XtraSec System Catalogue ELM
XtraSec Recommended full system architecture for high security applications XtraSec Command Centre Server Secure Dual Path Ethernet Switch Network with non-xtrasec workstations and devices Secure Dual Path Ethernet Switch Secure Dual Path Ethernet Switch XtraSec Controller 3000 ELM PIR Cabinet with XtraSec Controller 3000 and SLM XtraSec Remote Arming Terminal XtraSec Remote Arming Terminal Command Centre Workstation Command Centre Workstation Security PowerFence TM System ELM PIR ELM Reed Switch ELM I/O Expansion Controller 3000 Legend The maximum level of encryption used for each branch of the network is: System-wide Standard Configuration Cardax or Third Party Readers Up to 500 Controllers (Controller 3000 and 5000 combined) Up to 5000 Field Devices Up to 50 Operator Workstations Up to 4000 Cardax Readers Internet Protocol (168 Bit SSL Enhanced Encryption) Internet Protocol (168 Bit SSL Encryption) Internet Protocol Security (IPSec 128 Bit 3DES) Low Speed RS485 (128 Bit AES Encryption) Cardax Standard Wiring
Introducing XtraSec XtraSec is a high security electronic security system incorporating authentication and very high levels of data encryption to prevent an intruder attack on system communications. Key word explanations Authentication relates to the communications start-up procedure. At the beginning of each communications session, the authentication keys are exchanged between the communicating units to ensure the units are authorised to communicate to each other. Authentication also establishes the protocols for managing the security of ongoing communications between the units. Authentication is accomplished using specialised encryption techniques. Encryption relates to sending the data in a format that inhibits deciphering. The higher the encryption key value, the greater the level of protection provided. Water, power, fuel, telecommunications, finance and banking, airport, port, food supply, government, defence, police, health, dangerous goods, research If your organisation delivers critical infrastructure vital to national security, or participates in sensitive markets, or is in high security government sectors, you will appreciate the need for tight security. XtraSec provides the control system for high level electronic physical security. At its core it integrates access control and intruder alarms, and provides a platform for integrating with other security systems such as biometrics, DVR and intercom systems, to enable a system-wide security solution. Residing on the technology platform, XtraSec protects against a competent technical attack or compromise of system communications from internal or external would-be intruders. It achieves superior system security through very high levels of system data encryption and monitored communications, using a minimum encryption key level of 128 bits. This system catalogue aims to give you an overview of the XtraSec system, focusing on the added value delivered through the higher security implemented in the XtraSec system components. Further information about the functionality of system components is available in the product specific data sheets mentioned. The reader is also recommended to review a copy of the System Catalogue which provides an overview of the system. 1
Technology Platform XtraSec System Architecture is designed, developed and manufactured by Gallagher Security Management Systems, a division of New Zealand based Gallagher Group Ltd. A scalable system that can reside on an organisation s IT network, the product range extends from the Command Centre server and workstation management system, to intelligent field controllers, alarm keypad, a range of input and output devices, reader interfaces, readers and transponders. Key features of the technology platform include: Microsoft Windows Operating Systems Microsoft SQL Database options OPC enabled for sharing event information Support for XML data exchange with external applications Internet compatibility Upgradable and scalable solutions. Key components of the XtraSec system include: XtraSec Command Centre XtraSec Command Centre is the security management system. This variant of the server software has enhanced (1024 bit) authentication and 168 bit SSL encryption to communicate with XtraSec Controller 3000s. XtraSec Controller 3000s Intelligent field controllers, XtraSec Controllers are factory-programmed with authentication specific to the Cardax FT XtraSec range. XtraSec Controllers are intelligent units able to continue programmed operation should communications with other controllers or the main server be compromised. However, Gallagher Security Management Systems recommends that XtraSec systems are configured with a customised dual path Ethernet switch to provide redundant communications paths between any of the XtraSec components on the network for maximum integrity. Line Encryption Packs Incorporating encrypted communications (128 bit AES), Cardax FT Line Encryption Packs consist of Start of Line and End of Line Modules (SLM/ELM) designed to protect the communications between the inputs on input/output devices, and input detection devices such as PIRs. AES is an established encryption algorithm that is well suited for use in embedded applications. XtraSec Remote Arming Terminal The XtraSec Remote Arming Terminal is an alarm keypad that incorporates enhanced encryption at 128 bit AES. Full System Architecture The full system architecture is recommended for fully monitored manned sites. The XtraSec system architecture fully supports wide area networking. Where this is proposed, it should first be discussed with relevant internal/external parties to ensure the required level of security is in place on the WAN. 2
Integrating High Security, Access Control and more technology has been developed using industry standard software development tools to deliver the latest platform for integrated security. All software features and products developed on the technology platform, including comprehensive access control and alarm management, are available to XtraSec systems. This means high security areas with high levels of encryption can be configured alongside other areas secured with lower levels of encryption, all within the same XtraSec system. It is a single efficient solution making site security much easier to plan and manage. The system provides extensive integration opportunities. > Integration with Imaging Systems for viewing, triggering and storing image sequences associated with events > Integration with PowerFence Perimeter Security Systems, also from Gallagher Security Management Systems, for deterring and detecting would-be intruders > Integration with Digital Intercom Systems for live and stored audio communications associated with events > Integration with Biometric technologies for integrating the biometric technology of your choice > Integration with Cardholder Management Systems through the XML Interface to streamline cardholder data management and generate process efficiencies and controls as well as improve data quality > Integration with Building Management Systems through the OPC Interface to link events such as access control events, with air conditioning and lighting control systems. Organisation requirements often vary so please contact us to discuss your specific needs and preferences. 3
XtraSec Command Centre XtraSec Command Centre is the server and workstation software for the configuration, control and monitoring of high and medium security areas. XtraSec Command Centre supports the configuration and maintenance of system components and parameters to deliver: Comprehensive access control Alarms management including integrated intruder alarms Cardholder management including personal data and access privileges System integration through the XML and OPC Interfaces. Significant features include the audit trail, flexible Find function and reporting options. Communication between the XtraSec Command Centre communications server and XtraSec Controllers is protected by SSL (Secure Socket Layer) 168 bit encryption using the RC4 encryption algorithm with enhanced XtraSec authentication. The XtraSec Command Centre server will also communicate with standard Controllers (at the standard 40 bit encryption level). A completely scalable system, a range of features designed to enhance site security are available including: PhotoID and Card Encoding, to enable image capture, card design, and card printing and encoding Cardholder Challenge, providing the ability for operators to visually confirm the identify of a cardholder who has badged their card at a reader by comparing the cardholder image in the system against a live image from a third party system Anti-passback configuration to prevent a cardholder gaining access to a zone, then passing the card out to another person for entry Anti-tailgating configuration, to prevent people from following in other cardholders without presenting their own card on entry by generating an alarm when they exit Zone Counting to enable live counts of the number of cardholders present in specific Access Zones No Alone Zones configuration to ensure that whenever a high security area is occupied, there are at least two people recorded as being present. The significant advantage of the XtraSec system is that it provides a single platform for supporting both high security and regular security areas. The ability to partition the system using the System Division feature facilitates the management of different areas according to each area s security level. Combined with operator privileges, you can control who has access to information in the system within each division, and define the functions that each operator is authorised to perform. It also enables the installation of system components relevant to the area s security level. For more information about the functionality of the server software, please refer to the Command Centre data sheet or contact Gallagher Security Management Systems. 4
XtraSec Controller 3000 XtraSec Controller 3000s incorporate high level encryption and enhanced authentication of communications. They are intelligent field controllers managing the security and access control functions in the field. Managing the security and access control functions in the field, XtraSec Controller 3000s communicate with XtraSec Command Centre using on board TCP/IP over an Ethernet network. Communications are secured using 168 bit SSL encryption: Between the XtraSec Command Centre and XtraSec Controllers In the peer-to-peer communications between XtraSec Controllers In the peer-to-peer communications between XtraSec Controllers and standard Controllers There are no hard limits for the number of XtraSec Controllers supported in a system. Two variants of XtraSec Controllers are available: XtraSec Controller 3000-8R Provides on-board support for 8 Cardax readers (or 4 third party readers), 8 outputs and 16 inputs. XtraSec Controller 3000-4R Provides on-board support for 4 Cardax readers (or 2 third party readers), 4 outputs and 8 inputs. There are two I/O expansion options supported by the Controller 3000 architecture: I/O Expansion (8 inputs/4 outputs) 8-Input Expansion (8 inputs) Security of communications through the I/O expansion options can be enhanced through the use of Line Encryption Modules. For more information about the functionality of the XtraSec Controller 3000, please refer to the Controller 3000 and Devices data sheet. 5
XtraSec Remote Arming Terminal Supported by the XtraSec Controller 3000, the XtraSec Remote Arming Terminal is a user-friendly, menu-driven keypad interface for high security intruder alarms management. The XtraSec Remote Arming Terminal enables authorised users to monitor, arm (set) and disarm (unset) intruder alarm zones, in addition to viewing and acknowledging alarms in the field. The extent of the functionality available is determined by the user s assigned privileges and the privileges configured for that particular XtraSec Remote Arming Terminal. The communications between the XtraSec Controller 3000 and the XtraSec Remote Arming Terminal use 128 bit AES encryption. There are no hard limits on the number of XtraSec Remote Arming Terminals within the XtraSec system. Each XtraSec Controller can support up to four XtraSec Remote Arming Terminals. Each XtraSec Remote Arming Terminal can control up to 30 alarm zones and up to 100 inputs located on any XtraSec field controller residing on the same network. The XtraSec Remote Arming Terminal can also be configured with Cardax Prox readers for higher security access control. In this scenario, the cardholder presents their card to the reader while entering their Personal Identification Number through the keypad on Remote Arming Terminal. The advantage of this configuration is that the PIN is securely transmitted via the 128 bit AES encrypted communications supported by the XtraSec Remote Arming Terminal. For more information on the functionality of the XtraSec Remote Arming Terminal, please refer to the Remote Arming Terminal data sheet. 6
Line Encryption Pack Line Encryption Packs provide enhanced protection for communications to external devices such as PIRs that are connected to the input hardware. Line Encryption Packs consist of Start of Line and End of Line Modules (SLM/ELM) designed to protect the communications between the inputs on hardware and input detection devices (primarily PIRs). Communications between the SLM and ELM are protected by 128 bit AES encryption. They are supplied in matched pairs (one SLM to one ELM), so that only the correct pair will successfully communicate with each other. A distance of up to 2km is supported between a SLM and its corresponding ELM. The SLM is directly connected to the inputs on the hardware. Start-of Line Module The ELM is very small, designed to be installed and connected within the intruder detection device. These modules incorporate encrypted communications (128 bit AES) between the intruder detection device and the input hardware. For more information, please refer to the Line Encryption Pack data sheet. End-of Line Module (actual size) 7
Cardax Readers A range of attractive Cardax readers and transponders is available to complement the XtraSec system. In addition to access control, readers can also be used by authorised cardholders to arm and disarm alarm zones. Cardax Prox standard (125 or Mifare Series) Cardax Prox teardrop (Mifare Series) Cardax Prox Plus (125 or Mifare Series) Cardax Encoder Cardax Encoder (125 Series) (Mifare Series) A range of transponders for different reader technologies is available The range of Cardax readers for access control includes Cardax Prox readers for card only applications and Cardax Prox Plus readers for where card plus PIN is required. Supported by the Controller 5000, the Intelligent Door Terminal is a card plus PIN reader with a dot-matrix LCD and integrated intercom. In addition to access control, Cardax readers can also be used by authorised cardholders to arm and disarm alarms. Cardax readers are monitored through heartbeat communications which means should the Controller lose communication with a reader, an alarm will be raised at the Command Centre for follow up investigation. Readers and card options are available in two technologies: The popular 125kHz technology in systems, multiple card formats are supported concurrently Philips Semiconductors contactless Mifare Standard technology for a higher security, multi-function single-card solution. Cardax Encoders for both Mifare and 125 technologies are available for card encoding. Cardax readers, Encoders and encoded cards utilise the Cardax card data proprietary format. For more information, please refer to the data sheets for Cardax FT Intelligent Door Terminal, Cardax Prox (Mifare Series) and Cardax Prox (125 Series). 8
Redundant Ethernet Network Solution Software Maintenance Agreements A backup network communication path is a vitally important component of any high security system. Gallagher Security Management Systems recommends configuring XtraSec systems with selected Ethernet switches made by MOXA Technologies Inc to provide a solution for redundant Ethernet network communications: 8 10/100 BaseT(x) Ports to support 2 dual redundant network ports (RJ45) and 6 local ports (RJ45) for Ethernet communication circuits 6 10/100 BaseT(x) Ports, 2 multi mode 100 Base f(x) Ports to support 2 fibre optic ports for dual redundant fibre optic network connection and 6 local Ethernet ports (RJ45). As part of the Gallagher commitment to continuing research and development, new features and products are regularly released. Software Maintenance Agreements are available to ensure that your XtraSec system benefits from performance improvements and is maintained and supported on the latest Microsoft operating platforms. Software Maintenance Agreements also provide your organisation the opportunity to elect new features and hardware products which will enhance site security. The first year of a Software Maintenance Agreement is included with your investment in XtraSec Command Centre. Both models are available from Gallagher Security Management Systems. For more information, please refer to the MOXA Redundant Ethernet Switch data sheet. Further Information For configuration guidelines, further technical information and site references, please contact your Cardax Business Development Manager. 9
About Gallagher Security Management Systems Gallagher Security Management Systems (www.gallaghersms.com), a division of Gallagher Group Ltd, markets Cardax electronic access control systems and PowerFence perimeter security systems. Established in 1938, Gallagher Group Ltd is the operating company for an international organisation which encompasses research and development, manufacturing and marketing of its solutions animal management systems and security management systems. For more information about Gallagher Group, please visit our web site at www.gallaghergroup.co.nz For more information, please contact: www.cardax.com Disclaimer In accordance with the Gallagher Group policy of continuing development, design and specifications are subject to change without notice. Gallagher Security Management Systems is a division of Gallagher Group Limited, an ISO 9001:2000 Certified Supplier. Cardax is a registered trademark of Gallagher Group Limited. All other product, brand or trade names are property of their respective trade mark owners. Copyright Gallagher Group Limited 2005. All rights reserved. ISO 9001 Lic 14125 www.gallaghersms.com Gallagher Security Management Systems Gallagher Group Limited 181 Kahikatea Drive PO Box 3026 Hamilton New Zealand Phone +64-7-838 9851 Fax +64-7-838 9801 Email cdxsales@cardax.com Offices/Distributors are located in: Asia Australia Europe Middle East New Zealand Russia South Africa United Kingdom United States of America 6J0763 09/05