Functional Specification Document Access Control Technology Unit C1 South City Business Centre Tallaght Dublin 24 Ireland Ph: + 353 (0) 1 4662570 Web: www.accesscontrol.ie
Index Introduction 1.1 Hardware Components 1.2 Power Requirements 1.3 Structured Cabling 1.4 Communications 1.5 Housings & Equipment Tamper Switches 1.6 Alarm Handling / Fire Override 1.7 Local Event Buffer 1.8 Card Reading Technologies 1.9 Wireless Electronic Locks 2.0 System Architecture 2.1 Software 2.2 Database Accessibility 2.3 Immediate Propagation 2.4 Authentication 2.5 Interactive Sitemaps 2.6 Multi Tennant (Partitioning) 2.7 Card Design 2.8 Cardholders 2.9 Searching 2.10 User Tracking 2.11 Real Time Audit Trail 2.12 Automatic Archive 2.13 Reporting 2.14 Help 3.0 Warranty Appendix 1 Appendix 2 Software Requirements Hardware Requirements Page 1
Introduction The access control system (ACS) shall comprise of an integrated, scalable, electronic proximity card system. The Access Control System s primary function is to regulate access through specific portals (doors, gates or barriers) to secured controlled access points, also have provision of capturing cardholder s images and producing access cards used to provide access throughout designated areas. The system will support an integrated network of intelligent smart card readers using MIFARE technology at fixed locations which provides the backbone of the access control system. The database for the Access Control System (ACS) will operate using Microsoft SQL Database 2005 or later. There shall be a dedicated server allowing remote client computers (workstations) access the ACS using client/server protocol. Access to the security application software shall be password protected. Hardware Specification 1.1 Hardware Components Controllers Access Control Units (ACU) are supplied with internal non-volatile memory. This memory will allow all programming of access permissions, time schedules and the current date and time data stored in the internal memory to be retained during periods of power failure. ACU shall be configurable via Enterprise level software. ACUs will also be configurable via an integral keyboard/display or internal web server. ACU controllers shall have the facility to control Entry and Exit readers per door and shall be capable of differentiating between valid entry and exit events. ACUs shall be integrated with a 12Volt DC 2Amp power supply (PSU) and be capable of monitoring and reporting mains present, supply voltage and tamper. All faults shall be reported via the ACS controlling software. The metal housing shall be capable of supporting an external back-up battery. ACUs shall support direct IP 100Mbs Ethernet connection for connection with the software. Page 2
1.1 Hardware Components Cont. ACU device shall support the following features; 60,000 users 1024 user groups TCP/IP (100/10 Mbs) USB Connectivity. RS485 Protocol. Automatic door discovery NetBIOS over TCP/IP name resolution. Dynamic IP Address (DHCP). Voltage Monitoring and reporting Elevator control Input / output monitoring 1.2 Power Requirements ACU controllers shall be powered by a 12V DC supply. Power consumption of ACU are 230mA.. Power Supply Unit (PSU) shall be monitored and regulated with the ability of battery backup. 1.3 Structured Cabling Wiring shall be in accordance with the schematic and floor plan drawings as indicated below. ACU controllers shall be networked over a TCP/IP protocol or an RS485 configuration. 1.4 Communications Master ACU uses TCP/IP communications techniques over Ethernet, whilst employing proprietary communications protocols. In the event of communication failure or interruption, the local ACU shall continue to operate independently, using criteria held in non-volatile memory, and logging usage until communication has been restored. The system shall employ a distributed architecture so that all access decisions are made locally. It shall be possible to cluster ACUs to share data and make one ACU a master of a cluster of up to 16 ACUs. the main point of communication to the server, with an alternate master within each cluster to support the cluster in event of a failure; this will keep network bandwidth at a minimal level Page 3
1.5 Housings & Equipment Tamper Switches ACU controllers are fitted with equipment tamper switches which consist of a spring loaded switch assembly. 1.6 Fire Override / Alarm Notification ACU controllers shall unlock all doors automatically on Fire Alarm Activation. When the ACU gets an input from the fire alarm it shall automatically release all specified online-doors. The system shall allow doors to be configured to cause a variety of alarms to activate based upon inputs. Each hardware component will generate a number of alarms. These alarms include (but will not be limited to): DOOR AJAR DOOR FORCED OPEN DOOR OPENED UNDER DURESS ENCLOSURE TAMPERING VOLTAGE MONITORING BREAKGLASS MONITORING 1.7 Local Event Buffer ACU devices maintain a buffer of all events that occur locally. The ACU stores events until they are uploaded to the server. If communication between ACU and server is lost, events will be retained until communication is restored, at which point the last 5000 logged events shall be uploaded to the server. 1.8 Card Reading Technologies The access control system shall operate using contactless smart card 13.56MHz MIFARE technology conforming to standards compliant with ISO/IEC 14443-4. MIFARE protocol proximity readers shall use a Belden 9504 (or equivalent) cable and may be located at a cable distance up to 100m from the ACU. MIFARE protocol proximity readers shall recognize the unique ID encoded to the appropriate memory sector. Card read range shall be a minimum of 25mm in normal operating conditions. Card readers shall be in a polycarbonate housing provided with LED indicators to indicate power status, valid and invalid reads. The card reader or entry device will give an audible indication of each read. Readers will be available in Proximity and/ or Pin and Proximity formats. Readers can be mounted on a standard electrical pattress box. A mullion variant will be available rated to IP67. Page 4
1.9 Wireless Electronic Locks On-line stainless steel wireless electronic locks will support 868 MHz standard wireless bandwidth. Wireless electronic locks will communicate with a TCP/IP ACU Controller. Each ACU controller will be able to manage up to 32 locks per hub (range dependent). Locks will use CR123a 3v lithium battery as standard. In event of battery failure, USB override can be used. Wireless locks will allow free egress from secure side of the door. Wireless lock must be in unobtrusive colours such as black and grey. A status LED to inform on the current status of the door is required. Locks must be no larger than 293mm x 46mm x 30mm inside and 293 x 46 x 25 outside. Wireless Electronic Locks shall support; up to 200,000 door activation on a single battery 13.56 MHz MIFARE (Classic, DESFire EV1) real-time reporting to ACU USB connection Key override (optional) 72mm Euro profile key locks. 128bit AES encrypted communication fail secure facility white listed cards for emergency access Page 5
Software Specification 2.0 System Architecture Access Control Software (ACS) shall provide a multi-tasking windows environment that allows operators access the ACS system from their client PC. The software shall cater for multiple sites and be managed from a centralized server. 2.1 Software An Enterprise level Access Control management system will provide the standard IT tools and innovative distributed architecture. The application software shall interface with video management systems using the Milestone software platform or Physical Security Information Management (PSIM) systems. The system will utilise Microsoft's.NET 4.0 technology, use IT-standard tools that provide native encryption and XML data transfer. It will deliver user intuitive tools and screens similar to other office systems such as Outlook and Explorer to increase usability and reduce training required at implementation. The Enterprise level Software shall support, at a minimum, Microsoft SQL Server 2005 / 2008 (Express, Standard, or Enterprise), for data protection and redundancy. The Enterprise Software shall have true multi-tasking, multiprocessor and remote client support; allowing independent activities and monitoring to occur simultaneously at multiple locations. The operator workstation (Client) shall be user friendly, employing icon-based menus and providing a mouse-driven interface for system operation and the creation of color graphic maps. It shall have an intuitive user interface with easy navigation, using hyperlinks and back and forward buttons to navigate between pages on the screen. Page 6
The Enterprise Software shall support the following role based access modules: Installation A module for the installation, expansion and maintenance of the access control system hardware. Management A module dedicated for the management of users, doors, credentials and access rights. Monitoring A module dedicated to the monitoring of the access control system. This module must include a real-time logging of events on the system as they happen and allow remote-control (lock/unlock) of the doors. 2.2 Database Accessibility All system data must reside on a SQL database on the network and must be accessible in real-time to every / any system workstation. This allows for automatic change propagation to all workstations on the system as well as a common database to consolidate all information and allow for efficient disaster recovery. 2.3 Immediate Propagation Changes made using the ACS are automatically recorded to the SQL database and downloaded to the ACU controller using the appropriate communications channel. All database changes can be performed while the workstation is on-line without disrupting other system operations. 2.4 Authentication The ACS application shall request an operator s user name and password before entry to the system is granted. The software will not rut until the identification of the operator has been verified and access is granted. Privilege Levels When defining the operators access levels, the system shall allow the level of assignment to be specified. These levels include the following: Read only: This type of privilege level does not allow the operator to create or modify components in the specified area of the system. However, they are allowed to view those records. Page 7
Modify: This type of privilege level does not allow the operator to create components in the specified area of the system. However, they are allowed to view and make modifications to existing records. Full: This type of privilege level allows the operator to create, modify and view components in the specified area of the system. 2.5 Interactive Sitemaps The ACS shall also support the use of interactive Site Maps. The graphics and floor plans shall be configured in a JPEG, GIF or Bitmap format to allow for the importation of existing site drawings. Upon activation of a selected alarm, the system shall automatically display the associated graphic / floor plan on the PC monitor. The operator shall use the mouse to click on an icon on the graphic and acknowledge / cancel alarm events as well as operating the door. 2.6 Multi-Tenant (Partitioning) The ACS system shall have the facility to partition multiple sites. It shall allow systems, with a large number of doors and users, to be partitioned into smaller manageable systems (Sites). The hardware (Master ACU) shall connect as normal to the system. ACS operator can only view and configure attributes (users, user groups, doors, timezone, events etc) that belong to their particular site. The operators shall not see attributes from other sites. As new items are added to the database, the administrator can assign the items to different sites. 2.8 Card Design The ACS shall facilitate the design and printing of ID cards which shall allow the operator to create unlimited card templates which may be printed from the software. The card templates may be configured to display the card holder s photo, company logo, user details etc as designed. It may also be programmed to include a barcode or to encode a magnetic stripe on the card. 2.9 Cardholders The database shall support 60,000 cards all of which are downloaded and retained in the memory of the ACU. This cardholder management functionality allows the enrolment of cardholders into the database, capturing of images and import / export of employee data. This functionality also allows a system operator to assign or modify the access rights of any cardholder and the changes to be implemented in real time. 2.11 User Tracking Page 8
The ACS records the last visited access point (with date and time) for every cardholder. A special trace function is available for operators to track activity of specific cardholders. When the trace has been applied, all card activity relating to that cardholder will be highlighted in the user tracking report. A report may also be generated that details the locations visited by the traced cardholder. 2.12 Real Time Audit Trail The ACS shall log all changes to the database and these events are logged on-screen as they occur (in real-time). All system changes, alarm events, access rights changes, input/output state changes, exception messages, miscellaneous system messages, or any information relating to the access control system in general are logged to the audit trail and the event log. 2.13 Automatic Archive The ACS shall be capable of creating an automatic backup of the database. This facilitates a backup to be created for the database on a scheduled daily basis. 2.14 Reporting The ACS shall provide detailed reports regarding the information contained in the database, audit trail, or operator journals, without the need for programming skills. The operator shall be able to select the specific system components on which to base a report, and order the report according to any logical criteria. 2.15 Help The software shall provide a HELP option which shall provide supplementary information relevant to the event displayed on the main screen. The help menu should be activated by the use of the mouse and should detail all relevant material. 3.0 Warranty The access control equipment shall come with a minimum of 5 years manufacturer s warranty. Page 9
Appendix 1 Software Requirements: The following software is required for the installation and running of the Enterprise software: Database Server Software Requirements: Windows Server 2003 32bit, or 64 bit, OR Windows Server 2008 32bit, or 64 bit Microsoft.Net Framework V.4.0 Microsoft SQL Server 2005 Express Edition with SP2, OR Microsoft SQL Server 2005 Standard Edition with SP2 Client Requirements Windows XP, Windows Vista or Windows 7 Appendix 2 Hardware Requirements: The minimum hardware requirements are as follows: Database server: Processor: Core i5 Memory: 4GB Hard disk: 20G Note: These are minimum specifications guidelines only. Requirements may change depending on the number of doors, users, etc. Page 10
Appendix 3 Schematics Diagram 1 Diagram 1: An example of a elock and ACTpro4000 access control system is shown. It consists of two Hubs in a Hub Group, with 4 elocks, 2 ACTpro ACU and a PC running the ACT Enterprise software. The system is completely extendable up to 4000 doors with additional elocks, Hubs and ACU devices. ACT Enterprise Server/Client Software with multiple administrators ACTpro Series IP controllers with wireless hub, elocks and input /output module Page 11