Security system with embedded HTTP server

[0002] The invention relates to security systems that are ready for internet and intranet access and, more particularly, to such systems that enable any HTTP client, such as a computer running an Internet Browser software package, to setup, maintain and access the information of the systems via internet and/or intranet communication on existing corporate computer networks using standard TCP/IP protocol.

[0003] Businesses, such as banks, financial institutes and law firms, must control employees' access to the business premises, and must ensure that the individual is actually the authorized person. Other business sectors such as manufacturers, also want to keep track of the attendance records of their employees and workers. Today, businesses use a variety of security systems to achieve the purposes. These include systems using traditional passwords or security-access cards, and more advanced biometrics systems such as fingerprint and voice authentication systems. However, each of these systems poses problems.

[0004] The existing security systems can provide different security levels to satisfy different security requirements for businesses. But with the exception of the simplest systems such as single password-based stand-alone access-control devices, all these security systems are complicated to setup and maintain, especially for larger-scale security systems that involve more than one security terminal interconnected to form a completed system.

[0005] In general, the existing security systems in the market today require dedicated computers connecting to the systems for the setup and maintenance purposes (e.g., new enrollment, withdrawal and other changes of employees' data). The security system must be connected to a dedicated computer via a serial connection (usually in RS-232 or RS-485 standard) or other similar channels using proprietary communication protocol. The dedicated computer must be a PC, running Microsoft Windows 95/98/NT for example, and must be running a special software provided by the vendor of the security systems that works with the proprietary protocol. Such proprietary software and protocol are platform-dependent, and other less-common computer platforms, such as Apple Macintosh and Unix machines, usually cannot do the job due to the lack of support from the vendor.

[0006] The setup and maintenance of the dedicated computers, the connections, and the proprietary software are cumbersome and require specialized knowledge to use effectively, and takes a lot of expensive IT times. Also, the additional costs of these dedicated computers and software are expensive.

[0007] Besides the problems associated with the setup and maintenance of the existing security systems, it is also difficult and inconvenient for users to access the information of the security systems, such as the access and attendance records of each individual. Generally, a typical security system only generates and sends raw data to the dedicated computer, in a form of simple line-by-line listing of the access log of all individuals in chronological order, in plain ASCII format. Only the dedicated computer can download and collect this raw data. Other computers cannot access the data. The raw data requires another software package to convert the raw data into useful and meaningful information for the management purpose (e.g., to get the attendance reports for an individual of a particular month), and the package is not typically integrated with the software that is used to setup and maintain the security system. Again, this additional software package can only be installed and run on the dedicated computer connected to the security system. And in order for other users in the company to access the information over the corporate computer network (e.g., when the users in the administration department prepare the payroll), the company may need to develop special software to allow other computers to access the information. This again is cumbersome and costs a lot of expensive IT times, and the information collected in this manner is not real-time data as it is not collected directly from the security system, and there is usually a time delay. Users are usually left to guess if the information is accurate and up-to-date or not.

[0008] In summary, the problems with the existing security systems today include the difficulties in setting up and maintaining the systems, the failure to utilize the existing computer network resources, the inconvenience for users to access the data and information of the systems, and the incapability for users to get the information in a real-time manner.

[0009] These and other objects, features and advantages of the present invention will become apparent in light of the following detailed description of preferred embodiments thereof, as illustrated in the accompanying drawings.

[0010] FIG. 1 is a block diagram illustration of a security system according to the present invention.

[0011] FIG. 1 is a block diagram of a Security Terminal 150 layered over the LAN 127. The connection is established between the LAN 127 and the build-in network adapter 167 via standard 10-base-T wiring 151. In addition to the Security Terminal 150, there are also other devices connected to the LAN 127, including the Apple Macintosh 131, the Unix machine 130, the PC 129, and other network resources (network printer 128 and disk storage 132). In addition, there are two other security terminals 164 and 163 connected to the same LAN 127, and they are configured as slave terminal. The Security Terminal 150 is configured as master terminal.

[0012] The LAN 127 is also connected to the Internet 136 via the link 142. This link can be a lease line, a dial-up line, or any other means. Remote computers 133, 134 and 135 are also connected to the internet 136, and they all have the required privilege to access the LAN 127 and the Security Terminal 150.

[0013] During the initial setup, an unique IP address must be assigned to the Security Terminal 150, along with other related information such as subnetmask and default gateway address. This can be accomplished by manually entering the IP address through the keypad 159, or if a DHCP server 153 is available on the LAN 127, the IP address can be automatically assigned by the DHCP server 153. However, as this particular Security Terminal 150 is configured as a master terminal (which will be discussed later), it is recommended that the Security Terminal 150 should be assigned a static IP address, so the IP address of the Security Terminal 150 will never change, and other slave terminals 164 and 163 can always find the master Security Terminal 150. DHCP stands for Dynamic Host Configuration Protocol, which is a protocol that provides dynamic address allocation and automatic TCP/IP configuration.

[0014] After obtaining a valid IP address, the communication link 151 between the Security Terminal 150 and the LAN 127 can be established. The user can then use either the Apple Macintosh machine 131, the Unix machine 130, or the PC 129 to run an Internet Browser software package, and to setup, maintain and access the information of the Security Terminal 150 through the Internet Browser. Note that this is platform-independent.

[0015] An Internet Browser is a HTTP client, and it sends requests to the embedded HTTP server module 102, that is built-in to the Security Terminal 150. As an example, when the connection between the HTTP client and the Security Terminal 150 is first established (usually by specifying to the Internet Browser the IP address assigned to the Security Terminal 150), the HTTP client usually sends a request for the initial home page to display in the Internet Browser. The embedded HTTP server 102 receives and interprets the request, and then notifies the Browser-based Management Module 104. The Browser-based Management Module 104 then sends the initial home page information to the embedded HTTP server module 102, and it in turn sends the response back to the HTTP client for displaying in the Internet Browser.

[0016] The security-related information about the employees is kept in the Access Control Database 106. During initial setup, the user is required to input the employees data. This includes the employee's ID, employee's name, the fingerprint image, the access right, and the valid period of the access right (e.g., one may have the access rights to the premises during weekdays from 8:00 am to 5:00 PM only). The setup procedure is done via the Internet Browser in any one of the computers 130, 129 and 131, in a very user-friendly user interface displayed in the Internet Browser.

[0017] The purpose of this particular fingerprint recognition security system is to ensure that the individual trying to enter the premises is actually the authorized person. An Electrical Door Lock 147 is controlled by the Access Control Module 108, and normally the door is locked by the Door Lock 147. During an authentication process, the individual needs to identify himself/herself as an authorized person by first entering his/her employee's ID number via the keypad 159, and then by placing his/her finger to the Fingerprint Sensor 158. The Fingerprint Sensor Module 110 then captures the fingerprint image and passes the image to the Core Module 101. The Core Module 101 then performs a look-up search for the employee in the Access Control Database 106, and if the particular employee ID is found in the Access Control Database 106, compares the captured image with the fingerprint template for that individual stored in the Access Control Database 106. If the captured image and the fingerprint template match, the individual is authenticated and the Core Module 101 instructs the Access Control Module 108 to release the Electrical Door Lock 147.

[0018] If the employee's ID is not found, or the captured fingerprint image does not match the fingerprint template of the individual, then the individual is not authenticated, and the Door Lock 147 remains locked. The individual is then unable to enter the premises.

[0019] After the individual is authenticated and the Door Lock 147 is unlocked, the Core Module 101 records the data of this authentication incident to the Access Log Database 107. It includes the employee's ID, date and time, as well as the security terminal ID (in the case of multiple security terminals environment, a terminal ID is used to uniquely identify each individual security terminal).

[0020] For Security Terminals 164 and 163, that are configured as slave terminals, the new record will also be sent to the master security terminal 150, and be kept in the Access Log Database 107 there. As a result, the Access Log Database 107 of the Master Security Terminal 150 contains all the access log data of all the salve security terminals in the same security system.

[0021] The Browser-Based Information Query Module 105 is responsible for converting the raw data in the Access Log Database 107 into information that is meaningful to the users, including access and attendance reports. The computers 156, 130 and 129 can simultaneously request such information through Internet Browser. Each of such computers sends the request to the Embedded HTTP Server Module 102 through the LAN 127. The request usually contains the particular employee's ID, or a group of employees, and the period of time needed. The Embedded HTTP Server Module 102 then collects the required raw data from Access Log Database 107 through the Core Module 101. Then it passes the data to the Browser-Based Information Query Module 105 to convert the data to the information required. After completion, the Embedded HTTP Server Module 102 sends the responses back to the HTTP client, which then displays the query results in the Internet Browser.

[0022] The Security Terminal 150, which is configured as Master terminal, is responsible for replicating the data in Access Control Database 106 to other slave security terminals 164 and 163. In the case when a new Slave Security Terminal is connected to the LAN 127, the slave terminal will search for and register with the Master Security Terminal 150. The Master Security Terminal 150 will then upload the data in the Access Control Database 104 to the new Slave Security Terminal.

[0023] In addition, should the data in the Access Control Database 106 be updated, the changes will also automatically be sent to all the slave security terminals. As a result, the Access Control Database 106 in all security terminals contain exactly the same data, and should a broken link problem occurs between a security terminal and the LAN 127, the particular security terminal can still function as a stand alone unit, since the employee's data is also kept in its own Access Control Database 106.

[0024] The exchange of information between Master Security Terminal 150 and Slave Security Terminals 164 and 163 is preferably performed through the Embedded TP server Module. TP stands for Transfer Protocol” which is an extension of the HTTP protocol, and is developed for this purpose. It enables the Master Terminal to send requests to Slave terminal and vice verse. The following is a summary of the new TP commands:

[0025] It is possible for a remote computer to access and maintain the Security Terminal 150. In such case, remote computers 133, 134 and 135, that are connected to the Internet 136, can access the Security Terminal 150, and performs all the same maintenance and query operations as the local computers 131, 130 and 129, provided that the LAN 127 is also connected to the Internet 136, and the remote computers have the required privileges to access the LAN 127. With this feature, a company's headquarters located overseas can remotely maintain the local Security Terminal 150, such as withdrawing the access right of an individual in a local site.

[0026] Another advantage of implementing the Embedded HTTP Server Module 102 to a security system is that it enables the security system to utilize other network resources available in the LAN 127, including the network printer 128 and the network disk storage 132. All the Security Terminals 150, 164 and 163 can be configured to print the access data to the network printer 128 for each authenticated event, and they can also be configured to backup the Access Control Database 106 and the Access Log Database 107 to the network disk storage 132 periodically and automatically.

[0027] It will therefore be seen that we have developed a new security system that includes an embedded HTTP server, that allows platform-independent operations, and that can utilize the existing network resources, and that allows simultaneous accesses by different computers without the need of additional special software package. The terms and expressions employed herein are used as terms of description and not of limitation, and there is no intention, in the use of such terms and expressions, of excluding any equivalent of the features shown and described or portions thereof, but it is recognized that various modifications are possible within the scope of the invention claimed. For example, the Fingerprint Sensor Module 110 can be replaced by a magnetic-card reader, a smart-card reader, or a voice recognition devices. In addition to controlling Electrical Door Lock 147, the security system can also be designed to function as a remote-monitoring security device, with a build-in digital camera for instance, to remotely monitor a remote site via an Internet Browser.

[0028] In the block diagram (FIG. 1), the communication link 151 between the LAN 127 and the network adapter 167 is established using standard well-known 10-base T connection with physical wiring. However alternatively other communication links, such as wireless LAN, can be used.

[0029] Furthermore, although the security system has built-in features to utilize the network printer 128 and disk storage 132, additional network resources can also be utilized, such as the corporate centralized database (ODBC-compatible database for example).