Access control system using blockchain ledger
A distributed transaction ledger (e.g. blockchain) is used to control access through access points in an access control system. During normal operation, access control devices (e.g. system controllers and door controllers) generate and broadcast transaction information to a validation network. The validation network maintains a distributed transaction ledger for the access control system, for example, by validating and distributing the transaction information across the validation network according to predetermined consensus criteria. The devices perform access control functions based on transaction information retrieved from the transaction ledger. Door controllers receive identification information from user devices (e.g. identification badges, mobile computing devices) and send the identification information to the validation network. A predetermined number of responding nodes generate verification information based on authorization information in the transaction ledger. If a predetermined proportion of the responding nodes indicate that the occupant is authorized, access is granted by the door controller.
1. A method of operation of an access control system of a premises, the method comprising:
door controllers of the access control system receiving identification information from user devices;
nodes of a validation network of the access control system receiving the identification information from the door controllers, generating verification information based on the identification information and on local copies of a transaction ledger and sending the verification information to the door controllers;
the door controllers controlling access to access points of the premises based on the verification information;
selecting which of the nodes receive the identification information and generate the verification information based on predetermined quorum information for the validation network, wherein the predetermined quorum information prescribes a predetermined quantity of nodes to generate the verification information and a predetermined quantity of local copies of the transaction ledger to be queried during each access attempt; and
granting access to the access points in response to determining that the predetermined quantity of nodes unanimously responded with verification information indicating that the occupants are authorized to access the access points.
2. The method as claimed in claim 1 , wherein the transaction ledger is a blockchain.
3. The method as claimed in claim 1 , wherein the transaction ledger includes authorization information for the access points.
4. The method as claimed in claim 3 , wherein the authorization information includes contracts associating identification information for the users with identification information for the access points for which the users are authorized.
5. The method as claimed in claim 4 , further comprising the nodes generating verification information indicating that the users are authorized to access the access points in response to determining that valid contracts between the users and the access points exist.
6. The method as claimed in claim 4 , further comprising the nodes generating verification information indicating that the users are not authorized to access the access points in response to determining that valid contracts between the users and the access points do not exist.
7. The method as claimed in claim 3 , wherein the authorization for the access points includes an access control list indicating authorized occupants of the building for each access point.
8. The method as claimed in claim 7 , wherein the nodes generate the verification information by retrieving an up-to-date access control list from the local copies of the transaction ledger and determining whether an occupant associated with the identification information is authorized to access the access points.
9. The method as claimed in claim 1 , wherein the nodes of the validation network include system controllers of the access control system.
10. The method as claimed in claim 1 , wherein the nodes of the validation network include the door controllers, and the door controllers verify identification information received by other door controllers.
11. The method as claimed in claim 1 , further comprising the door controllers granting access in response to determining that all of the verification information received from the nodes indicates that the users are authorized and the door controllers denying access in response to determining that the verification information received from one or more of the nodes indicates that the users are not authorized.
12. The method as claimed in claim 1 , further comprising the door controllers generating transaction information indicating identification information for occupants requesting access and identification for access points being engaged by the occupants and broadcasting the transaction information to the validation network to be stored to the transaction ledger.
13. The method as claimed in claim 12 , wherein the nodes receive the identification information from the door controller by retrieving the identification information from the local copies of the transaction ledger in response to determining that the identification information was newly added to the transaction ledger.
14. The method as claimed in claim 1 , wherein the transaction ledger includes a log of access control events and historical configuration information and user authorization information, which are permanently added to the ledger in real time and can be accessed by the system controllers, door controllers and other distributed devices, technicians and/or security personnel.
15. The method as claimed in claim 1 , wherein the predetermined quorum information is stored in the transaction ledger after an initial configuration process.
16. The method as claimed in claim 1 , further comprising the predetermined quantity of nodes coordinating responses to the door controllers by adding the verification information to the transaction ledger.
17. The method as claimed in claim 16 , further comprising the nodes determining whether to respond to the door controllers based on how many nodes have already responded according to the transaction ledger.
18. The method as claimed in claim 16 , further comprising the door controllers controlling access to the access points based on verification information retrieved from the transaction ledger.
19. The method as claimed in claim 1 , further comprising denying access to the access points in response to determining that one or more of the predetermined quantity of nodes responded with verification information indicating that the occupants are not authorized to access the access points.
20. An access control system of a premises, the system comprising:
door controllers for receiving identification information from user devices and controlling access to access points of the premises; and
a validation network comprising nodes for receiving the identification information from the door controllers, generating verification information based on the identification information and on local copies of a transaction ledger and sending the verification information to the door controllers;
wherein the door controllers control access to the access points based on the verification information, selections of which nodes receive the identification information and generate the verification information are based on predetermined quorum information for the validation network, the predetermined quorum information prescribes a predetermined quantity of nodes to generate the verification information and a predetermined quantity of local copies of the transaction ledger to be queried during each access attempt, and the door controllers grant access to the access points in response to determining that the predetermined quantity of nodes unanimously responded with verification information indicating that the occupants are authorized to access the access points.
21. The system as claimed in claim 20 , wherein the transaction ledger is a blockchain.
22. The system as claimed in claim 20 , wherein the transaction ledger includes authorization information for the access points.
23. The system as claimed in claim 22 , wherein the authorization information includes contracts associating identification information for the users with identification information for the access points for which the users are authorized.
24. The system as claimed in claim 23 , wherein the nodes generate verification information indicating that the users are authorized to access the access points in response to determining that valid contracts between the users and the access points exist.
25. The system as claimed in claim 23 , wherein the nodes generate verification information indicating that the users are not authorized to access the access points in response to determining that valid contracts between the users and the access points do not exist.
26. The system as claimed in claim 20 , wherein the nodes of the validation network include system controllers of the access control system.
27. The system as claimed in claim 20 , wherein the nodes of the validation network include the door controllers, and the door controllers verify identification information received by other door controllers.
28. The system as claimed in claim 20 , wherein the door controllers grant access in response to determining that all of the verification information received from the nodes indicates that the users are authorized, and the door controllers deny access in response to determining that the verification information received from one or more of the nodes indicates that the users are not authorized.
29. A method of operation of an access control system of a premises, the method comprising:
door controllers of the access control system receiving identification information from user devices;
nodes of a validation network of the access control system receiving the identification information from the door controllers, generating verification information based on the identification information and on local copies of a transaction ledger and sending the verification information to the door controllers; and
the door controllers controlling access to access points of the premises based on the verification information,
wherein the transaction ledger includes access control events indicating identification information and access point information for each time an access point is engaged with by an occupant and whether access was granted or denied, status information for the door controllers including information about status changes of the door controllers, whether access points are locked or unlocked, configuration information, and the verification information for access control attempts.
30. A method of operation of an access control system of a premises, the method comprising:
door controllers of the access control system receiving identification information from user devices;
nodes of a validation network of the access control system receiving the identification information from the door controllers, generating verification information based on the identification information and on local copies of a transaction ledger and sending the verification information to the door controllers;
the door controllers controlling access to access points of the premises based on the verification information; and
selecting which of the nodes receive the identification information and generate the verification information based on predetermined quorum information for the validation network, wherein the predetermined quorum information prescribes a predetermined quantity of local copies of the transaction ledger to be queried during each access attempt and a minimum quality for the local copies of the transaction ledger stored on the nodes generating the verification information.
31. A method of operation of an access control system of a premises, the method comprising:
door controllers of the access control system receiving identification information from user devices;
nodes of a validation network of the access control system receiving the identification information from the door controllers, generating verification information based on the identification information and on local copies of a transaction ledger and sending the verification information to the door controllers;
the door controllers controlling access to access points of the premises based on the verification information; and
selecting which of the nodes receive the identification information and generate the verification information based on predetermined quorum information for the validation network, wherein the predetermined quorum information prescribes a predetermined quantity of local copies of the transaction ledger to be queried during each access attempt, and access is only granted to the access points when a predetermined percentage of the local copies of the transaction ledger include an access control list indicating that occupants requesting access should be allowed to access the access points.
32. A method of operation of an access control system of a premises, the method comprising:
door controllers of the access control system receiving identification information from user devices;
nodes of a validation network of the access control system receiving the identification information from the door controllers, generating verification information based on the identification information and on local copies of a transaction ledger and sending the verification information to the door controllers;
the door controllers controlling access to access points of the premises based on the verification information; and
selecting which of the nodes receive the identification information and generate the verification information based on predetermined quorum information for the validation network, wherein the predetermined quorum information prescribes a predetermined quantity of local copies of the transaction ledger to be queried during each access attempt, and the predetermined quorum information indicates a relatively small number of local copies of the transaction ledger to be queried and/or a relatively large number of local copies to be queried based on desired speed of access and desired level of security.