Architectural and Engineering Specification Brivo ACS 5000 Control Panels and ACS Service Document Number: MKT-DOC-006 November 22, 2005
Architectural and Engineering Specification Page 1 Table of Contents Table of Contents...1 1 INTRODUCTION...2 System Description...2 Related Documentation...3 2 SYSTEM ARCHITECTURE...4 Managed Service Provider...4 Web Hosted...4 Internet Browser Accessible...4 Encryption & Authentication...4 Wide Area Network...5 Central Data Storage...5 Redundancy...5 3 ACS APPLICATION...6 Maintain Custom Schedules...7 Manage Sites...7 Employ Tiered Administration...8 Track Administrator Actions...9 Maintain Credential Database...9 Manage Users and Groups...9 Maintain Activity Log...10 Generate E-mail Notifications and Daily Summaries...10 4 CONTROL PANELS...12 Supported Readers...12 Power Requirements...12 Control Boards...12 Access Control Functions...13 5 BRIVO ACS5000 PRODUCT SPECIFICATIONS...14 General Features...14 Hardware Components...14 Recommended Readers...14 Online Service for Account Administration...15 Service & Support...15 6 BRIVO ACS 5000 TECHNICAL SPECIFICATIONS...16
Architectural and Engineering Specification Page 2 1 Introduction The purpose of this document is to specify the Architectural/Engineering and Bid criteria for a Wide Area Network (WAN) based Access Control System (ACS) using such technologies as the Internet, private corporate networks, or wireless IP-based cellular networks. System Description The WAN-based ACS allows a company to network a single access control system for all its facilities, whether they are spread across town or across the world, and manage the entire system via a Webbased interface. In this architecture, the Managed Service Provider (MSP) is responsible for all required network connections. This eliminates the time, cost and complexity of custom cabling or internal IT setup as well as the provisioning of telecom networks to the remote facilities. It also removes the need to set up and maintain local networks and dedicated PCs or servers. The WAN-based ACS control panels installed at the customer s sites are networked with a secure central data facility, where the ACS application is hosted. The application is made available via the Web to the customer for administration and management of all aspects of facility access control. The core component of the ACS service platform is the Network Operations Center (NOC), a secure hosting facility where the application and database servers reside. These ACS applications integrate WAN technology such as the Internet with Web-based application services to provide specific products within vertical markets. A reference diagram for the system is provided below. Web-based User Interface User User User User Network Operations Center Internet Firewalls Web Servers ACS Application Servers Database Servers Network (e.g., Wireless, Internet) Remotely Managed Assets WAN-Based Access Control System
Architectural and Engineering Specification Page 3 Related Documentation Portions of the following documentation are incorporated into this specification and may be referred to for additional information: Brivo Administrator s Manual (#ENG-DOC-015) Administrator s Addendum ACS3000/4000 (#ENG-DOC-017) Brivo ACS3000 Installation Manual (#ENG-DOC-001) Brivo ACS4000 Installation Manual (#ENG-DOC-002) Brivo ACS5000 Installation Manual (#ENG-DOC-003) Tiered Administration Scenarios and Worksheet (#ENG-DOC-004). Brivo ACS Information Security (#MKT-DOC-010)
Architectural and Engineering Specification Page 4 2 System Architecture The following subsections provide an overview of the specifications for the ACS application system architecture, as well as its related services. Managed Service Provider Managed Service Providers (MSP) offer software and system functionality on a centralized, hosted basis, rather than as an installed application that resides at a customer site. The ACS service shall be provided under this MSP model and display all of the characteristics listed below. 1. The MSP shall host the ACS applications in a secure data facility. 2. The secure data facility shall have 24x7x365 staffing, including security and operational personnel. 3. The NOC shall have redundant main AC power supplies, including diesel generator backup. 4. The MSP shall perform all system and application maintenance on behalf of the customer. 5. The MSP facility shall provide secure archival data storage, including periodic offline tape backups. 6. The MSP shall provide automatic software upgrades. When changes are made to the central server software, those updates will be available to the customer upon the next login to the system. 7. The MSP shall provide on-call customer support services for the application and all associated control panels. Web Hosted 1. The ACS application shall be hosted on Web servers which are accessible via the Internet. 2. The ACS application shall be interoperable with common firewall and proxy server settings. Internet Browser Accessible 1. The ACS application shall be accessible via a standard Web browser over the Internet. 2. The ACS application shall not follow a client/server framework, and therefore shall not require any special client hardware or software other than a standard Web browser. 3. All customer control over the application shall be possible via a standard Web browser.. 4. The ACS application shall not require the customer to install any server software whatsoever. Encryption & Authentication 1. Sessions between the customer s browser and the Web-based ACS application shall be encrypted using 128-bit Secure Sockets Layer (SSL) encryption. 2. Communications between the control panel and the ACS application servers shall be encrypted using 128-bit Secure Sockets Layer (SSL) encryption. 3. The MSP servers shall validated the identity of any control panel attempting to communicate with the servers through the use of X509 digital certificates.
Architectural and Engineering Specification Page 5 4. When attempting to communicate with the MSP, the control panel shall validate the identity of the MSP servers via the use of X509 digital certificates. Wide Area Network 1. Control panels shall communicate with the central ACS application servers via either the Internet or a wide area wireless network, including wireless cellular systems. 2. The wide area network (WAN) connectivity shall be provided by the MSP as integral to the ACS service. 3. In the case of wide area wireless connectivity, the ACS system shall not require the customer to install any serial communications or network wiring to connect to the customer s LAN/WAN infrastructure. 4. In the case of Internet connectivity, the ACS system shall provide an integral RJ45 connector for Category 5 Ethernet cabling to connect to the customer s LAN/WAN infrastructure. Central Data Storage 1. All customer and system data shall be centrally stored at the MSP s hosting facility. 2. All data stored at the MSP facility shall be backed up to a secondary site or to off-site storage. Redundancy 1. All servers that are essential to providing the ACS service shall be redundant. 2. All communications channels between the MSP and the WAN shall be redundant. 3. The MSP shall have a secondary set of servers that can provide the ACS service in the event of a catastrophic disruption at the primary facility.
Architectural and Engineering Specification Page 6 3 ACS Application The Web-based ACS application resides at a centrally hosted facility and is accessed via any standard Internet browser. A list of system functionality is presented below, followed by more detailed descriptions of key operations. 1. Provide storage of all data in a centrally hosted database, maintained by the Managed Service Provider (MSP). 2. Provide a means for the MSP to backup and restore archival data. 3. Time stamp all access and system events. 4. Allow individual account administrators to set personal time zone preferences. 5. Provide the ability for the customer to make ACS configuration changes necessary for ensuring data integrity and facility security. 6. Provide the ability for the customer to define custom schedules for the purpose of managing facility access and operating auxiliary devices. (See details in the Maintain Custom Schedules section below.) 7. Provide a robust communications protocol to the control panels so that all commands and updates to the panels are verified and will be retried if communications fail. 8. Enable account administrators to define and manage sites as well as all their access points. (See details in the Manage Sites section below.) 9. Support Tiered Administration, enabling an account to have one Master Administrator and multiple senior and/or assistant administrators. (See details in the Employ Tiered Administration section below. 10. Validate administrators access to the application and track all actions. (See details in the Track Administrator Actions section below.) 11. Maintain a database of all credentials associated with the account and the user to whom each is assigned. (See details in the Maintain Credential Database section below.) 12. Manage users who have access to the sites associated with an account, and assign those users to groups that define their access privileges. (See details in the Manage Users and Groups section below.) 13. Provide integrated, Web-based biometric support such that users can be registered to the system at the same time their biometric data is captured. 14. Maintain an Activity Log that tracks all attempts to access the sites associated with an account, including both successful and failed attempts. (See details in the Maintain Activity Log section below.) 15. Provide a Lockdown functionality that enables administrators to temporarily but instantly revoke access privileges for one or more user groups in an emergency situation. 16. Dispatch e-mail notifications to select administrators when predetermined events occur, and send daily summary reports of events to select recipients. (See details in the Generate E-Mail Notifications and Daily Summaries below.) 17. Provide detailed activity reports of failed access events.
Architectural and Engineering Specification Page 7 Maintain Custom Schedules The ACS application shall provide the ability to define specific schedules that are editable, reusable time templates that can be used to control such things as when a door is accessible or when a device is activated. The application shall also enable the creation of holidays, periods of time during which the regular schedule is overridden. The operations associated with schedules and holidays include: Create and edit a schedule Associate a schedule with groups, floors, doors, and/or devices View a list of all groups, floors, doors and devices associated with a schedule Terminate a schedule s associations with one or more groups, floors, doors or devices Delete a schedule Create and edit a Holiday Associate a holiday with one or more schedules Associate a holiday with one or more doors Edit a Holiday s start and end date and time Delete a Holiday Manage Sites The ACS application shall enable account administrators to define and manage sites, as well as their associated control panels, doors, devices, elevators and floors. The operations associated with managing sites include: Define and manage control panels for the account Define and manage control boards Create and manage sites Add doors to a site and associate them with control panels Enable/disable the Door Ajar feature, and control the Door Ajar Threshold Define and edit an Invalid PINs Threshold and define an associated Shutdown period Define and edit a Pass-through Period Manage Request-to-Exit motion sensors Enable and disable In/Out tracking, which logs when individual users enter and/or exit specific doors Enable and disable Alarm Shunts and define Alarm Shunt Delay time Delete doors from a site Add devices to a site and associate them with control panels Define each device as a Switch, Timer, Valid Credential, or Event Track. Manage a device s output behavior Determine if and how a device should be tracked in the Activity Log Delete devices from a site
Architectural and Engineering Specification Page 8 Add elevators and associate them with control panels Associate each elevator with one or more sites Associate each elevator with a card reader Delete elevators Add floors to a site Define and edit an Unlock Schedule for each floor Delete floors Employ Tiered Administration The ACS application shall support Tiered Administration to enable the Master Administrator for the account to create subordinate administrators. Each administrator will have a unique logon ID that identifies that individual s permissions for viewing and editing account data. With Tiered Administration: 1. Each account shall have one and only one Master Administrator. The Master Administrator can operate on all account data, as well as view, create, edit and delete Senior and Assistant Administrators. The Master Administrator may perform all actions performed by Super, Senior and Assistant Administrators, as described below. 2. An account may have multiple Senior Administrators. Senior Administrator permissions are granted by the Master Administrator or a Super Administrator. (See definition of Super Administrator below.) Senior Administrators can operate on all account data, but cannot manage other Administrators. 3. An account may have multiple Super Administrators. Super Administrator permissions are granted by the Master Administrator or another Super Administrator. A Super Administrator is actually a Senior Administrator with super permissions. Super Administrators are Senior Administrators who can view, create, edit and delete all Administrators except the Master Administrator. 4. An account may have multiple Assistant Administrators. Assistant Administrator permissions are granted by the Master Administrator or a Super Administrator. Assistant Administrators have access to only a subset of the account data. Depending on their permissions, they may be able to view and/or manage some site and group data, but they cannot view or manage other Administrators. 5. For all Administrators, the following data shall be maintained: First Name Last Name E-mail Address Phone Time Zone Status Administrator ID Password Secret Question Secret Answer
Architectural and Engineering Specification Page 9 Track Administrator Actions For security reasons, the ACS application shall validate access to the application by account administrators and shall track their actions. To this extent, the application shall: Require users to supply a logon ID and a password in order to gain access to an account and its associated control panels and databases Support multiple administrators per account, each with a unique logon ID and password. Generate and display a non-editable, printable journal of all administrative actions performed on the account for the purpose of maintaining an unalterable audit trail. Maintain Credential Database The ACS application shall support the maintenance of a credential database to track all cards, PINs and fingerprint credentials associated with the account, including the user to whom each is assigned. Operations to be performed by the ACS application include: Validate that card numbers are unique, alpha-numeric, and no greater then 16 characters long. Allow multiple credentials per user. Support the creation of PIN credentials that are unique, 4 to 8 digits long, and either randomly generated by the system or selected by the user. Provide 10 user definable fields associated with user in the user database. Automatically send updated credential information to the appropriate access control panels with no other user intervention Operations performed by account administrators include: Add cards of various Bit lengths to a Card Bank (26, 34, 35, 37 with FC, 37 without FC, 40) Make and revoke card assignments Remove cards from the Card Bank Manage Users and Groups The ACS application shall provide the ability to define individual users who have access to one or more sites associated with an account, and to assign each user to a group that defines his or her access privileges. Operations that support this function include: Define a user group Edit access privileges for a group of users Grant and revoke Keypad Unlock-Hold Privileges Delete a user group Create a new user Assign a unique 4- to 8-digit PIN to a user Change a user s PIN Delete a user s PIN
Architectural and Engineering Specification Page 10 Assign a unique card number to a user Change user s card number Revoke a user s card number Define a user s Start Date Define a user s Termination Date Change a user s Termination Date Delete a user s Termination Date Associate and disassociate a set of fingerprints with a user s credentials using Bioscrypt Biometrics Assign a user to one or more groups Remove a user from one or more groups Delete a user Maintain Activity Log The ACS application shall track all attempts to access the sites associated with an account and maintain this information in an Activity Log that can be accessed by administrators of the account. Activity Log functionality includes: Display the Activity Log unfiltered, so that all activities are listed Display the Activity Log filtered by user, so that only those actions performed by a specific user are displayed Display the Activity Log filtered by site, so that only those actions performed at a specific site are listed Display the Activity Log filtered by door or device, so that only those actions performed on a specific door or device are listed Allow administrators to view the Activity Log by 20, 30 or 40 events per page Allow administrators to search the Activity Log Report for exception events, user events, control panel events and device events, searching by absolute date or relative days Allow administrators to search the Activity Log Report for events related to a specific door or device at a specific site Allow administrators to search the Activity Log Report for actions performed by a specific user on a specific door at a specific site. Generate E-mail Notifications and Daily Summaries The ACS application shall provide the ability to send email notifications to standard email accounts, pagers, and cell phones in response to various system events as described below. In addition, the application shall provide for a daily summary of the same events to be sent to select recipients. Door Ajar/Door Ajar Cleared Door Forced Open Too Many Invalid PINs Unlock Schedule Restored/Door Locked by keypad
Architectural and Engineering Specification Page 11 Unlock Schedule Overridden by Keypad/Door Unlocked by Keypad Door Locked by Timer Door Unlocked by Timer Failed Access by Unknown Person Failed Access by Known Person Failed access by a user within a group Successful access by a user within a group Successful access by a specific user Device Engaged/Disengaged Control Panel/Control Board Unit Opened/Closed AC Power Loss/Restoral and Battery Status Control Panel Communication Failure Account administrators shall have the ability to manage e-mail notifications and daily summaries according to functionality listed below. Create and edit notification rules specifying which administrators should receive e-mail notification of which system events Associate a schedule with each notification rule Specify the language to be used in notification e-mails Delete notification rules Create and edit a list of administrators to receive daily e-mail summaries of system events, sorted by site, user and time of occurrence
Architectural and Engineering Specification Page 12 4 Control Panels The following subsections specify required control panel characteristics. Supported Readers Control panels shall support multiple card reader technologies via standard Weigand interfaces, including: Weigand effect readers Proximity readers Biometric readers Keypads (PIN) Power Requirements 1. The control panel shall be powered from a standard 120VAC, 60Hz. Outlet. 2. The control panel shall be supplied with internal battery backup, and include the following functionality related to power source. The control panel shall indicate whether it is on main or battery backup power; The control panel shall send an alarm to the central ACS application when it switches between main and battery power; 3. The control panel shall provide a notification to the central ACS application upon Power Up / Start-up / Reboot. Control Boards 1. The control panel shall support up to 14 expansion control boards, including any combination of Door Boards and Input/Output (I/O) Boards. 2. Each Door Board shall support the following inputs: Reader Interface (2) Door Closure Sensor Input (2) Request to Exit (2) Door Switch (2) Auxiliary Switch Input (2) 3. Each Door Board shall support the following output relays: Door Lock (2) Alarm Shunt relay (2) Auxiliary Relay (2) 4. Door Boards may be used to control or single door or multiple I/O devices. 5. Each I/O Board shall support up to eight input devices and eight output devices.
Architectural and Engineering Specification Page 13 6. The Reader interface shall support the following (Weigand) lines: Circuit Wiegand DATA 0 Wiegand DATA1 RED Led Control Output 12VDC Ground Shield GREEN Led Control Output BEEPER Output Control Access Control Functions Each control panel shall: Support a Request to Exit input which energizes an associated relay in order to open a door Support an Auxiliary input which energizes an associated relay Perform local credential-based user authentication against a local database stored in FLASH memory Provide for door latch activation / deactivation via a relay output Provide Door Ajar notification with a configurable timer to define the length of time before a door is considered to be ajar Provide Door Open notification to the central ACS application via a contact closure input Provide Door Close notification to the central ACS application via a contact closure input Provide Auto Unlock notification to the central ACS application Provide for local buffering and replay of events in case of a communications failure between the control panel and the central ACS application Provide a centrally configurable Door Unlock by Schedule feature Provide a centrally configurable Holiday override feature Provide centrally configurable Door Unlock by Keypad feature Send device status to the central ACS application at least once per hour Send a notification to the ACS of unauthorized door opening
Architectural and Engineering Specification Page 14 5 Brivo ACS5000 Product Specifications General Features The ACS5000 is designed for multi-door installations. It supports up to 15 control boards per control panel, and an account may have multiple control panels. Other general characteristics of the ACS5000 include: Centralized control and management of all access privileges via any PC, Mac or Webenabled device Wiegand reader compatible Automatic event buffer Up-to-the-minute online updates of event transactions User-specified event notifications to e-mail, pager and cell phone contacts Up to 1,000 users/credentials per control panel Hardware Components The following hardware components are shipped with the ACS5000: Brivo ACS Control and Communications Panel, containing one Master Control Board and up to fourteen additional Door and/or I/O Boards Power supply AC Transformer 7 Ah Battery Antenna kit (wireless version only). Recommended Readers The following readers and keypads are supported for use with the ACS5000: Essex ThinLine 2x6 Stainless Steel Keypad Essex 12 Pad 3x4 Stainless Steel HID ThinLine II Switch Plate Proximity Reader. HID Prox-Point Plus Proximity Reader HID Mini-Prox Proximity Reader HID Prox-Pro Proximity Reader with Integrated Keypad HID Prox-Pro Proximity Reader BioScrypt V-Smart Biometric Reader Additional Readers Supported on Custom Basis
Architectural and Engineering Specification Page 15 Online Service for Account Administration There are numerous features to assist account administrators in managing access to their facilities, including: Web-based user interface, including an online Activity Log that tracks all access events Multiple administrative account passwords, and a Journal of all administrators actions on the system Immediate notification of events to specified e-mail, pager, or cell phone contacts Templates and customized time schedules, time zones and group management. Cards and PINs supported, including card bank management features. Archive history online. Service & Support To enable customers to take full advantage of the ACS5000, Brivo offers support in a variety of formats: User documentation, including a Quick Start Guide, an Administrators Manual, an Installation Manual, and a Networking Guide, all available online. Online help 24/7 unlimited use of Brivo s ACS service Toll-free telephone and e-mail customer support. One Year Warranty
Architectural and Engineering Specification Page 16 6 Brivo ACS 5000 Technical Specifications Control panel limit per account: Control board limit per control panel: Number of readers: Secure wireless network connection: Wiegand Reader compatibility: Wiegand Keypad compatibility: Bioscrypt Biometrics capability: Real-time reporting at www.brivo.com: Archived data: E-mail notifications & activity reports: Inputs: Relay outputs: Alarm shunting: Control panel power requirements: Battery backup: Enclosure: Dimensions: Panel to-panel wiring distance: Unlimited 14 in addition to Master Board Up to 30 per control panel, with multiple control panels per account Yes 64-bit, 37-bit, HID Corporate 1000, 26-bit, 33-bit 8-bit (Word), 4-bit (Nibble) 26-bit Yes Yes Yes Open/Closed Common, NO, NC Yes 16.5 Volt, 40 VA 12 Volt DC 7 Ah NEMA Type 1, tamper switch, key locks 6.25 (d) x 14.25 (h) x 16.25 (w) Unlimited due to long-range wireless networking. Not applicable for Ethernet version of panel Temperature & humidity range: Operating temperature: 35-110 F (2-43 C) Humidity: Maximum 85% non-condensing Reader limit per account: Unlimited Card memory: 8,000 users/credentials per panel Antenna included (wireless only): Yes, with 16 ft. of coaxial cable & mounting bracket Warranty: One year, parts Smart cards supported: Yes, HID 1430 & 1431 contactless Smart Cards