Universal validation module for access control systems
A validation module provides for the upgrading of a physical access control system (PACS) to full HSPD-12 compliance without requiring modification or replacement of the existing PACS. The validation module may contain all of the validation functionality required by federal specifications and technical requirements. The validation module may be installed between an existing PACS panel and a supported card/biometric reader. Readers may be selected based on assurance level requirements, e.g., contactless or contact readers for low and medium assurance level areas and full biometric readers for high assurance areas. The validation module may validate a card according to the assurance level setting, extract ID information from data on the card and then pass the ID information to the PACS panel for an access decision. Cardholder data captured by one validation module may be distributed to other validation modules of the PACS using a management station.
1. A method for accessing control system, comprising:
providing coupling to the access control system using modular communication interfaces that includes a first communication port that couples to at least one reader of the access control system and enables a validation device to receive cardholder data from the at least one reader and includes a second communication port that couples to an access decision component of the access control system and enables a validation device to send extracted ID information to the access decision component;
receiving cardholder data in connection with an access request at an access point controlled by the access control system;
validating the cardholder data using an Internet connection to access a remote revocation database that indicates if credentials corresponding to cardholder data have been revoked by authenticating the cardholder data according to an authentication mechanism;
after validation of the cardholder data, extracting ID information from the validated cardholder data; and
sending the extracted ID information to an access decision component of the access control system that determines whether access is granted for a cardholder corresponding to the extracted ID information.
2. The method according to claim 1 , wherein the modular communication interfaces further include a third communication port that couples to a management station.
3. The method according to claim 2 , further comprising:
exchanging information with the management station.
4. The method according to claim 1 , wherein the authentication mechanism is at least one of: cardholder unique identifier (CHUID), card authentication key (CAK), PIV authentication key (PKI), and biometric authentication (BIO).
5. The method according to claim 1 , wherein validating the cardholder data includes performing certificate path discovery and validation to a trusted authority.
6. The method according to claim 1 , further comprising:
performing enrollment processing for cardholder data that is identified as being used for a first time with the access control system.
7. The method according to claim 6 , wherein the enrollment processing includes capturing and storing certificates of the cardholder data that is identified as being used for the first time.