Query-aware privacy for access control data analytics

1. A method comprising:

maintaining, by one or more servers, a database ( 120 , 130 ) of access control events, wherein the access control events involve a plurality of access-controlled points at a plurality of buildings;

dividing, by the one or more servers, a portion ( 138 ) of the database into shares ( 140 A, 140 B, 140 C), wherein the portion of the access events data contains evidence of a malfunctioning device, the evidence of a malfunctioning device comprising evidence of at least one of:

physical damage to the malfunctioning device; and

faulty performance of the malfunctioning device;

passing, by the one or more servers, the respective shares to respective third party servers ( 44 A, 44 B, 44 C);

processing the shares in the respective third party servers, wherein the dividing and the processing the shares in the third party servers limits effects of potential data compromise;

passing output of the processing from the third party servers to a further server ( 40 ); and

processing the output on the further server.

2. The method of claim 1 wherein:

the processing the output on the further server includes combining the shares.

3. The method of claim 1 wherein:

the processing comprises diagnosing the malfunctioning device.

4. The method of claim 3 wherein:

the diagnosing the malfunctioning device comprises diagnosing a malfunction in a credential device for accessing the access-controlled points.

5. The method of claim 3 wherein:

the diagnosing the malfunctioning device comprises diagnosing a malfunction in a reader.

6. The method of claim 1 wherein:

the portion of the access events data contains credential holder identifying information wherein the credential is used to access the access-controlled points.

7. The method of claim 6 wherein:

the dividing obscures the credential holder identifying information.

8. The method of claim 5 wherein:

each of the plurality of readers is at an associated access point of said plurality of access-controlled points.

9. The method of claim 3 wherein:

the results of the processing on the further server are communicated to the one or more servers; and

the one or more servers are used to identify the malfunctioning device.

10. The method of claim 1 wherein:

the results of the processing on the further server are communicated to the one or more servers; and

the one or more servers are used to identify the malfunctioning device.

11. An access control system ( 20 ), the access control system comprising:

a plurality of credential devices ( 24 );

a plurality of readers ( 26 ) at access-controlled points at a plurality of buildings for reading the credential devices; and

one or more servers ( 30 , 32 ) coupled to the readers and programmed to:

maintain an access events database ( 120 , 130 ) involving access to said access-controlled points;

divide a portion ( 138 ) of the access events database into shares ( 140 A, 140 B, 140 C), wherein the portion of the access events data contains evidence of a malfunctioning device, the evidence of a malfunctioning device comprising evidence of at least one of:

physical damage to the malfunctioning device, and

faulty performance of the malfunctioning device; and

pass the respective shares to respective third party servers ( 44 A, 44 B, 44 C), wherein the dividing and passing the shares to the third party servers limits effects of potential data compromise.

12. The system of claim 11 wherein:

the plurality of credential devices includes smartphones and RFID cards or badges.

13. The access control system of claim 11 wherein:

each of the plurality of readers is at an associated access point of said plurality of access-controlled points.

14. The system of claim 11 wherein:

the one or more servers are configured to receive further processed output from the third party servers as processed by a further server and wherein the one or more servers are configured to identify the malfunctioning device.

15. A method for using an access control system ( 20 ), the access control system comprising:

a plurality of credential devices ( 24 );

a plurality of readers ( 26 ) at access-controlled points at a plurality of buildings for reading the credential devices; and

one or more servers ( 30 , 32 ) coupled to the readers and programmed to:

maintain an access events database ( 120 , 130 ) involving access to said access-controlled points;

divide a portion ( 138 ) of the access events database into shares ( 140 A, 140 B, 140 C), wherein the portion of the access events data contains evidence of a malfunctioning device, the evidence of a malfunctioning device comprising evidence of at least one of:

physical damage to the malfunctioning device, and

faulty performance of the malfunctioning device; and

pass the respective shares to respective third party servers ( 44 A, 44 B, 44 C), the method comprising:

maintaining, by the one or more servers, the access events database;

dividing, by the one or more servers, the portion of the access events database into the shares; and

passing, by the one or more servers, the respective shares to the respective third party servers, wherein the dividing and the passing the shares to the third party servers limits effects of potential data compromise.

16. The method of claim 15 further comprising:

the plurality of credential devices includes smartphones and RFID cards or badges.

17. The method of claim 16 wherein:

the portion of the access events data contains credential holder identifying information.

18. The method of claim 15 further comprising:

receiving, by the one or more servers, further processed output of the third party servers as processed by a further server and wherein the one or more servers are used to identify the malfunctioning device.