Access control

src: www.axis.com

In the field of physical security and information security, access control ( AC ) is a selective restriction of access to a place or other resource. Action access can mean eating, entering, or using. Permission to access resources is called authorization .

Keys and incoming credentials are two analog access control mechanisms.

Video Access control

Physical security

Geographical access control may be enforced by personnel (e.g., Border guard, bouncer, ticket checker), or with a device such as a revolving door. There may be a fence to avoid outsmarting this access control. The access control alternative in the narrow sense (physically controlling access itself) is an authorized attendance checking system, see for example Ticket controller (transport). Variant is outgoing control, e.g. from a store (cashier) or country.

The term of access control refers to the practice of restricting entry to property, buildings, or spaces for authorized persons. Physical access control can be achieved by humans (guards, guards, or receptionists), through mechanical means such as keys and keys, or through technological means such as access control systems such as mantrap. Within this environment, physical key management can also be used as a means to further manage and monitor access to areas that are mechanically locked or access to certain small assets.

Physical access control is a matter of who, where, and when. The access control system determines who is allowed in or out, where they are allowed to log in or out, and when they are allowed in or out. Historically, this was done in part through locks and keys. When a door is locked, only someone with a key can enter through the door, depending on how the key is configured. Mechanical and key locks do not allow keyholder restrictions at certain times or dates. Mechanical and key locks do not provide key records used on any particular door, and keys can be easily copied or transferred to unauthorized persons. When a mechanical key is lost or the keyholder is no longer authorized to use a protected area, the key must be re-locked.

Electronic access controls use computers to overcome key limitations and mechanical locks. Various credentials can be used to replace a mechanical key. The electronic access control system provides access based on the credentials presented. When access is granted, the door is unlocked for a predetermined time and transactions are recorded. When access is denied, the door remains locked and access is recorded. The system will also monitor the door and alarm if the door is forced open or opened too long after it has been unlocked.

Access control system operation

When credentials are presented to the reader, the reader sends credential information, usually a number, to the control panel, a very reliable processor. The control panel compares the credential number to the access control list, grants or rejects the requested request, and sends the transaction log to the database. When access is denied based on the access control list, the door remains locked. If there is a match between credentials and access control lists, the control panel operates a relay which in turn unlocks the door. The control panel also ignores the door signals open to prevent alarms. Often readers provide feedback, such as blinking red LEDs for access denied and blinking green LEDs for given access.

The description above illustrates a single factor transaction. Credentials can be circulated, thus changing access control lists. For example, Alice has access to server space, but Bob does not. Alice gives Bob a credential, or Bob picks it up; he now has access to server space. To prevent this, two-factor authentication can be used. In a two-factor transaction, credentials are presented and a second factor is required for access to be provided; Other factors may be PIN, second credential, operator intervention, or biometric input.

There are three types (factors) of authentication information:

• something that the user knows, e.g. password, pass-phrase or PIN
• something the user has, like a smart card or fob key
• something that users use, such as fingerprints, are verified by biometric measurements

Passwords are a common way to verify the identity of a user before access is granted to an information system. Additionally, the fourth factor of authentication is now recognized: someone you know, where someone else knows you can provide human authentication elements in situations where the system has been set up to allow that scenario. For example, a user might have their password, but forget their smart card. In such a scenario, if the user is known by a designated cohort, the group can provide their smart card and password, in combination with the remaining factors of the users concerned, and thus provide two factors for users with lost credentials, provide three factors overall to allow access.

Credentials

Credentials are physical objects/pieces, pieces of knowledge, or the physical aspect of a person that allows individual access to certain physical facilities or computer-based information systems. Typically, credentials can be something someone knows (like a number or PIN), something they have (such as an access badge), something they (like a biometric feature), or some combination of these items. This is known as multi-factor authentication. The typical credentials are the access card or key-fob, and newer software can also turn the user's smartphone into an access device.

There are many card technologies including magnetic stripe, bar code, Wiegand, 125 kHz, 26-bit card, contact smart card, and contactless smart card. Also available are key phobs, which are more concise than ID cards, and attached to keychains. Biometric technologies include fingerprint, face recognition, iris recognition, retinal scanning, sound, and hand geometry. The built-in biometric technology found on newer smartphones can also be used as credentials along with access software running on mobile devices. In addition to the more traditional card-based access technologies, newer technologies such as Near Field Communication (NFC) and low-energy Bluetooth also have the potential to communicate user credentials to readers for system or building access.

Access control system components

Access control points can be doors, turnstiles, parking gates, elevators, or other physical barriers, where access grants can be electronically controlled. Usually, the access point is the door. Electronic access control door can contain several elements. Basically, there is a stand-alone electric lock. The lock is not locked by the operator with the switch. To automate this, operator intervention is replaced by the reader. The reader can be a keyboard where the code is inserted, either a card reader, or a biometric reader. The reader usually does not make access decisions, but sends the card number to the access control panel that verifies the number with the access list. To monitor the position of the door, the magnetic door switch can be used. Conceptually, the door switch is no different from the one in the refrigerator or car door. Generally only entries are controlled, and out of control. In cases where the exit is also controlled, a second reader is used on the opposite side of the door. In cases where out is uncontrolled, out is free, a device called request-to-exit (REX) is used. The requested device to exit can be a push button or motion detector. When the button is pressed, or the motion detector detects movement on the door, the door temporary alarm is ignored when the door is opened. Exiting the door without having to unlock the electric door is called a mechanical free exit. This is an important security feature. In cases where the key must be electrically opened upon exit, the device request to exit also unlocks the door.

Access control topology

The access control decision is made by comparing the credentials to the access control list. This search can be performed by a host or server, by the access control panel, or by the reader. The development of an access control system has seen a steady push to search out from the central host to the edge of the system, or the reader. The dominant topology around 2009 is the hub and talks to the control panel as a hub, and the reader as a spokesperson. Search and control functions are performed by the control panel. The radius communicates through a serial connection; usually RS-485. Some manufacturers push decision-making to the edge by placing controllers at the door. IP controllers are enabled, and connect to hosts and databases using standard networks.

Type of reader

Access control readers can be classified based on the functions they can perform:

• Basic reader (not smart): just read the card or PIN number, and forward it to the control panel. In the case of biometric identification, such readers issue a user ID number. Typically, the Wiegand protocol is used to transmit data to the control panel, but other options such as RS-232, RS-485 and Jam/Data are unusual. This is the most popular type of access control reader. Examples of such readers are RF Tiny by RFLOGICS, ProxPoint by HID, and P300 by Farpointe Data.
• The semi-intelligent reader: has all the inputs and outputs needed to control the door hardware (lock, door contact, exit button), but makes no access decision whatsoever. When a user presents a card or inserts a PIN, the reader sends the information to the main controller, and awaits his response. If the connection to the main controller is interrupted, the reader stops working, or works in degraded mode. Usually semi-intelligent readers connect to the control panel via RS-485 bus. Examples of such readers are InfoProx Lite IPL200 by CEM Systems, and AP-510 by Apollo.
• Smart reader: has all the inputs and outputs needed to control the hardware of the door; they also have the memory and processing power necessary to make access decisions independently. Like semi-intelligent readers, they are connected to the control panel via RS-485 bus. The control panel sends configuration updates, and retrieves events from readers. Examples of such readers could be InfoProx IPO200 by CEM Systems, and AP-500 by Apollo. There is also a new generation of intelligent readers who are referred to as "IP readers". Systems with IP readers usually do not have traditional control panels, and readers communicate directly to PCs that act as hosts.

Some readers may have additional features such as LCD buttons and functions for data collection purposes (ie hour-in/hour-out events for attendance reports), camera/speakers/microphone for intercoms, and smart card read/write support.

Access control readers can also be classified by their type of identification technology.

Access control system topology

1. Serial controller. The controls are connected to the host PC via the RS-485 serial communications channel (or via a 20mA current loop in some older systems). An RS-232/485 external converter or RS-485 internal card must be installed, as the standard PC does not have an RS-485 communications port.

Advantages:

• The RS-485 standard allows long cable runs, up to 4000 feet (1200 m)
• The response time is relatively short. The maximum number of devices on a RS-485 line is limited to 32, which means that hosts can often request status updates from each device, and show the event almost in real time.
• High reliability and security because the communication channel is not shared with other systems.

Deficiency:

• RS-485 does not allow a Star-type cable unless the splitter is used
• RS-485 is not suitable for transferring large amounts of data (i.e. configuration and users). The highest possible throughput is 115.2 kbit/sec, but in most systems it is down to 56.2 kbit/second, or less, to increase reliability.
• RS-485 does not allow the host PC to communicate with multiple controllers connected to the same port simultaneously. Therefore, in large systems, configuration transfers, and users to the controller may take a very long time, interfere with normal operation.
• The controller can not start communication if there is an alarm. The host PC acts as master on the RS-485 communication line, and the controller must wait until they are surveyed.
• A special serial switch is required, to make the host PC settings redundant.
• Separate RS-485 path must be installed, rather than using existing network infrastructure.
• Cables that meet RS-485 standards are much more expensive than regular Category 5 UTP network cables.
• The operation of the system is highly dependent on the host PC. If the host PC fails, events from the controller can not be retrieved, and functions requiring interaction between the controller (ie anti-passback) cease to function.

2. Main series and sub-controllers. All door hardware is connected to sub-controller (door controller or door interface a.k.a). Sub-controllers usually do not make access decisions, rather than forward all requests to the main controller. Primary controllers typically support 16 to 32 sub-controllers.

Advantages:

• The workload on the host PC is significantly reduced, as it only needs to communicate with some of the main controllers.
• The overall cost of the system is lower, because the sub-controller is usually a simple and inexpensive device.
• All other benefits listed in the first paragraph apply.

Deficiency:

• The operation of the system depends heavily on the main controller. If one of the main controllers fails, the event of the sub-controller is not taken, and functions requiring interaction between sub-controllers (ie anti-passback) cease to function.
• Some sub-controller models (usually lower cost) do not have the memory or processing power to make access decisions independently. If the main controller fails, the sub-controller turns into a degraded mode where the door is locked or fully opened, and no event is recorded. Such sub-controllers should be avoided, or used only in areas that do not require high security.
• Major controllers tend to be expensive, therefore such topologies are not particularly suitable for systems with multiple remote locations with only a few doors.
• All other RS-485 related losses listed in the first paragraph apply.

3. Main controller & amp; smart reader. All door hardware is directly connected to a smart or semi-intelligent reader. The reader usually does not make access decisions, and passes all requests to the main controller. Only if the connection to the main controller is not available, will the reader use their internal database to make access decisions and record events. Semi-intelligent readers who do not have a database and can not function without the main controller should only be used in areas that do not require high security. Primary controllers typically support 16 to 64 readers. All the advantages and disadvantages are the same as those listed in the second paragraph.

4. Serial controller with terminal server. Despite the rapid development and increasing use of computer networks, access control manufacturers remain conservative, and are in no hurry to introduce network-supported products. When pressed for solutions with network connectivity, many choose options that require less effort: the addition of terminal servers, devices that convert serial data for transmission over LAN or WAN.

Advantages:

• Allows using existing network infrastructure to connect segments separate from the system.
• Provides a convenient solution if RS-485 line installation will be difficult or impossible.

Deficiency:

• Increase system complexity.
• Create additional jobs for the installer: usually the terminal server must be independently configured, and not through the access control software interface.
• The serial communication relationship between the controller and the terminal server acts as an obstacle: although data between host PC and terminal server runs at 10/100/1000Mbit/s network speed, it should slow down to serial speed of 112.5 kbit/second or less. There are also additional delays introduced in the conversion process between serial and network data.

All RS-485 related benefits and losses also apply.

5. Primary network supported controllers. Topology is almost the same as described in the second and third paragraphs. The same advantages and disadvantages apply, but the on-board network interface offers some valuable improvements. Transmission configuration and user data to the main controller faster, and can be done in parallel. This makes the system more responsive, and does not interfere with normal operation. No special hardware is needed to achieve excess host PC settings: in case the main host PC fails, the secondary host PC may start polling the network controller. The disadvantages introduced by terminal servers (listed in the fourth paragraph) are also omitted.

6. IP Controller. The controls are connected to the host PC via an Ethernet LAN or WAN.

Advantages:

• The existing network infrastructure is fully deployed, and there is no need to install new communication channels.
• There is no limit on the number of controllers (as 32 per line in RS-485 case).
• RS-485 installation only, discontinuation, grounding and troubleshooting knowledge are not required.
• Communications with the controller can be done at full network speed, which is important if transferring lots of data (database with thousands of users, possibly including biometric recordings).
• In the event of an alarm, the controller can initiate a connection to the host PC. This capability is important in large systems, as it serves to reduce network traffic caused by unnecessary voting.
• Simplify the installation of systems consisting of multiple sites separated by large distances. Basic internet link is enough to establish a connection to a remote location.
• A variety of standard network equipment options are available to provide connectivity in various situations (fiber, wireless, VPN, dual path, PoE)

Deficiency:

• The system becomes vulnerable to network-related issues, such as delays in heavy traffic and network equipment failures.
• Access controllers and workstations can become hackers accessible if the organization's network is not properly protected. This threat can be eliminated by physically separating the access control network from the organization's network. It is also worth noting that most IP controllers use Linux platforms or proprietary operating systems, which make them more difficult to hack. Industry standard data encryption is also used.
• The maximum distance from the hub or switch to the controller (if using a copper cable) is 100 meters (330Ã, ft).
• The operation of the system depends on the host PC. If the host PC fails, the event of the controller is not taken and the functionality requiring interaction between controllers (ie anti-passback) stops functioning. However, some controllers have peer-to-peer communication options to reduce dependence on host PCs.

7. IP Reader. The reader connects to the host PC via an Ethernet LAN or WAN.

Advantages:

• Most IP readers have PoE capabilities. This feature makes it very easy to provide battery-powered power throughout the system, including locks and different types of detectors (if used).
• The IP reader eliminates the need for enclosures controllers.
• No capacity is wasted when using an IP reader (eg a 4-door controller will have 25% unused capacity if it only controls 3 doors).
• IP system reader scale easily: no need to install main or new sub-controller.
• The failure of an IP reader does not affect other readers in the system.

Deficiency:

• To be used in areas with high security, IP readers require special input/output modules to eliminate possible interruptions by accessing keys and/or exit keys. Not all IP reader manufacturers have such modules.
• Being more sophisticated than basic readers, IP readers are also more expensive and sensitive, therefore they should not be installed outdoors in areas with harsh weather conditions, or high vandalism possibilities, unless specially designed for exterior installations. Some manufacturers make such models.

The advantages and disadvantages of IP controllers apply to IP readers as well.

Security risks

The most common security risk of intrusion through an access control system is to simply follow legitimate users through the door, and this is referred to as tailgating. Often legitimate users will hold the door to intruders. This risk can be minimized through security awareness training from the user population, or more active ways like a revolving door. In extremely high security applications this risk is minimized by using the sally port, sometimes called security vestibulum or mantrap, where operator intervention is required as possible to ensure valid identification.

The second most common risk is from opening the door. This is relatively difficult on well-secured doors with strikes or magnetic locks of high-voltage style. Completely implemented access control systems include forced door monitoring alarms. It varies in effectiveness, usually failing from high false positive alarms, poor database configuration, or lack of active intrusion monitoring. Most newer access control systems incorporate several types of door opening alarms to let the door system administrator be left open for longer than a certain period of time.

The third most common security risk is natural disasters. To mitigate risks from natural disasters, building structures, to the quality of networks and vital computer equipment. From an organizational perspective, leadership will need to adopt and implement a Hazard All Plan, or a Disaster Response Plan. Highlights of any incident plan determined by the National Incident Management System should include pre-incident planning, during incident actions, disaster recovery, and after review of actions.

Similar to levering crashing against cheap partition walls. In the space of tenants along the division wall are vulnerabilities. Vulnerability along the same line is the breakdown of the various sides.

Hardware spoofing locking is quite simple and more elegant than levering. A strong magnet can operate solenoid control bolts in electrical locking hardware. Motor locks, more common in Europe than in the US, are also susceptible to these attacks using donut-shaped magnets. It is also possible to manipulate power to either key by removing or adding flows, although most Access Control systems incorporate a battery backup system and locks are almost always on the safe side of a door.

Access cards themselves have proven to be vulnerable to sophisticated attacks. Hacked hackers have created portable readers who capture card numbers from a user's distance card. Hackers just walk with the user, read the card, and then present the number to the reader who secures the door. This is possible because the card number is sent clearly, no encryption is used. To overcome this, multiple authentication methods, such as PIN plus cards must always be used.

Many unique serial number access control credentials are programmed sequentially during creation. Known as sequential attacks, if intruders have credentials ever used in the system, they can only increase or decrease the serial number until they find the credentials that are currently authorized in the system. Ordering credentials with a unique random serial number is recommended to counter this threat.

Finally, most of the electrical locking hardware still has a mechanical lock as a failure. The mechanical lock keys are vulnerable to collisions.

The principle of need-to-know

The need to know the principle can be enforced with user access control and authorization procedures and the goal is to ensure that only authorized individuals gain access to the information or systems necessary to perform the task.

Maps Access control

Computer security

In computer security, common access controls include authentication, authorization, and auditing. A narrower access control definition would only include access approval, in which the system makes a decision to grant or deny access requests from an authenticated subject, based on what the subject permits. Authentication and access controls are often combined into one operation, so access is approved based on successful authentication, or based on anonymous access token. Authentication and token methods include passwords, biometric scans, physical keys, electronic keys and devices, hidden paths, social barriers, and human and automated monitoring.

In each access control model, entities that can perform actions on the system are called subjects , and entities representing resources whose access needs to be controlled are called objects (see also Access Control Matrices). Subjects and objects should be regarded as software entities, not as human users: any human user can have only an effect on the system through the software entities they control.

Although some systems equate subjects with user IDs , so all user-initiated processes by default have the same authority, this level of control is not good enough to satisfy the principle of least privilege, and arguably responsible over the prevalence of malware in the system (see computer insecurity).

In some models, for example object-capability models, each software entity can potentially act as a subject and an object.

By 2014, access control models tend to fall into one of two classes: based on capabilities and those based on access control lists (ACLs).

• In a capability-based model, holding unpredictable references or capabilities for an object gives access to objects (roughly analogous to how ownership of one's home key gives one access to one's home ); access is delivered to the other party by transmitting that capability over a secure channel
• In an ACL-based model, subject access to an object depends on whether its identity appears on the list associated with the object (roughly analogous to how the bouncer on the private side will check the ID to see if a name appears on the guest list); access is delivered by editing the list. (Different ACL systems have different conventions about who or what is responsible for editing the list and how it was edited.)

Both ACL-based and capacity-based models have mechanisms to allow access rights to be given to all members of a subject group (often the group itself is modeled as the subject).

The access control system provides essential services from authorization , identification and authentication ( I & amp; A ), access approval , and accountability where:

• the authorization specifies what the subject can do
Identification and authentication
• ensures that only legitimate subjects can enter the system
• approval access grants access during operation, by associating users with resources they are allowed to access, based on authorization policy
• The accountability identifies what subject (or all subject related to the user) performs

src: www.sigmawifi.com

Access control model

Access to the account can be enforced through many types of controls.

1. Attribute Based Access Control (ABAC) | The access control paradigm in which permissions are granted to users through the use of policies that evaluate attributes (user attributes, resource attributes, and environmental conditions)
2. Discretionary Access Control (DAC)
   In DAC, the data owner determines who can access specific resources. For example, a system administrator can create a file hierarchy to access based on specific permissions.
3. Historical Access Control (HBAC)
   Access granted or denied based on a real-time evaluation of a requesting party's activity history, e.g. behavior, time between requests, content of demand. For example, access to certain services or data sources may be assigned or rejected on personal behavior, e.g. the demand interval exceeds one request per second.
4. Identity Based Access Control (IBAC) | Using these network administrators can more effectively manage activities and access based on individual needs.
5. Mandatory Access Control (MAC)
   In MAC, users do not have much freedom to determine who has access to their files. For example, user security permissions and data classifications (as confidential, confidential or confidential) are used as security labels to determine the level of trust.
6. Organization-Based Access Control (OrBAC)
   The OrBAC model allows policy designers to define security policies separately from implementations
7. Race Based Access Control (RBAC)
   RBAC allows access based on job titles. RBAC largely removes the wisdom when granting access to objects. For example, a human resources specialist should not have permission to create a network account; this should be the role provided to the network administrator.
8. Rule Based Access Control (RAC)
   The RAC method is largely contextual. This example will only allow students to use the lab for a certain time.
9. Access Control Based on Liability
   Information is accessed based on the responsibility given to the actor or business role

src: www.outsource.net

Telecommunications

In telecommunications, the term access control is defined in US Federal Standard 1037C with the following meaning:

1. Service features or techniques used to permit or deny the use of communication system components.
2. Techniques used to define or restrict the right of an individual or application program to obtain data from, or place data into, storage devices.
3. The definition or limitation of an individual's or app's program's right to obtain data from, or to place data in, storage devices.
4. The process limits access to resources from SIA (Automated Information System) to authorize other users, programs, processes, or systems.
5. The function is performed by a resource controller that allocates system resources to meet user requests.

This definition depends on several other technical terms from Federal Standard 1037C.

src: www.memoori.com

In object-oriented programming

In an object-oriented programming language, access control is a piece of equipment to achieve encapsulation, one of four basic object-oriented programming. The goal is to establish a clear separation between the interface (the visible and accessible part of the class) and the implementation (internal representation and auxiliary methods).

Also known as data hiding, this ensures exclusive data access to class members (both variables and methods) and protects the integrity of objects by preventing corruption by client programmers/client classes. Rule of thumb is to use a more limited access level for your data, unless there is a compelling reason to expose it. It also helps reduce interdependence between classes - leading to lower coupling and fewer regression disorders.

In object-oriented programming, access control is usually implemented using an access modifier within an object or class. Although the access modifiers may be syntactically different between languages, they all strive to achieve the same goal; Decide which variables and methods are visible and to whom.

Some programming languages ​​(eg Java, C, C #, Ruby) use the same public public , protected , and private modifiers. This is a keyword that allows the programmer to assign access levels to classes and class members (both data and methods). Their exact use in any programming language varies, depending on the philosophy of the language, but there are more similarities than differences.

Comparison of the use of keyword access modifiers in different OOP languages ​​

Note: in Ruby, the private method always has self as the implicit recipient. Therefore, they can only be used on their current objects.

In some languages ​​there is a mechanism for changing access changes to gain access to the private components of an object. One example is a friend class in C.

Access attributes

Specific public member methods - accessor (aka getter ) and the mutator method (often called setter ) are used to control changes class variables to prevent unauthorized access and data corruption.

src: www.veritech-systems.com

Public policy

In public policy, access control to restrict access to the system ("authorization") or to track or monitor behavior within the system ("accountability") is an implementation feature using a trusted system for security or social control.

src: www.lockupservices.ca

See also

• Alarm device, Alarm management, Security alarm
• Card reader, General Access Card, Magnetic stripe Card, Proximity Card, Smart Card, Optical Door, Access Badges
• Fortress, Fortress
• Computer security, Logical security,.htaccess, Wiegand effects, XACML, Credentials
• Door security, Lock up, Lock (security device), Electronic lock, Safe, Safe-crack, Bank safe
• Fingerprint scanner, photo identification, Biometric
• Identity management, Identity document, OpenID, IP Controller, IP reader
• Key management, Key card
• Lock screen
• Management of physical security information
• Physical Security Professional
• Prison, Spiked Paste, Mantrap
• Security, Security engineering, Security lighting, Security management, Security policy

src: www.mercuryalarmservices.co.uk

References

• US. Federal 1037C
• US. MIL-188
• US. National Security Information System Glossary
• Harris, Shon, CISSP All-in-one Exam Guide, 6th Edition, McGraw Hill Osborne, Emeryville, California, 2012.
• "Integrated Security System Design" - Butterworth/Heinenmann - 2007 - Thomas L. Norman, Author CPP/PSP/CSC
• NIST.gov - Computer Security Division - Computer Security Resource Center - ATTRIBUTE BASED ACCESS CONTROL (ABAC) - PICTURE

src: www.firefighter-pgh.com

External links

• Access Control Markup Language. The default language/model of OASIS for access control. Also XACML.

Source of the article : Wikipedia