Enterprise solutions that uses portable computers running OnGuard to provide a way for security officers, guards, or sentries to make fast, intelligent decisions about whether to grant or deny a cardholder access to a specific area. The officer uses an optional scanner or reader to search the OnGuard database for access privileges, and is instantly presented with the system s recommendation for whether to grant or deny the cardholder access. MobileVerify is meant for use in areas where electronic access control is typically not applicable such as gates around the perimeter of a military base, entrances at a fenced in construction site, boarding sites on naval ships, or for other types of gated checkpoints. A mobile computer handles all of the client functions, and connects to the OnGuard server via b wireless Ethernet standards. The mobile computer is personal computer platform independent - it may consist of a tablet computer, laptop, desktop, wearable computer, or any computer with a Windows operating system. The computer must have Mobile Enterprise installed on it, and must have a wireless network card. The wireless network is designed, acquired and attenuated, providing connectivity between the Mobile Enterprise computer and the wireless access (connectivity) point on the secure side of the network. Without a network connection, Mobile Enterprise can be reconfigured to operate in a standalone mode. To put things very simply, Mobile Enterprise is the OnGuard Enterprise product combined with the MobileVerify feature and some type of mobile computer. For more information about Enterprise systems, refer to the Enterprise User Guide. This manual assumes that you already have a wireless network in place, have installed OnGuard, set up your database, and are ready to configure MobileVerify. MobileVerify Limitations The main limitations of the MobileVerify feature include: MobileVerify is only available for cardholders, not for visitors. MobileVerify is limited to a single recommendation based on a single cardholder drop-down value. This limitation is evident in situations where personnel are given a recommendation to enter an area, but then have no real way to give a different recommendation for leaving an area. An example of this would be sailors getting on a ship. MobileVerify could be used to validate sailors boarding a ship, but it could not be used to recommend who can leave the ship unless the recommendation is the same regardless of entering or leaving. revision 2 9

10 1: Mobile Enterprise Overview A security officer, guard, sentry, or other authorized user is required because a determination must be made whether to approve the system s grant or deny recommendation. Conventions Used in this Documentation Where a term is defined, the word is represented in italics. Field names, menus, and menu choices are shown in bold. Keyboard keys are represented in angle brackets. For example: <Tab>, <Ctrl>. Keyboard key combinations are written in two ways: <Ctrl> + <Z> means hold down the first key, then press the second. <Alt>, <C> means press the first key, then press the second. Window buttons on the screen are represented in square brackets. For example: [OK], [Cancel]. Throughout the documentation, flowcharts are used to illustrate processes. Each shape and line used has a distinct purpose: Shape or line Purpose Indicates the start or end of a process Indicates a process A dotted line indicates that whatever specified within that shape is optional Indicates that a decision is made Feedback is received 10 revision 2

11 MobileVerify Setup

12

13 MobileVerify User Guide Chapter 2: Setting Up a Mobile Computer This section provides a general overview of setting up any mobile computer for use with Mobile Enterprise. The mobile computer is personal computer platform independent - it may consist of a tablet computer, laptop, desktop, wearable computer, or any computer with a supported Windows operating system. A MobileVerify station can be set up three different ways: As a client on a standard system (scenario A) As a wireless client with a constant connection (scenario B) As a wireless client with a temporary connection (scenario C) These scenarios are depicted in the following diagram. If you can accept that when the connection is not available, the MobileVerify station does not work, then your setup is simple. If, however, you wish to be able to use the MobileVerify station even when the connection is not available, then you will need to set up a distributed ID database on the MobileVerify station. (For more information, refer to the Distributed ID Management Systems chapter in the Replication Administration User Guide.) Replication will then be used to keep the databases up to date with each other when they connect to the main revision 2 13

14 2: Setting Up a Mobile Computer database. Replication is the bi-directional transaction exchange of cardholder records and download of system information. Scenario A: MobileVerify Client on a Wired System In scenario A, the simplest of all MobileVerify setups, a standard OnGuard client is used with the MobileVerify feature. In this scenario, there is a single database which resides on the server, and the client is connected via ethernet to the server. To set this scenario up: 1. On the server computer: a. Install the OnGuard software, making sure to select Server when prompted. b. Configure the hardware key. For more information, refer to Configuring the Hardware Key in the Installation Guide. Important: If you are using a software license you do not need to use a hardware key or install the Sentinel drivers. c. Install the OnGuard license using License Administration.For more information, refer to Install Your OnGuard License in the Installation Guide. d. Create the database by running Database Setup. e. Configure your custom MobileVerify interface in FormsDesigner. For more information, refer to Chapter 4: FormsDesigner Configuration on page 23. f. Configure the access control options. For more information, refer to Chapter 5: Access Control Configuration on page On the mobile computer, install the OnGuard software. Make sure to select Client when prompted. Scenario B: MobileVerify Client on a Wireless System Scenario B is essentially the same as Scenario A, with one exceptions: the network is wireless. In addition, Scenario B does not have a locally connected database. In this configuration, a standard OnGuard client with a wireless ethernet network card is used with the MobileVerify feature. If you are concerned about losing connectivity to the server, then set up Scenario C. 14 revision 2

15 MobileVerify User Guide Scenario C: Wireless Without Connection In scenario C, a MobileVerify client is connected to the server via wireless ethernet. Since it is possible that the MobileVerify client may lose its connection to the server, the server is set up as a Distributed ID Master server, and the MobileVerify client is configured as a Mobile Badging station. This means that there is a database on both the server and on the MobileVerify client. The databases are kept synchronized periodically by running Replicator. Replicator is run as a service on the MobileVerify client, and the MobileVerify client is set up to replicate with the server on a predetermined schedule. If this configuration is used and the connection fails, then an error message displays telling you this. You must then log out of the DSN that points to the server, and log back into OnGuard using a DSN that points to the database that is on the MobileVerify client. This process is not automatic; you must do this manually. Once you have logged into the DSN that points to the MobileVerify client s database, you can then function without the server. However, the information in your database is only as current as when your last replication occurred. Also, since the Communication Server generally runs on the server and you do not have a connection to the Communication Server, the Open Door command cannot be used. In this case, the person who is responsible for physical security would become responsible for granting access based on the OnGuard system s recommendation. Once the connection is re-established, Replicator should be run manually and used to perform a full upload and download as soon as possible to get the two databases synchronized. To set this scenario up: 1. On the server computer: a. Install the OnGuard software, making sure to select Server when prompted. b. Configure the hardware key. For more information, refer to Configuring the Hardware Key in the Installation Guide. Important: If you are using a software license you do not need to use a hardware key or install the Sentinel drivers. c. Install the OnGuard license using License Administration. For more information, refer to Install Your OnGuard License in the Installation Guide. d. Create the database by running Database Setup. e. Configure your custom MobileVerify interface in FormsDesigner. For more information, refer to Chapter 4: FormsDesigner Configuration on page 23. f. Configure the access control options. For more information, refer to Chapter 5: Access Control Configuration on page 39. revision 2 15

16 2: Setting Up a Mobile Computer Note: If the system is an Enterprise system, gates cannot be configured on the Master server. Gates are treated as hardware, so they must be added at a Regional server or MobileVerify station. 2. On the MobileVerify computer: a. Install a network card if the system will be configured to connect to the network and to the OnGuard server via B or G ethernet. b. Install the OnGuard software. Make sure to select Server when prompted. c. Configure the hardware key. For more information, refer to Configuring the Hardware Key in the Installation Guide. Important: If you are using a software license you do not need to use a hardware key or install the Sentinel drivers. d. Install the OnGuard license using License Administration. For more information, refer to Install Your OnGuard License in the Installation Guide. e. Create the database by running Database Setup. f. Log into Replication Administration and configure the database to be a Distributed ID Mobile Station. (For more information, refer to the Distributed ID Management Systems chapter in the Replication Administration User Guide.) g. Run a Replicator session. Make sure to select the following options: Download cardholder records from the master server (by selecting the Download cardholders/assets check box and selecting download options) Download system tables from the master server (by selecting the Download system records check box) Enterprise users: If you configured gates, select the Upload cardholders/assets/hardware records check box. h. Configure Replicator to run as a service. i. Configure a replication schedule. Replication for MobileVerify Systems The Replicator application is responsible for replication. Replication is the process of sending transactions up to the parent server and getting transactions from the parent server. Replicator is run on each Regional server or Mobile Station. It is the Regional server or Mobile Station that initiates replication. MobileVerify can be set up two different ways: With a constant connection to the server via a wireless network card, or 16 revision 2

17 MobileVerify User Guide As a standalone solution that gets synchronized with the server on an operational basis. When MobileVerify is set up with a constant connection, Replicator is run as a service. When set up as a standalone solution, Replicator is run as an application and is started manually. For information on how to run a Replicator session or to schedule Replication refer to the Replicator User Guide or online help. For additional information about replication, refer to the Replication Administration User Guide or online help. Scheduling Replication Traditional Mobile stations are designed to run Replicator manually (not as a service or scheduled). This configuration works off Distributed ID Masters, Enterprise Masters, and Enterprise Regions as the parent to the mobile. Mobile Enterprise does offer the option of setting up a mobile station with scheduled Replication which requires it to run as a service. This type of configuration IS NOT supported from an Enterprise Master. This type of mobile revision 2 17

18 2: Setting Up a Mobile Computer needs to have either a Regional server or Distributed ID Master as the mobile s parent system. The following table illustrates the differences between the two systems: System type Manual replication? Scheduled replication? Supported parent server types Master Region Distributed ID Master Traditional Mobile stations X X X X Mobile Enterprise X X X X 18 revision 2

19 MobileVerify Software Configuration

20

21 MobileVerify User Guide Chapter 3: License and Permissions License for MobileVerify MobileVerify is a licensed feature. The MobileVerify license is count-based; you are licensed to have a certain number of workstations. The number of workstations you are licensed to use is displayed in the Maximum Number of Mobile Verify Workstations (SWG-1470) setting in the Mobile Enterprise section of the license, as shown. Set Permissions to Use MobileVerify 1. From the Administration menu in System Administration, select Users. 2. Click the System Permission Groups tab. 3. Click [Add]. 4. If segmentation is not enabled, skip this step. If segmentation is enabled the Segment Membership window will open. a. Select the segment that this permission group will be assigned to. b. Click [OK]. 5. In the Group Name field, type a unique, descriptive name for this permission group. 6. On all sub-tabs, select the checkbox(es) that correspond to the capabilities you wish to include in this permission group. The MobileVerify tab contains the mobile verification options. a. Select the MobileVerify checkbox to allow the user to configure MobileVerify. b. Select the MobileVerify Administration checkbox to allow the user to perform MobileVerify administrative functions. c. Select the Change system-wide [threat level] checkbox to allow the user to change the system-wide force protection setting. This is done on revision 2 21

22 3: License and Permissions the System Settings form in the MobileVerify folder. To display the MobileVerify folder, select Administration > MobileVerify. Note: By default, the name of this field is Change system-wide [threat level]. However, the portion in italics may change depending on your configurations in FormsDesigner. For more information, refer to Chapter 4: FormsDesigner Configuration on page 23. d. Select the Gate configurations checkbox to allow the user to change MobileVerify user gate configurations. This is done on the Gates form in the MobileVerify folder. e. Select the MobileVerify Workstation Options checkbox to allow the user to configure MobileVerify workstation options. f. Select the Change gate assigned to workstation checkbox to allow the user to change the gate assigned to a workstation. This is done on the Gate Configuration sub-tab in the Workstations folder. g. You can select either the Change [threat level] setting to anything checkbox or the Change [threat level] setting to higher than default only checkbox. Note: By default, the names of these fields are Change [threat level] setting to anything checkbox and Change [threat level] setting to higher than default only. However, the portion in italics may change depending on your configurations in FormsDesigner. For more information, refer to Chapter 4: FormsDesigner Configuration on page Click [OK]. Select the Change [threat level] setting to anything checkbox to allow the user to change a particular gate s force protection setting to anything he/she chooses. Select the Change [threat level] setting to higher than default only checkbox to allow the user to change a particular gate s force protection setting to a setting higher than the default only. 22 revision 2

23 MobileVerify User Guide Chapter 4: FormsDesigner Configuration If you are working with an existing database, make sure to make a backup and verify that it is good before making changes in FormsDesigner! Configuration Sequence Before you can use MobileVerify, you must use FormsDesigner to configure both the database and the user interface to meet your needs. You must: 1. Add a Force Protection Setting page (optional). The alternative is to incorporate the MobileVerify fields and buttons onto the Cardholder page. The Cardholder page or a new page are the only places the MobileVerify fields can be added. For more information, refer to Add a Force Protection Setting Page (Optional) on page Add a cardholder Force Protection Setting field. For more information, refer to Add a Cardholder Force Protection Setting Field on page Create a recommendation label that displays a recommendation based on a comparison of the cardholder s force protection setting to the current system s force protection setting. For more information, refer to Create a Recommendation Label on page Create recommendation buttons for the recommendation label. For more information, refer to Create Recommendation Buttons on page Create a current gate setting label. For more information, refer to Create a Current Gate Setting Label on page Create a current settings label. For more information, refer to Create a Current Settings Label on page Save the page. For more information, refer to Save the Page on page 34. After FormsDesigner has been configured, the access control system can be configured. For more information, refer to Chapter 5: Access Control Configuration on page 39. revision 2 23

24 4: FormsDesigner Configuration Configuration Procedures Add a Force Protection Setting Page (Optional) 1. Decide what you want your user interface to look like. You can either choose to add the MobileVerify fields and buttons to the Cardholder page, or you can create a new page and add them there. For simplicity, these instructions will assume that you are adding a new page. 2. Start and log into FormsDesigner, if you have not already. Choose to open the Cardholder form when prompted. For more information, please refer to the Introduction chapter in the FormsDesigner User Guide. 3. From the Insert menu, select Page. The Pages window is displayed. 4. Click [Add]. 5. In the Name field, type Force Protection Setting, or any other name you would like the tab to be called, and then click [OK]. a. The Force Protection Setting page appears in the list box of the Pages window. b. Click [Close]. 6. A tab with the page s name is added to the main window. By default, it is positioned between the Cardholder and Badge pages. Add a Cardholder Force Protection Setting Field 1. Click the Force Protection Setting tab. 2. The first step is to add a drop-down list. From the Insert menu, select Drop-down List. a. Click and drag on the Force Protection Setting page to create a box to contain the object. Don t worry too much about size or placement; you can change these attributes later. 24 revision 2

25 MobileVerify User Guide b. The corresponding Properties folder will be opened with the Drop-down Settings form displayed. 1) In the Object name field type Force Protection Setting or any other name you wish to use. 2) In the Field name field type FORCEPROTECTION or any other name you wish to use. The name cannot contain spaces or special characters. 3) Select the Required checkbox if a value must be selected for every cardholder entered. 4) Click [OK]. 3. The second step is to add a label for the drop-down list. From the Insert menu, select Label. a. Click and drag on the Force Protection Setting page to create the label. b. The corresponding Properties folder will be opened with the Label Settings form displayed. revision 2 25

26 4: FormsDesigner Configuration 1) In the Object name field type Force Protection Setting Label or any other name you wish to use. 2) In the Text field type Force protection setting: or any other name you wish to use. 3) In the Assigned field drop-down list, select Force Protection Setting. 4) Click [OK]. 4. Adjust the size and placement of the drop-down list and label to suit your needs. Your page should look something like this so far: Create a Recommendation Label The recommendation label is where the grant or deny recommendation is displayed to the user. There can only be one recommendation label. The recommendation label is associated with the cardholder Force protection setting field. The cardholder s force protection setting is compared to the current system force protection setting, and an access recommendation is displayed. The recommendation label can display one of two possible recommendations. The actual text displayed for each recommendation can be changed, but the defaults are Grant and Deny. A grant recommendation will be displayed if the system s force protection setting is alphabetically equal to or greater than the cardholder s force protection setting. A deny recommendation will be displayed if the system s force protection setting is greater than the cardholder s force protection setting. The background color of the recommendation can be changed depending on the recommendation. By default, the background is red for a deny recommendation and green for a grant recommendation. The font of the text that is displayed (i.e., Grant or Deny) can also be changed in the same manner as with any other FormsDesigner label. To create a recommendation label: 1. From the Insert menu, select MobileVerify > Recommendation Label. 26 revision 2

27 MobileVerify User Guide 2. Click and drag on the Force Protection Setting page to create the label. 3. The corresponding Properties folder will be opened with the MobileVerify Settings form displayed. a. In the Drop-down to use for recommendation drop-down list, select Force Protection Setting. Note: The current Force Protection Setting is set in the System wide [threat level setting] drop-down list on the System Settings form in the MobileVerify folder in System Administration or ID CredentialCenter. b. In the When drop-down is less than current Force Protection Setting section: 1) By default, the text that is displayed on the label when a cardholder s force protection setting is less than the system s current force protection setting is Deny. You may use the default or type your own value in the Display text field. 2) By default, the color of the button is red. You may use the default or click the [Color] button and select a new color. c. In the When drop-down is equal or greater than current Force Protection Setting section: 1) By default, the text that is displayed on the label when a cardholder s force protection setting is equal to or greater than the system s current force protection setting is Grant. You may use the default or type your own value in the Display text field. 2) By default, the color of the button is green. You may use the default or click the [Color] button and select a new color. d. Click the General Settings tab. In the Object name field type Force Protection Recommendation Label or any other name you wish to use. e. Click [OK]. revision 2 27

28 4: FormsDesigner Configuration 4. Adjust the size and placement of the recommendation label to suit your needs. Your page should look something like this so far: Create Recommendation Buttons Recommendation buttons allow a user to grant or deny access to an individual. Each recommendation button can be associated with a reader so that an open door operation can take place. When an individual is granted or denied access and the recommendation button has been associated with a reader, the location of the individual is updated. There are several settings in FormsDesigner that determine how a recommendation button behaves. If the Allow thisbutton to override recommendation checkbox on the MobileVerify Recommendation Button form in FormsDesigner is selected for a button, then the button cannot be used unless the action matches the recommendation (i.e., grant access using the Grant button). Instead, a message is displayed that indicates an invalid operation. If the Prompt user to confirm override checkbox on the MobileVerify Recommendation Button form in FormsDesigner is selected for a button, then a warning is displayed if the recommendation does not follow the button operation selected. This is to prevent mistakes from being made, as well as to confirm the user s request. The names and display text in the instructions that follow are recommendations; you can change them to suit your needs. Be sure to keep track of what names you change because they may be referenced in future procedures. Although this example uses two buttons, Grant Access and Deny Access, you are not limited to two buttons. To create a recommendation button: 1. First create a Grant Access button. From the Insert menu, select MobileVerify > Recommendation Button. a. Click and drag on the Force Protection Setting page to create the button. 28 revision 2

29 MobileVerify User Guide b. The corresponding Properties folder will be opened with the MobileVerify Recommendation Button form displayed. 1) In the Object Name field, type Grant Access or any other name you wish to use. 2) In the Recommendation associated with button drop-down list, select Equal or greater than system setting. 3) The Allow this button to override recommendation checkbox is selected by default. This means a user will be able to override the system and deny access to a cardholder who is granted access. If the checkbox is not selected this means, if a cardholder is granted access, a user cannot override the system and deny the cardholder access. The override will be indicated in the transaction log. 4) If you selected the Allow this button to override recommendation checkbox, select whether to prompt the user to confirm an override of an access grant recommendation. 5) In the Display text field, type Grant Access, or any other text that you would like on the button. 6) Select whether to notify the user when the Grant Access recommendation button is clicked. If the Notify user when button is clicked checkbox is selected, then the user will receive a confirmation message each time the Grant Access recommendation button is clicked. 7) Click [OK]. revision 2 29

30 4: FormsDesigner Configuration 2. Adjust the size and placement of the recommendation button to suit your needs. Your page should now look something like this: 3. Next create a Deny Access button. From the Insert menu, select MobileVerify > Recommendation Button. a. Click and drag on the Force Protection Setting page to create the label. b. The corresponding Properties folder will be opened with the MobileVerify Recommendation Button form displayed. 1) In the Object Name field, type Deny Access or any other name you wish to use. 2) In the Recommendation associated with button drop-down list, select Less than system setting. 3) The Allow this button to override recommendation checkbox is selected by default. This means a user will be able to override the system and deny access to a cardholder who is granted access. If the checkbox is not selected this means, if a cardholder is granted 30 revision 2

31 MobileVerify User Guide access, a user cannot override the system and deny the cardholder access. The override will be indicated in the transaction log. 4) If you selected the Allow this button to override recommendation checkbox, select whether to prompt the user to confirm an override of an access grant recommendation. 5) In the Display text field, type Deny Access, or any other text that you would like on the button. 6) Select whether to notify the user when the Deny Access recommendation button is clicked. If the Notify user when button is clicked checkbox is selected, then the user will receive a confirmation message each time the Deny Access recommendation button is clicked. 7) Click [OK]. 4. Adjust the size and placement of the recommendation button to suit your needs. Your page should now look something like this: Create a Current Gate Setting Label 1. From the Insert menu, select MobileVerify > Current Gate Label. 2. Click and drag on the Force Protection Setting page to create the label. revision 2 31

32 4: FormsDesigner Configuration 3. The corresponding Properties folder will be opened with the MobileVerify Settings form displayed. a. In the Object name field, type Current Gate Label or any other name you wish to use. b. In the Styles section, select how you want the gate information to display in the label. c. Click [OK]. 4. The second step is to add a label for the drop-down list. From the Insert menu, select Label. a. Click and drag on the Force Protection Setting page to create the label. b. The corresponding Properties folder will be opened with the Label Settings form displayed. 1) In the Object name field type Current Gate Setting Label or any other name you wish to use. 2) In the Text field type Current gate setting: or any other name you wish to use. 3) Click [OK]. 32 revision 2

33 MobileVerify User Guide 5. Adjust the size and placement of the drop-down list and label to suit your needs. Your page should look something like this so far: Create a Current Settings Label 1. From the Insert menu, select MobileVerify > Current Setting Label. 2. Click and drag on the Force Protection Setting page to create the label. 3. The corresponding Properties folder will be opened with the MobileVerify Settings form displayed. a. In the Object name field, type Current Setting Label or any other name you wish to use. b. In the Styles section, select how you want the gate information to display in the label. c. Click [OK]. 4. The second step is to add a label for the drop-down list. From the Insert menu, select Label. a. Click and drag on the Force Protection Setting page to create the label. revision 2 33

34 4: FormsDesigner Configuration b. The corresponding Properties folder will be opened with the Label Settings form displayed. 1) In the Object name field type Current Setting or any other name you wish to use. 2) In the Text field type Current system/gate/user setting(s): or any other name you wish to use. 3) Click [OK]. 5. Adjust the size and placement of the drop-down list and label to suit your needs. Your page should look something like this so far: Save the Page 1. From the Form menu, select Save. 34 revision 2

35 MobileVerify User Guide 2. The following message will be displayed. 3. Select one of the following options: Save and DESTROY any existing user-defined cardholder data. This choice saves the current layout definition but destroys all user-defined cardholder data. Selecting this choice displays the following message: If you then click [Yes], the following things will happen: You will be prompted to authorize the removal of each user-defined drop-down list field The forms in the folder, accessed by end-users, will use the new layout definition that you created on the editable forms The database tables, as defined by the layout, will be recreated As a result, the user defined fields of all records that existed prior to that moment will be DESTROYED. Save and PRESERVE any existing user-defined cardholder data. This choice saves both the current layout definition and the user-defined cardholder data. If you choose this option, a message will be displayed indicating the current number of cardholder records and the total length of time that may be required to save the layout and data. Click [Yes] to proceed. 4. The form is saved, and Form saved! is displayed in the status bar. 5. Now perform a full download to the Distributed ID/Mobile Station so that the Forms Designer changes take effect. revision 2 35

36 4: FormsDesigner Configuration 36 revision 2

37 MobileVerify Operator Procedures

38

39 MobileVerify User Guide Chapter 5: Access Control Configuration Configuration Sequence Populate the force protection setting list Configure the system s force protection setting Configure gates Configure workstations Before configuring the access control system for MobileVerify: Readers must be configured in System Administration. For more information please refer to the Readers Folder chapter in the System Administration User Guide. FormsDesigner must be configured. For more information, refer to Chapter 4: FormsDesigner Configuration on page 23. After FormsDesigner has been configured, use System Administration or ID CredentialCenter to: 1. Populate the Force Protection Setting list. For more information, refer to Populate the Force Protection Setting List on page Configure the system s current force protection setting. For more information, refer to Configure the System s Force Protection Setting on page Configure gates. For more information, refer to Configure Gates on page Configure workstations. For more information, refer to Configure Workstations on page Assign force protection settings to cardholders. For more information, refer to Assign Force Protection Settings to Cardholders on page 44. Assign force protection settings to cardholders Configuration Procedures Populate the Force Protection Setting List 1. In System Administration or ID CredentialCenter, select List Builder from the Administration menu. The List Builder folder is displayed. revision 2 39

40 5: Access Control Configuration 2. From the listing window on the left side of the Simple Lists form, select Force Protection Setting. 3. Click [Add]. 4. In the List Contents field, type 1) Normal or any name you would like this force protection setting to be called, and then click [OK]. Force protection setting lists are usually based on one of the following: The Force Protection Condition (FPCON) system. The FPCON levels are Normal, Alpha, Bravo, Charlie, and Delta. Delta is the highest force protection setting, and Normal is the lowest. The List Contents field is sorted in alphabetical order, so you should enter the FPCON levels as follows: 1) Normal 2) Alpha 3) Bravo 4) Charlie 5) Delta The Defense Readiness Condition (DEFCON) system. Defense Readiness Conditions are graduated to match situations of varying military severity (status of alert). DEFCON 1 is the highest readiness level and DEFCON 5 is the lowest. The List Contents field is sorted in alphabetical order, so you should enter the DEFCON levels as follows: 1) DEFCON 5 2) DEFCON 4 3) DEFCON 3 4) DEFCON 2 5) DEFCON 1 40 revision 2

41 MobileVerify User Guide 5. Repeat steps 3 and 4 to create additional force protection settings. When you have added all of your force protection settings, the Simple Lists form should look similar to the following: 6. Click [Close] to exit the List Builder folder. Configure the System s Force Protection Setting 1. In System Administration or ID CredentialCenter, select MobileVerify from the Administration menu. The MobileVerify folder opens. 2. Click [Modify]. 3. Select a force protection setting from the System wide [threat level] setting drop-down list. Notes: If your force protection settings are named 1) Normal, 2) Alpha, 3) Bravo, 4) Charlie, and 5) Delta, 5) Delta is the highest force protection setting, and 1) Normal is the lowest. If your force protection settings are named 1) DEFCON 5, 2) DEFCON 4, 3) DEFCON 3, 4) DEFCON 2 and 5) DEFCON 1, 1) DEFCON 5 is the lowest force protection setting and 5) DEFCON 1 is the highest. Force protection settings are defined in the List Builder folder. For more information, refer to Populate the Force Protection Setting List on page 39. By default, the name of this field is System wide [threat level] setting. However, the portion in italics may change depending on your configurations in FormsDesigner. For more information, refer to Chapter 4: FormsDesigner Configuration on page Click [OK]. revision 2 41

42 5: Access Control Configuration Configure Gates Note: For Enterprise systems, hardware cannot be added in the Master server database. Therefore, the gates must be configured in the MobileVerify station database. 1. In System Administration or ID CredentialCenter, select MobileVerify from the Administration menu. The MobileVerify folder opens. 2. Select the Gates tab. 3. Click [Add]. 4. In the Name field, type in the name of the gate. This name helps identify the gate, point, or area that is being protected. It is used in reports and the user transaction history as well as alarms in Alarm Monitoring. This is strictly a logical name and can be anything. For example: Parking lot A gate. 5. From the [threat level] setting drop-down list, select this gate s force protection setting. This setting will override the system setting level. This setting is needed so that a workstation can use a different system setting for other areas in the facility that may require a specific security level. Selecting this setting is optional; the default is to use the standard system setting. Notes: Force protection settings are configured in the List Builder folder. For more information, refer to Populate the Force Protection Setting List on page 39. When the <Use system setting> choice is selected, the system will use the setting selected in the System wide [threat level] field on the System Settings form in this folder. By default, the name of this field is [threat level] setting. However, the portion in italics may change depending on your configurations in FormsDesigner. For more information, refer to Chapter 4: FormsDesigner Configuration on page Select the Allow higher system setting to override checkbox if you want higher system wide force protection settings (configured on the System Settings form) to override the gate s force protection setting. 7. To configure the UI control for a grant (for example, when a guard receives a grant recommendation and selects the grant button, a specific door opens): a. Click [Add]. The Select UI Control/Reader window is displayed. 42 revision 2

43 MobileVerify User Guide b. From the UI control drop-down list, select Grant Access. Note: The drop-down list options depend on what you named your recommendation buttons in FormsDesigner. For more information, refer to Create Recommendation Buttons on page 28. c. From the Reader drop-down list, select the name of the reader that corresponds to this gate. This is optional - you do not have to associate a recommendation button with a reader. Doing so will cause an open door operation to occur on that reader when the button is depressed. If a reader has an area entering or area leaving associated with it, then the occupancy for each area will automatically be updated. d. Click [OK]. 8. To configure the UI control for a deny, repeat step 7. However, this time make sure to select Deny Access (or whatever your recommendation button is named), in the UI control drop-down list. 9. On the Gates form, click [OK]. Configure Workstations 1. In System Administration or ID CredentialCenter, select Workstations from the Administration menu. The Workstations folder opens. 2. Click [Add]. 3. In the Name field, do one of the following: Type the name of the existing or planned workstation that you wish to describe. Click [Browse] and select the name from the displayed list. Note: You are required to enter the workstation s NetBIOS name. (The NetBIOS name is specified when Windows networking is installed/configured.) 4. If you do not wish to configure an activity printer, skip this step. Otherwise, select the Activity Printer sub-tab. a. Select the Has device checkbox. b. Select the options that are appropriate for the device. 5. If you do not wish to configure a CCTV controller, skip this step. Otherwise, select the CCTV Controller sub-tab. a. Select the Has device checkbox. b. Select the options that are appropriate for the device. 6. If you do not wish to configure a video capture device, skip this step. Otherwise, select the Video Capture Device sub-tab. a. Select the Has device checkbox. b. Select the options that are appropriate for the device. 7. Configure gates: revision 2 43

44 5: Access Control Configuration a. Select the Gate Configuration sub-tab. b. From the Gate settings drop-down list, select the name of the gate that you want to be associated with this workstation. Note: Gates are configured on the Gates form in the MobileVerify folder. For more information, refer to Configure Gates on page Click [OK]. Assign Force Protection Settings to Cardholders Note: This procedure assumes that cardholder records have already been added to the database. For more information on adding cardholder records, please refer to the Cardholders Folder chapter in either the System Administration or ID CredentialCenter User Guide. 1. In System Administration or ID CredentialCenter, select Cardholders from the Administration menu. The Cardholders folder is displayed. 2. Select the Force Protection Setting tab. Notes: This step assumes that you created a Force Protection Setting page in FormsDesigner. For more information, refer to Add a Force Protection Setting Page (Optional) on page 24. If all the fields you set up in FormsDesigner are not visible on the Force Protection Setting page, verify that the permissions are set correctly. For more information, refer to Set Permissions to Use MobileVerify on page Locate the cardholder record that you want to assign a force protection setting to. To do this: a. Click [Search]. b. From the Person type drop-down list, select the type of record you want to search. Choices are: All - when selected, your search will locate both cardholder and visitor records. Cardholders - when selected, your search will only locate cardholder records. Visitors - when selected, your search will only locate visitor records. Note: The Person type drop-down list is subject to licensing restrictions. If this field is not displayed, move on to the next step. 44 revision 2

45 MobileVerify User Guide c. Specify your search criteria by typing full or partial entries in the enabled fields. d. Click [OK]. e. OnGuard retrieves and displays the first matching record. Use the,,,,, and buttons to navigate through the database. A dimmed button means that the associated operation is not possible (e.g., moving to the next record while the last record is being displayed). 4. Click [Modify]. 5. Select a force protection setting from the Force Protection Setting dropdown list. Notes: If your force protection settings are named 1) Normal, 2) Alpha, 3) Bravo, 4) Charlie, and 5) Delta, 5) Delta is the highest force protection setting, and 1) Normal is the lowest. If your force protection settings are named 1) DEFCON 5, 2) DEFCON 4, 3) DEFCON 3, 4) DEFCON 2, and 5) DEFCON 1, 1) DEFCON 5 is the lowest force protection setting and 5) DEFCON 1 is the highest. For more information, refer to Populate the Force Protection Setting List on page 39. The name of this field may be different depending on your configurations in FormsDesigner. For more information, refer to Chapter 4: FormsDesigner Configuration on page Click [OK]. 7. Repeat steps 3-5 for each cardholder that you want to assign a force protection setting to. revision 2 45

46 5: Access Control Configuration 46 revision 2

47 MobileVerify User Guide Chapter 6: Verification and User Procedures Verification Sequence Verification is the process of determining whether a person should be granted access. The cardholder presents their credential, and you search for the badge id. The cardholder s force protection setting is then compared to the current system force protection setting. If the cardholder s force protection setting is less than the current system force protection setting, then OnGuard returns an access grant recommendation. The guard can override that decision and decide to deny access if the Allow user to override Deny checkbox is selected. If the cardholder s force protection setting is higher than the current system force protection setting, then the person is not allowed access according to the OnGuard software. The guard can override that decision and grant the person access if the Allow user to override Grant checkbox is selected. However, it is logged and the person becomes the guard s responsibility. To determine whether a cardholder is allowed access: 1. Search for the cardholder s badge ID. For more information, refer to Search for a Badge ID on page The system will compare the cardholder s assigned force protection setting with the current system force protection setting to determine the access recommendation. 3. Deny or grant the cardholder access. If overriding an access recommendation, a confirmation may be needed depending on how the system is configured. 4. The transaction will then be logged to the database. The basic and advanced verification process diagrams that follow illustrate this process. revision 2 47

48 6: Verification and User Procedures Verification Process Without Override Permissions Diagram This diagram illustrates the verification process when the Allow user to override Deny and the Allow user to override Grant checkboxes on the Mobile Verify Settings form in FormsDesigner are NOT selected. Search for the badge ID Is the cardholder s force protection setting equal to or greater than the current system force protection setting? No Yes Access grant recommendation received Access deny recommendation received Cardholder granted access Cardholder denied access Door opens and area the cardholder is associated with is updated Transaction logged 48 revision 2

49 MobileVerify User Guide Verification Process With Override Permissions Diagram This diagram illustrates the verification process when the Allow user to override Deny checkbox and/or the Allow user to override Grant checkbox on the Mobile Verify Settings form in FormsDesigner are selected. Search for the badge ID Is the cardholder s force protection setting equal to or greater than the current system force protection setting? Yes Access grant recommendation received Access deny recommendation received If Access grant recommendation was received Does the guard have permission to override the access grant or deny recommendation? If Access deny recommendation was received Yes No No Does the guard grant access? No If overriding an access grant recommendation, a confirmation may be required Yes If overriding an access deny recommendation, a confirmation may be required Cardholder granted access Cardholder denied access Door opens and area the cardholder is associated with is updated Transaction(s) logged revision 2 49

50 6: Verification and User Procedures Search for a Badge ID You can search for a badge ID by either typing the badge number directly into the keyboard, by using a wedge reader, or by using a barcode scanner. Search Using a Keyboard OnGuard has the ability to search for a badge ID from the Cardholders folder by simply typing in the badge ID when in view mode. To do this: 1. If the Cardholders folder is not already open, open it by selecting Cardholders from the Administration menu. The Cardholders window must be the active window. 2. On either the main keyboard or on the numeric keypad, type the badge number you wish to search for. The following window will automatically open, and the number you type will appear in it: 3. Click [OK] or press <Enter>. a. If the badge ID exists in the system, the cardholder record associated with that badge number will automatically be opened. b. If the badge ID does not exist in the system, all fields in the Cardholders folder will be blank. Wedge Reader OnGuard also has the ability to search for a badge ID from the Cardholders folder by attaching a wedge reader to the keyboard, and then using the reader to scan badge IDs as direct keyboard input. Configure a Wedge Reader How the OnGuard system interprets the information it receives from a wedge reader can be configured by doing the following: 1. In System Administration, select Cardholders from the Administration menu. 2. Select Keyboard Wedge Settings from the Cardholder menu. 50 revision 2

51 MobileVerify User Guide 3. The Keyboard Wedge Settings window opens. a. Specify the Table and Field you wish to search on when keyboard input is detected. By default, the system searches on the ID field in the BADGE table. If for example you wanted to search based on social security number instead of badge ID, you would select the SSNO field in the EMP table. b. If CAC (Common Access Card) barcodes will be used, select the If length of input exceeds limit, assume CAC barcode checkbox and specify the limit. This allows military code 3of9 barcodes to be scanned and decoded into the cardholder s social security number. If you do not wish to use this feature, leave this checkbox deselected. c. Select whether to ignore non-numeric data. By default, the Ignore nonnumeric data checkbox is selected. This is important for scans that include dashes in the social security number. d. Specify the maximum length in the Max length field. A maximum length must be provided so that wedge scanners that do not automatically provide a line feed carriage return can be used as long as the length of the scan is always the same (i.e., social security number). e. Specify the start and end. In a string of numbers that contains a search criteria (typically social security number or badge ID), start and end are the first and last position, respectively, that contain the search criteria. f. Click [OK]. Search Using a Wedge Reader 1. Attach a wedge reader to the keyboard. 2. Use the wedge reader to scan the badge. revision 2 51

52 6: Verification and User Procedures 3. The following window will automatically open, and the number scanned will appear in the window: 4. Click [OK] or press <Enter>. a. If the badge ID exists in the system, the cardholder record associated with that badge number will automatically be opened. b. If the badge ID does not exist in the system, all fields in the Cardholders folder will be blank. Note: The system can be configured to search on any field, not just the Badge ID. For more information, refer to Configure a Wedge Reader on page 50. Change a Workstation s Gate Association Since MobileVerify is designed to work with mobile workstations, it is important to be able to easily change what gate a mobile workstation is associated with. For example, a mobile unit using MobileVerify to protect a car lane (lane A) may be asked to move to another lane (lane B), or may be asked to protect an entirely new area. 1. Select the Cardholder option from the Administration menu. 2. Select the MobileVerify option from the Cardholder menu. 3. In the Current gate drop-down listbox, select the gate that the workstation will be associated with. 4. Click [OK]. 52 revision 2

53 MobileVerify User Guide Chapter 7: Change System Settings Change the Gate a Cardholder is Associated With 1. In System Administration or ID CredentialCenter, display the Cardholders folder if it is not already. To do this, select Cardholders from the Administration menu. 2. Locate the cardholder whose gate association you wish to change. 3. From the Cardholder menu select MobileVerify. 4. The MobileVerify Options window opens. In the Current gate drop-down list, select the gate you wish to associate the cardholder with. 5. Click [OK]. revision 2 53

54 7: Change System Settings 54 revision 2

55 MobileVerify User Guide Chapter 8: MobileVerify Reports MobileVerify Reports OnGuard contains reporting functionality, which is available in the Reports folder in System Administration or ID CredentialCenter. The Reports folder is displayed by selecting Administration > Reports. For the types of MobileVerify reports that you can generate and a description of each, please refer to the following table. Report Name Description Report Type(s) MobileVerify User Transaction Log MobileVerify User Transaction Log, By Operation MobileVerify User Transaction Log, By User ID Global APB/Mobile Verify Occupancy, By Date Global APB/Mobile Verify Occupancy, By Name A chronological log of all transactions performed A chronological log of all transactions performed that is grouped by operation Chronological log of all transactions performed that is grouped by User ID Shows the last known area accessed by each cardholder, sorted by date and time Shows the last known area accessed by each cardholder, sorted by name User Transactions, Date/Time User Transactions, Date/Time User Transactions, Date/Time Anti-Passback, Cardholder, Date/ Time Anti-Passback, Cardholder, Date/ Time Note: For information on how to run a report, please refer to the Reports Folder chapter in the System Administration or ID CredentialCenter User Guide. Determine Occupancy for an Area A report can be generated that allows you to determine who is in an area (via MobileVerify). For example, if you are using MobileVerify at a gate to a weapons compound, the commanding officer of the base could immediately know who is currently in the weapons compound. revision 2 55

56 8: MobileVerify Reports 56 revision 2

57 MobileVerify User Guide Glossary Alarm Monitoring Barcode reader Defense Readiness Condition (DEFCON) Force Protection Condition (FPCON) FormsDesigner Hazardous location ID CredentialCenter License Administration Muster report An application that displays incoming alarms and events as they occur at the access control field hardware. An input device equipped with a stylus that scans a barcode. The device then converts the bar code into a number displayed on-screen. A uniform system of progressive alert postures. Defense Readiness Conditions are graduated to match situations of varying military severity (status of alert). DEFCON 1 is the highest readiness level and DEFCON 5 is the lowest. Security program designed to protect soldiers, civilian employees, family members, facilities, and equipment in all locations and situations, accomplished through planned and integrated application of combatting terrorism, physical security, operations security, personal protective services, and supported by intelligence, counterintelligence, and other security programs. The FPCON levels are Normal, Alpha, Bravo, Charlie, and Delta. Delta is the highest force protection setting, and Normal is the lowest. An application that enables you to customize the appearance and functionality of the forms in the Cardholders folder. A type of area configured in System Administration. An application that is used to add cardholder records to the database and manage cardholder information, including capturing photos/signatures, creating and printing ID badges, and defining access levels. A web application used to install new licenses, view installed licenses, and view the license server log. A report that lists all of the cardholders who are currently in a hazardous location. PC card A computer device packaged in a small card about the size of a credit card and conforming to the PCMCIA standard. PC card cover Port replicator Radio Frequency Identification (RFID) System Administration Wedge reader A cover that fits over the PC card slots on a mobile PC to keep dirt out. A device containing common PC ports, such as serial and parallel ports, that plugs into a notebook computer. The purpose of the device is to allow you to easily attach a portable computer to standard, non-portable devices such as a printer and monitor. For example, if you use a computer both at home and at work, you could set up both work areas with a port replicator. Then, you just plug in your notebook computer to the port replicator at either location and you're ready to work. A data collection technology similar to barcode identification that uses electronic tags to store identification data and a wireless transmitter gun to capture it. The tag, which is also known as an electronic label, transponder or code plate, gets its power from the gun. An application that is used to configure your access control and alarm monitoring environments, including all access control hardware devices, non-hardware system features, and user permissions. A barcode reader that connects to a PC. The wedge lets you scan a barcode and enters the data into the PC as if it were typed at the keyboard. revision 2 57

58 Glossary 58 revision 2

59 MobileVerify User Guide Index A Access control configuration Add cardholder Force Protection Setting field Force Protection Setting page Alarm Monitoring Assign force protection settings to cardholders.. 44 B Barcode reader Buttons Deny Access Grant Access C Change the gate a cardholder is associated with. 53 Configuration sequence access control FormsDesigner Configure gates Configure the system s force protection setting. 41 Conventions used in this documentation Create current gate setting label current settings label recommendation buttons recommendation label Current gate setting label Current settings label D Defense Readiness Condition (DEFCON) Deny Access button Determine occupancy for an area F Force Protection Condition (FPCON) Force Protection Setting add a cardholder Force Protection Setting field 24 add a Force Protection Setting page assign to cardholders configure the system s Force Protection Setting 41 populate the Force Protection Setting list FormsDesigner configuration definition G Gate configuration Gates change gate cardholder is associated with configure create a current gate setting label Grant Access button H Hazardous location I ID CredentialCenter K Keyboard using to locate a badge number L License Administration License for MobileVerify List Builder use to populate the force protection setting list 39 M MobileVerify configurations overview... 9 reports Muster report P PC card definition PC card cover Populate the Force Protection Setting list Port replicator Procedures add a cardholder Force Protection Setting field 24 add a Force Protection Setting page assign force protection settings to cardholders. 44 change the gate a cardholder is associated with 53 configure gates configure the system s force protection setting revision 2 59

60 Index 41 create a current gate setting label create a current settings label create a recommendation label create recommendation buttons determine occupancy for an area populate the Force Protection Setting list save the page search for a badge ID R Radio Frequency Identification (RFID) Replication MobileVerify systems scheduling S Save the page Search for a badge ID Set permissions to use MobileVerify Setting up the mobile PC System Administration V Verification sequence W Wedge reader... 50, revision 2

61 MobileVerify User Guide revision 2 61

62 Lenel Systems International, Inc Pittsford-Victor Road Pittsford, New York USA Tel Fax