Mathematical model of the «anti-passback» function in access control and management systems.

Mathematical model of the «anti-passback» function in access control and management systems.

Vorontsov Kirill Borisovich,
Korolev Vladimir Sergeevich,
Lebedev Leonid Pavlovich

Mathematical model of the «anti-passback» function in access control and management systems

When creating physical protection systems (PPS), the task is to protect vital zones and systems of the protected facility from erroneous, incompetent or deliberate actions of subjects located on its territory, which by the nature of possible damage are close to unauthorized actions of external or internal violators. One of the effective measures to prevent such actions is the prohibition of repeated passage, implemented by the access control and management system (ACS), which is part of the PPS. This function is designed to eliminate or significantly complicate the possibility of access to the zone by transferring their identification key to another person, as well as to ensure discipline in the movement of personnel around the territory of the facility.

The article is devoted to the construction of a mathematical model for the function of prohibiting repeated passage based on the analysis of the relationships between the zones of the object and the current position of the subject. The implementation of this function based on the model provides a unified mechanism for managing the access rights of subjects for a protected object with any topological structure of zones.

Terms and definitions

The physical protection system is a set of legal norms, organizational measures and technical solutions aimed at protecting the vital interests and resources of the protected facility from threats originating from unauthorized influence of individuals [5].

The physical protection system is built on the basis of the wide application of engineering and technical solutions and software and hardware and contains the following main components:

• personnel access control and management system,
• security and alarm system,
• TV surveillance system,
• operational communication and notification system,
• auxiliary systems (electric power, lighting, etc.).

The functioning of the PPS is carried out within the framework of a mathematical model of the object developed at the design stage, which describes its structure, the quantitative and qualitative composition of technical security equipment (TSE), access control equipment and external system devices.

It is advisable to represent the object model in the form of two parts — logical and physical. Such a division at the upper level of information processing will allow abstracting from the physical nature of the event source and operating only with logical elements.

The mathematical model is built based on the objects of control. The object of control is a generalized name for any functional element of the system that has a fixed set of states and is capable of generating a system event when its state changes [2,4].

The logical part of the model describes territories and zones that are containers for other objects of control, as well as access points and control points. Physically, an access point (AP) is a device that directly controls access and prevents uncontrolled passage of people. A control point is an actuator or an alarm sensor of any type (security, fire, etc.), registered in the system [3,8].

Access points that exclude the passage of more than one subject per act of passage, and at the same time allow the identification of the passerby, are gateway-type access points. Access points that do not guarantee the passage of only one subject per act of passage are gate-type access points [4].

Access zone is a part of the territory of the facility, which is a limited enclosed space, has physical boundaries and is protected by a set of access points and control points. It can be entered only by crossing the access point. An access zone protected by gateway-type access points only is called a boundary.

There are also zones, which are a limited but open space with one or more physical boundaries — blocking zones. These are usually checkpoints that control a single perimeter, but for some reason are controlled by different controllers.

Each point of the logical part of the object model corresponds to one or more elements of the physical part, which describe specific physical devices. For example, one access point can be connected to an electromagnetic lock, an identification card reader, a weighing platform, a code-setting device, a radiation control sensor.

An access control and management system is a set of organizational and methodological measures and software and hardware tools that solve the problem of monitoring and managing visits to individual zones, as well as operational control of personnel movement and the time they spend on the territory of the facility [5].

Each access point operates under the control of a specialized controller. Depending on the method of constructing the system, the controller can control one or several access points, store the subjects' data in its internal database and/or in the system server database. The fundamental point (with any method of constructing) is that each subject registered in the system has its own «personal» unique identifier, by which its owner is uniquely determined. Magnetic and smart cards, contactless proximity cards, an image of the iris, a fingerprint, a pattern of palm veins, etc. can serve as identifiers [6]. Each identifier is characterized by a certain unique material code, which is associated with information on the rights and privileges of the subject — the owner of the identifier [8].

During the system operation, this identifier is transmitted to the controller using a reader installed at the access point. Based on a comparison of the read identifier and the sample identifier stored in the database, the controller makes a decision on further actions: admitting the subject, denying access, blocking, alarm, etc. All facts of presenting identifiers and related actions (passages, alarms, etc.) are recorded in the controller and stored on the system server. This information is usually used later to obtain reports on working time accounting, control over movements around the facility, etc. [1].

Anti-passback or re-entry prohibition is a prohibition of access to a zone by the identifier of a subject already registered and located in this zone. In addition to this function, ACS also includes «zonal» control, which prohibits access to a zone if the subject is currently in another zone. The implementation of the «anti-passback» function allows to exclude the reuse of the same card by different people [7].

Obviously, this feature exists only for zones accessed via a gateway-type AP with mandatory recording of subjects at entry and exit. A necessary condition for implementing the «anti-passback» function is the presence in the system of a mechanism for forced synchronization of the subjects' position, in which information about the fact of crossing the access point is sent to all controllers managing the access points. In the event of an abnormal situation, such as a connection failure, the controller operates in the local «anti-passback» mode, when repeated passage by the same identifier through the access points served by this controller is blocked.

Connections between object zones

As already noted, the PPS operates within the framework of a mathematical model of the protected object developed (at the design stage), which describes the topology, zone structure, quantitative and qualitative composition of technical security equipment, access control means, etc. When designing a system, a logical model is first developed, where the protected object is divided into territories, zones of responsibility, access and blocking. Access points and control points are added to the zones. The next step is to associate the created logical model with a physical model, where each access or control point is assigned a specific physical device: technical security equipment, access control device, etc. In this case, each registered element of the system is assigned a unique identifier.

For clarity and to simplify the understanding of the relationship between control objects, the model of the protected object is usually presented hierarchically as a tree, in which the zones are in a «parent-child» relationship. Additionally, this approach allows to simplify the task of constructing a mathematical model describing the implementation of the «anti-passback» function.

The mathematical model of this function is based on the analysis of the topology of the protected object and taking into account the factors that are significant only for this task. The significant factors in this case are the gateway-type TD and access zones — boundaries. All other objects of control of the SUD subsystem can be neglected, since it is impossible to unambiguously determine either the position or the change in the position of the subject relative to the access zone.

Mathematical model of the «anti-passback» function

There are four types of relationships c, p, b, n between two zones u and v, which are described by the following characteristic functions:

Without proof, we note that for any pair of the above characteristic functions f and g (f ¹ g) the statement is true: f(u,v) x g(u,v) = 0. That is, a pair of zones can consist of only one of the relations. In order for the controller to determine the subject's rights to cross controlled APs, it is sufficient to know the permitted direction of movement in each of these access zones. Let us introduce the notation for the subject's actions: a — entry into the zone is permitted; b — exit from the zone is permitted; g — crossing the boundaries of the zone is prohibited. Let us designate as d the directions of the subject's movement: h — inward; m — outward.

Based on the above, a mathematical model of the «anti-passback» function is constructed, which determines the permitted direction of movement of the subject for zone v when the subject crosses zone u in the direction d:

Implementation

The above-designated function Пis implemented using the ACS software. Depending on the method of constructing the system, the software can be distributed or concentrated — usually on the system server. It is only important that the nodes on which the function result is calculated, together ensure the transfer of significant information between all access control controllers.

When crossing an access point, the controller records the new position of the subject and reports the arguments u and d. Based on this data, substituting into Пas the third argument v all other zones, the permitted direction of movement of the subject is calculated. Then this information is transmitted to the corresponding ACS controllers. The latter, having received a notification about the change in the permitted direction of movement of the subject, change his access rights in the TDs controlled by them.

The implementation of the developed mathematical model in the hardware and software complex «Kedr» (State Unitary Enterprise «Dedal», Dubna) showed adequate management of access rights when subjects move around the territory of the protected facility.

Conclusion

Based on the described classification of components of the access control and management system, analysis of the relationships between the zones of the object and the current position of the subject, a mathematical model of the function of prohibiting repeated passage is constructed and implemented. The mathematical model provides a single mechanism for managing access rights for an object with any topological structure of zones and does not depend on the software and hardware implementation of the ACS.

List of References

1. Fedyaev S.L. et al. Software and hardware complex for building integrated security systems — SSSI «Kedr». Architecture and basic principles of operation/Scientific and methodological collection. Problems and prospects for the development, improvement and application of technical means of border protection. Scientific and methodological collection. — Kaliningrad: Kaliningrad Border Institute, 2005. — Issue 16, Part 1.

2. Korolev V.S. Some aspects of building integrated security systems for facilities/Technical means and systems of physical protection of nuclear-hazardous facilities. Current level of development and prospects for improving the safety of nuclear-hazardous facilities. Proc. of the industry seminar. — M.: FSUE «SNPO «Eleron», 2004.

3. Documentation of the SSSI «Kedr». Terms and definitions. — Dubna: GUP «Dedal», 2001.

4. Documentation of the SSSI «Kedr». Classification of objects of control. — Dubna: GUP «Dedal», 2003.

5. Alaukhov S.F., Kotseruba V.Ya. Concept of security and principles of creation of systems of physical protection of important industrial objects. — Zarechny: FSUE «NIKIRET», 2005.

6. Ginze A.A. New technologies in ACS //Security systems, 2005. — № 6.

7. Omelyanchuk A.M. Enhanced algorithms in access systems of especially important objects //Security systems, 2005. — № 2.

8. GOST R 51241-98. Access control means and systems. Classification. General technical requirements. Test methods.