INTEGRATED PHYSICAL AND LOGICAL SECURITY MANAGEMENT VIA A PORTABLE DEVICE

Abstract

Integrated physical and logical security management is extended to a mobile device, such as a portable wireless device or radio. The Mobile-IMPACT solution extends the reach of authorized users to handheld devices for monitoring, managing and/or controlling of IT/network and physical security. Allowing authorized users to view and control access events while not in their office and logged into their console, mobility within and outside of a facility or campus organization no longer requires a laptop computer. With new handheld technologies more widely accessible and dropping in price while still gaining additional functionality, a chief security officer and their security staff can now monitor access to their building/doors/control zones, look-up user and card information, trigger queries/reports, set new alarm conditions and monitor sensors or a perimeter from a handheld device anywhere in the world using an electronic communication medium, such as a PDA, cell phone, radio, or the like.

Claims

1-58. (canceled)

59. A system comprising: a server having a non-transitory computer readable storage media including instructions to enable the server to: receive a request from a mobile device, said request comprising an identifier and location information; authenticate a user of the mobile device based on at least one of said identifier and said location information; cause to be displayed on the mobile device access information corresponding to one or more registered users, wherein said access information is associated with at least one of a logical access control device and a physical access control device at one or more physical locations; and enable the user of the mobile device to edit at least some of said access information.

60. The system of claim 59, wherein said identifier is uniquely associated with said mobile device.

61. The system of claim 59, wherein said identifier is uniquely associated with said user.

62. The system of claim 59, wherein said instructions further enable the server to cause to be displayed on the mobile device information corresponding to one or more cameras at one or more of said physical locations.

63. The system of claim 62, wherein said instructions further enable the server to enable the user of the mobile device to control at least one of said one or more cameras.

64. The system of claim 59, wherein said instructions further enable the server to provide an alert to said mobile device.

65. The system of claim 64, wherein said alert is associated with said location information.

66. The system of claim 59, wherein said instructions comprise instructions that are configured to be executed in response to a command from said mobile device.

67. A method comprising: receiving a request from a mobile device, said request comprising an identifier and location information; authenticating a user of the mobile device based on at least one of said identifier and said location information; causing to be displayed on the mobile device access information corresponding to one or more registered users, wherein said access information is associated with at least one of a logical access control device and a physical access control device at one or more physical locations; and enabling the user of the mobile device to edit at least some of said access information.

68. The method of claim 67, wherein said identifier is uniquely associated with said mobile device.

69. The method of claim 67, wherein said identifier is uniquely associated with said user.

70. The method of claim 67, further comprising causing to be displayed on the mobile device information corresponding to one or more cameras at one or more of said physical locations.

71. The method of claim 70, further comprising enabling the user of the mobile device to control at least one of said one or more cameras.

72. The method of claim 67, further comprising providing an alert to said mobile device.

73. The method of claim 7264, wherein said alert is associated with said location information.

74. A method comprising: configuring a mobile device to manage a converged logical and physical security system, said configuring step comprising: enabling the mobile device to transmit a request, said request comprising an identifier and location information; enabling the mobile device to receive an authentication based on at least one of said identifier and said location information; enabling the mobile device to display access information corresponding to one or more registered users, wherein said access information is associated with at least one of a logical access control device and a physical access control device at one or more physical locations; and enabling the mobile device to provide an interface to a user, wherein said interface is configured to enable a user to edit at least some of said access information.

75. The method of claim 74, wherein said identifier is uniquely associated with said mobile device.

76. The method of claim 74, wherein said identifier is uniquely associated with said user.

77. The method of claim 74, wherein said configuring step further comprises enabling the mobile device to display information corresponding to one or more cameras at one or more of said physical locations.

78. The method of claim 77, wherein said configuring step further comprises enabling the mobile device to control at least one of said one or more cameras.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0081] The exemplary embodiments of the invention will be described in detail, with reference to the following figures, wherein:

[0082] FIG. 1 illustrates an exemplary security system according to this invention;

[0083] FIG. 2 illustrates in greater detail the relationship between the mobile client, business logic and data according to this invention;

[0084] FIG. 3 is a hybrid flowchart and system architecture diagram that shows data flow according to an exemplary embodiment of this invention;

[0085] FIG. 4 illustrates an exemplary method of exchanging commands between a mobile device and the CRITSEC server(s) according to this invention;

[0086] FIGS. 5-17 illustrate exemplary screen captures of a user interface on the mobile device running Mobile-IMPACT according to an exemplary embodiment of this invention;

[0087] FIG. 18 is a flowchart outlining an exemplary method for the mobile management of the converged logical and physical security system according to this invention;

[0088] FIG. 19 illustrates an exemplary method for generating an alert on the mobile device according to this invention; and

[0089] FIG. 20 illustrates another exemplary alert method according to this invention.

DETAILED DESCRIPTION

[0090] The exemplary embodiments of this invention will be described in relation to communications systems and security systems. However, it should be appreciated, that in general, the systems and methods of this invention will work equally well in other types of communications environments, networks and/or protocols and with various logical and physical security systems.

[0091] The exemplary systems and methods of this invention will also be described in relation to wired and/or wireless communications devices, such as mobile devices, PDA's, cellular phones, radios, Blackberry, mobile computers, laptops, tablet PC's, and the like. However, to avoid unnecessarily obscuring the present invention, the following description omits well-known structures and devices that may be shown in block diagram form or are otherwise summarized or known.

[0092] For purposes of explanation, numerous details are set forth in order to provide a thorough understanding of the present invention. It should be appreciated however that the present invention may be practiced in a variety of ways beyond the specific details set forth herein.

[0093] Furthermore, while the exemplary embodiments illustrated herein show the various components of the system collocated, it is to be appreciated that the various components of the system can be located at distant portions of a distributed network, such as a communications network and/or the Internet, or within a dedicated secure, unsecured, and/or encrypted system. One or more of the various components/modules could also be converged into one or more of the other illustrated components/modules, such as the smart card reader/writer and/or biometric reader included in the mobile device.

[0094] Thus, it should be appreciated that the components/modules of the system can be combined into one or more devices, such as a security system, mobile device, radio, incident management perimeter access control and tracking system, CRITSEC system and the like. As will be appreciated from the following description, and for reasons of computations efficiency, the components of the systems can be arranged at any location within a distributed network without affecting the operation thereof. One or more functional portions of this system could also, for example, be distributed between a mobile device and an associated CRITSEC system.

[0095] Furthermore, it should be appreciated that the various links, including the communications channels connecting the elements can be wired or wireless links or any combination thereof, or any other known or later developed element(s) capable of supplying and/or communicating data to and from the connected elements. The term module as used herein can refer to any known or later developed hardware, software, firmware, or combination thereof, that is capable of performing the functionality associated with that element. The terms determine, calculate, and compute, and variations thereof, as used herein are used interchangeably and include any type of methodology, process, technique, mathematical operation or protocol.

[0096] FIG. 1 illustrates an exemplary security system 1 according to this invention. The security system 1 includes an IT/network and physical security management system (CRITSEC) 100, an incident management perimeter access control and tracking system (IMPACT) 100, and one or more mobile devices 50 interconnected by one or more networks 10 and links 5. The mobile devices 50 can also be connected to or include one or more of a smart card reader 52, a biometric reader 54, and can optionally access the network 10 via, for example, a wireless access point 56. Each of the mobile devices 50 are capable of running a Mobile-IMPACT application for which an exemplary interface can be seen on the screen of mobile device 58. As discussed in the related application, CRITSEC 100 can manage one or more of identity proofing, credential issuance, factors of authentication, biometrics, sensors, both onboard and outboard, GIS/GPS systems, access control readers, cameras/video, sensors, enterprise IT security, enterprise facility security, alarm systems, networks, incident management systems, situational awareness suites/dashboards, identity management systems and metadata, directory services, door readers, time and other physical access devices, computer/network access, and the like 110.

[0097] As illustrated in FIG. 2, the mobile devices 50, or mobile clients, can include a data presentation module, one or more plug-ins 208 and a command handling module 210 which are connected to the CRITSEC 100 that can include, for example, a logical and physical access control decisions module 102, a command processing module 104, an authorization checking module 108, and an event handling module 106. These systems can have access to one or more databases 202 as well as configuration files/registry information 204. As illustrated, these systems have access also to outside resources 110, such as cameras, internet resources, and the like as described above. While not illustrated, each system can also include one or more processors, controllers, memory and storage as appropriate.

[0098] In operation, the mobile devices 50 are provided with the ability to manage any aspect of CRITSEC 100 or IMPACT 200 remotely. This can have significant advantages, some of which are discussed above in the summary of the invention.

[0099] For example, a user with a mobile device 50, provided they have communications connectivity, can one or more of: configure users or user settings in CRITSEC 100, configure or manage the controller in the CRITSEC 100, view, edit and/or export logs as well as view one or more of cameras and sensors as well as control the same via, for example, pan/tilt/zoom controls.

[0100] More specifically, and in accordance with an exemplary embodiment, an API runs on the mobile device 50 that provides an interface, such as that shown in 58 as well as FIGS. 5-17. A user, after logging in and being authenticated to CRITSEC 100, can access one or more of the above functions via an associated interface for CRITSEC management. For example, if the user and mobile device 50 would like to view or configure a user or user settings, in cooperation with the command handling module 210, plugins 208, and the data presentation module 206, a list of users can be provided on the mobile device 50. From this list, a user can select to manage or view a particular user, display user information, and optionally display logical access information associated with the user, optionally display card information including card details and access groups associated with the user, as well as perform editing, deleting, or other management of any of the above portions of information. This can all be done, as described hereinafter, through the use of the Mobile-IMPACT interface 58 running on the mobile device 50.

[0101] In a similar manner, the mobile device 50 provides access to controller configuration within CRITSEC 100. In general, a user via the mobile device 50 can elect to select and connect to a specific controller. Controller information can then be displayed and the user provided with the ability to view door/reader groups as well as the ability to edit the door/group information or in general any controller functionality.

[0102] Log information in CRITSEC and/or impact 200 can also be accessed via the mobile device 50 with the Mobile-IMPACT interface 58, again with the cooperation of the command handling module 210, plugins 208 and data presentation module 206 to one or more of open the logs, view the logs, change display characteristics or sort order of the logs, as well as the option to export the logs, such as to an e-mail, printer, other device, or the like.

[0103] The Mobile-IMPACT interface 58 also gives the user of mobile device 50 the ability to access one or more cameras and/or sensors associated with CRITSEC 100. If the camera is provided with controls, the user can also access these, such as pan, tilt, zoom, as well as view the feeds therefrom.

[0104] As will be discussed hereinafter, it is to be appreciated that various rules and policies can be associated with any of the above activities based on, for example, a user profile, whether or not the mobile device 50 has been authenticated to CRITSEC 100, and in general any security measures put in place to ensure the user mobile device 50 is actually authorized to manage CRITSEC 100 and/or impact 200.

[0105] Due to the lack of LDAP and active directory support in most handheld devices, such as phones, radios, PDAs, and the like, and the optional requirement of keeping the TCP port requirement low for mobile devices 50, an exemplary embodiment of this invention utilizes a set of commands that the mobile application running on the mobile device 50 can use to retrieve and manage data that would otherwise be impossible to retrieve. In accordance with an exemplary embodiment, these commands comprise an identifier of the command, e.g., name or number, so the CRITSEC 100 is aware of what the client is trying to perform, and one or more parameters needed by CRITSEC 100 to execute the command.

[0106] For example, to reset a user's password, instead of connecting via LDAP/active directory or another directory service and issuing the required command from the mobile device 50 which would require additional ports to be opened and require the mobile device 50 to support LDAP/active directory protocol or have the protocol ported to the particular device, the mobile device 50 could send a special command that would be understood by CRITSEC 100, with this command including an identifier, for example, any value, and parameters including, for example, the command issuer's user name, command issuer's password, which could be used optionally for authorization, the user's whose password is to be changed, and the password that will be set.

[0107] CRITSEC 100 could then make the modification to its active directory or other directory service with CRITSEC 100 understanding the command nomenclature used by the mobile device 50. As will be discussed hereinafter, this command management will be discussed in greater detail in relation to FIG. 4, which is directed toward the exemplary functionality of the command handling module 210 and command processing module 104.

[0108] FIG. 3 illustrates an exemplary data flow of the security system 1. In particular, a command is sent from the mobile device in step S300 to the CRITSEC server in step S304. This is accomplished in cooperation with one or more of the command handling module 210, plugins 208 and data presentation module 206. Furthermore, this communication can be done in accordance with TCP/IP protocols with possible encryption optionally set by CRITSEC 100.

[0109] Upon receipt of the command in the CRITSEC server 304, and in cooperation with the command processing module, logical and physical access control decisions module 102 and authorization checking module 108, command processing is performed in step S306, with the first command being processed being authentication. More specifically, authentication processing is performed in step S308, with the cooperation of the LDAP/active directory/directory services S310 and access lists S312. As can be appreciated, the security system 1 can optionally be configured such that the only commands that will be initially processed until authentication has been completed are authentication request commands. Once authentication is complete, the mobile device 50 can send one or more of physical access control commands in step S314, logical access control commands in step S322, and CRITSEC specific commands in step S338.

[0110] More specifically, if the mobile device 50 sends physical access control commands in step S314, an optional check can be performed in step S316 to ensure the user and/or the mobile device 50 is authorized to perform that command. For example, in step S318, the groups that are allowed to issue the command in question are retrieved. Then, in step S320, a check is made to determine whether the user/mobile device belongs to one of the allowed groups through, for example, a directory service like LDAP/active directory. A determination is then made in step S322 whether the user is authorized to perform the command. If the user/mobile device is authorized to perform the command, control continues to step S328 with control otherwise jumping to step S324. In step S324, the failed attempt to execute the command can be logged and, in step S326, an optional event sent to the event handling module 106.

[0111] In step S328, and in cooperation with the command processing module 104, the physical controller command can optionally be changed based on the destination controller the command is intended for. Then, in step S330, the command can be executed and, if necessary, a result returned to the client at mobile device 50. Control then continues to step S375 where control returns to the CRITSEC server.

[0112] In step S322, a user has sent a command for logical access control. Next, in step S334, and in cooperation with the command processing module 104, the command can optionally be converted as needed, for example, based on a directory service like active directory/LDAP. Then, in step S336, the command can be sent to the directory service and result returned to the client, if required. In this illustrative example, the authorization and logging can be handled by the directory service with control continuing to the CRITSEC server in step S375.

[0113] In step S338, a user has issued a CRITSEC specific command from the mobile device 50. In step S340, an optional check can be performed to ensure the user is authorized to perform the command. Next, in step S342, the groups that are allowed to issue the command are retrieved and in step S344, a check to determine whether the user requesting the command belongs to one of the allowed groups. Similar to the above embodiment, this can be performed through a directory service like LDAP/active directory. In step S346, a determination is made whether the user is authorized. If the user is authorized, control jumps to step S352 with control otherwise continuing to step S348. In step S348, the failed command attempt can optionally be logged within step S350 and an event, with cooperation of the event handling module 106 sent to the event handler.

[0114] In step S352, a command is executed and any necessary results returned to the client with control continuing to step S375.

[0115] In step S380, communication, such as TCP/IP with possible encryption is established with Mobile-IMPACT 382. Then, in step S384, and optionally in cooperation with the command handling module 210, mobile device 50 performs command processing based on commands/data/other information from the CRITSEC server in step S375. For example, in step S386, an alert command has been sent to the mobile device 50 which, when read by the command handling module 210, and in cooperation with one or more of the plugins 208 and the data presentation module 206, can generate an appropriate interface corresponding to the alert then, for example, in step S388 format a string and insert one or more links to specific parts of the application based on the event type.

[0116] For example, if the alert has to do with a user trying multiple times to gain access through a door, and those access attempts having failed and number of attempts reaching a threshold, links can be provided in the alert that allow the user to immediately view a camera feed of that door as well as the log information so the user at the mobile device 50 is aware of what access credentials/factors and associated biometrics the user is attempting to use to gain access to the door. In addition, and optionally in step S390, control of the mobile device 50 can be further manipulated by the alert command, such as turning the screen on, vibrating, playing an audio or visual alert queue, and displaying alert information, as in step S392.

[0117] In step S394, one or more of command, data and information have been returned to the mobile device with, in step S396, requesting plugin being informed of the result. As discussed, this result can be data, video feed, sensor information, user information, or in general any information relating to the security system 1. Then, in step S398, the plugin 208, in cooperation with the data presentation module 206, displays the requested data, message, information, or the like.

[0118] Event handling occurs with the cooperation of the event handling module 106, and one or more of the other modules as illustrated, for example, in FIG. 2. For example, if an event occurs, e.g. a physical, logical, or other event, such as failed login attempt, in step S377, the event can optionally be logged. Then, in step S378, a determination is made whether the event is significant enough to trigger an alert. It should be appreciated, that a single event could be configured to trigger an alert, multiple events of the same type, or a combination of events when looked at in totality be the trigger for an alert. If an alert is required, in step S379, an alert command is sent to the CRITSEC server S375 which, as previously discussed, can forward the alert to the mobile device 50.

[0119] As mentioned earlier, for mobile devices that do not include the ability to perform LDAP or active directory services, an architecture needs to be established that allows communication between the mobile device and the CRITSEC 100. An exemplary method of performing this command exchange and translation is shown in FIG. 4.

[0120] More specifically, in step S400, a user requests an action on the mobile device. Next, in step S410, the mobile device uses, for example, a CRITSEC API, to generate a code number/name that corresponds to the requested action and can be formatted such that the appropriate data and/or parameters are included therewith. Then, in step S420, the assembled command is sent to the CRITSEC server. Control then continues to step S430.

[0121] In step S430, the command is received by the CRITSEC server. Next, in step S440, the code name/number is looked-up in a code table, such as that illustrated in the example code table 4. Control then continues to step S450.

[0122] In step S450, a determination is made whether a match is found in the code table. If a match is not found, in step S455 an unknown command message can optionally be returned to the mobile device. Otherwise, in step S460, the command associated with the action or request is executed and parameters passed. Then, in step S470, a determination is made whether all parameters that are needed to execute the command have been provided and are valid. If the answer to this decision is no, control continues to step S475 where an invalid parameter message can optionally be returned to the mobile device. Otherwise, control continues to step S480 where the command is executed and result returned with data to the mobile device which is then displayed in step S490.

[0123] For example, in step S480, the server can connect to the active directory/LDAP, retrieve information from a database, update a controller configuration, update a user or a user configuration, or the like, and one or more of a confirmation, additional information, or the like, as appropriate, return to the mobile device is step S490.

[0124] The example code table 4 illustrates various example codes corresponding to exemplary action requests. For example, in example code table 4, code name 1000 is associated with a resetting password action. Code number 1001 is associated with an ad get child objects action. Code number 1002 is associated with an update card action. Associated with each of these code numbers, there is a description of the method name which is executed, a description of the method, what is returned to the mobile device, and a summary of the data being modified and/or data location.

[0125] FIGS. 5-17 illustrate exemplary screen captures on a mobile device 50 according to an exemplary embodiment of this invention. In this particular exemplary usage scenario, a user logs in, performs various functionality on the CRITSEC server, receives a video feed, and, in FIG. 17, receives an alert.

[0126] More specifically, in FIG. 5, an interface is provided on the mobile device 50 where the user provides the login credentials to login to the CRITSEC 100. These can be the same credentials that the user uses for active directory login and to login to CRITSEC directly. The CRITSEC server field can optionally be provided with the IP address or host name of the CRITSEC the user will be logging into, in the event there is more than one. As discussed above, and as a security feature, one or more portions of the application can be disabled until the user has logged in and been authenticated to prevent someone who is not authorized from being able to access, change, or view secure information.

[0127] FIG. 6 illustrates an exemplary configuration area of a CRITSEC located at IP address 610. A list of users 620 is illustrated that belong to the server/domain associated with the IP address 610. In this particular example, user Craig Morehouse has been selected, so the user of the mobile device can retrieve and/or edit information associated with that particular user.

[0128] In FIG. 7, basic user information associated with user 630 is displayed including the selected user's first and last name 710, as well as the description entered for the user 720. The interface also illustrates the user's access type 730 whether they have rights to enter the facility, log on to the computer system, or both. The user who is logged on to the application may not have the ability to access edit functionality associated with this user, which is why in FIG. 7, the field are grayed out as being read-only. If the user viewing this user's data had appropriate permissions, these fields could obviously be editable.

[0129] FIG. 8 illustrates an exemplary interface where a user has selected the logical info tab 740 from FIG. 7. In this interface, the details that the user uses to log on onto the computer system are shown. For example, user name 810, expiration date 820, and indication whether the account is disabled or locked 830, as well as a list of allowed computers 840 are shown in the interface. A user with the appropriate permissions could obviously disable the user from being able to log in by selecting the disable button or, for example, unlock their account if the user mistakenly entered their password incorrectly to many times.

[0130] FIG. 9 illustrates an exemplary user interface that can be displayed when the user selects the cards tab 750 from FIG. 7. The cards tab shows the cards that belong to the user Craig Morehouse and in accordance with this exemplary embodiment, it can be seen that the user only has one card 910 and that one card is only granted access to one facility Denver CRITSEC. The user of the mobile device can then select the card and click the view button 920 to view/edit information about the card.

[0131] More specifically in FIG. 10, additional information associated with the card 910 is shown. In interface 1010, various information such as the access type, card identifier, escort ID, card number, start date, end date, and the like, and in general any information associated with the card, can be displayed. This interface also allows a user to determine what groups this user/card is associated with for physical access, by clicking on the access group tabs 1020.

[0132] FIG. 11 illustrates the various groups the user/card is associated with and, as can be seen, this exemplary user is associated with the general and sales groups.

[0133] FIGS. 12-14 illustrate exemplary methods for configuring a controller according to this invention. In particular, the interface in FIG. 12 illustrates that the user has moved to the controller configuration area, where the user is looking at the list of controllers available for connection, and has selected Denver CRITSEC 1220. Upon selection of one of the available controllers 1210, information about that controller can be displayed in interface portion 1230 with information such as device name, IP address, MAC address, port information, and the like, shown. This information can be minimized, for example, by clicking on the up arrow 1240.

[0134] Although partly obscured, when the user selects the door groups tab 1250 in FIG. 12, the exemplary interface in FIG. 13 can be displayed. This interface shows the door groups 1310 that are part of the Denver CRITSEC controller. If a user selects outside doors 1320, information about the outside door group is displayed in interface shown in FIG. 14. From the interface in FIG. 14, it can be seen that the group outside doors 1320, has an associated description 1410 and readers 1420.

[0135] FIG. 15 illustrates an exemplary interface associated with log viewing. For example, the interface 1510 includes type information, event information, data and time information, and in general any information associated with one or more events. As previously discussed, this information can be sorted by selecting any of the tabs at the interface 1510 as well as exported, printed, copied into an e-mail, forwarded to another destination, sent to forensics in a tamperproof manner, or the like.

[0136] FIG. 16 illustrates an exemplary interface where the user has requested to view four camera feeds 1610-1640. The user can add or subtract any number of feeds from the interface illustrated in FIG. 16, and for certain cameras that may have an ability to be controlled via pan/tilt/zoom controls, these controls can also be populated and selectable by the user via the interface for control of that camera.

[0137] The interface in FIG. 17 illustrates an alerting screen that includes information unique to the security system. For example, the Mobile-IMPACT application can run in the background when the user is not using it, and still receive messages, such as instant messages and alerts from the CRITSEC server, for example, when there is an alert. The message can optionally appear and play sound, vibrate, or otherwise notify the user that they have an alert, and this alert can override other applications running on the mobile device. For example, if the screen of the mobile device is turned off, the alert can turn the screen on for the user thereby providing the user with the ability to work on other applications while still being able to monitor their security infrastructure.

[0138] In this particular example, there is an alert 1710 illustrated on the interface. The alert includes event information, date information, card information, name information, controller information, as well as the reader information. In addition, relevant links can be provided 1720 and 1730 that allow a user immediate access to management operations that may be associated with the alert. These links 1720 and 1730 can be dynamically created based on the type of the alert, the severity of the alert, type of event, or in general, based on any information associated with the alert.

[0139] FIG. 18 illustrates an exemplary method of utilizing the Mobile-IMPACT application. In particular, control begins in step S1800 and continues to step S1810. In step S1810, a user logs in. As previously discussed, this could be an initial authentication with, depending on the nature of the requested action, additional authentication, passwords, or the like required. Once a user logs in, a user has the option of configuring and/or viewing user information in step S1820, controller configuration in step S1830, viewing log information in step S1840, and/or accessing cameras/sensors in step S1850. If a determination is made that the user would like to access user information in step S1820, control jumps to step S1822. If the user is requesting controller configuration in step S1830, control jumps to step S1832. If the user is requesting log information, control jumps from step S1840 to step S1842. If the user is requesting camera and/or sensor information in step S1850, control jumps to step S1852.

[0140] More specifically, in step S1822, one or more user lists can be provided. Next, in step S1824, a specific user can be selected for management and/or credential viewing. Then, in step S1826, information relating to the user is displayed. Control then continues to step S1827.

[0141] In step S1827, logical access information associated with the user can optionally be displayed. In step S1828, card information including card details and access groups can optionally be displayed. In step S1829, a user, provided they are authorized to perform editing, can be allowed to edit one or more of the above pieces of user-specific information. Control then continues to step S1899 where the control sequence ends.

[0142] In step S1832, a controller is selected and the mobile device connected thereto. Next, in step S1834, controller information can be displayed, within step S1836 one or more door and reader groups information optionally viewed. Similarly, and again depending on user authorizations, door and/or group information can optionally be edited in step S1838.

[0143] In step S1842, one or more logs are opened. Then, in step S1844, the logs can be viewed with the display characteristics thereof changed and/or sorted as provided in step S1846. In step S1838, the user is provided with the option of exporting and/or forwarding the log with control or to forensics continuing to step S1899, where the control sequence ends.

[0144] In step S1852, a user has requested access to one or more cameras and/or sensors. Upon access, information relating to the sensors and/or video and/or audio feed associated with one or more cameras can be displayed on the mobile device. Furthermore, in step S1854, an option is provided that allows the user to control pan, tilt, and/or zoom functionality associated with the one or more cameras. In a similar manner, although not illustrated, if the sensors have an associated control, the sensors can also be manipulated by the mobile device.

[0145] FIG. 19 illustrates an exemplary method of alerting a mobile device according to this invention. In particular, control begins in step S1900 and continues to step S1910. In step S1910, mobile alerting can be configured on the CRITSEC that allows for mobile alerts to be sent to one or more mobile devices. Once this configuration has been established, in step S1920, a determination is made whether a triggering event or combination of events has been satisfied. If a triggering event has not been satisfied, control continues to step S1930 where the system is continually monitored with control jumping back to step S1920. If a triggering event, or combination of events has been met, in step S1940, an alert command is sent to the mobile device(s). Once this command for an alert has been received at the mobile device, the command can optionally override local applications, services, or the like, on the mobile device to display the alert and information associated therewith in step S1950. As previously discussed, this alert can also include dynamic hyperlinks based on the alert that may be relevant to the user based on the nature of the event. Control then continues to step S1960 where the control sequence ends.

[0146] The interface in FIG. 20 illustrates another exemplary alerting screen that includes information unique to the security system. In this particular example, there is a colored (an optionally flashing) alert box 2010 illustrated on the interface. The alert 2020 includes event information, date information, card information, name information, controller information, as well as the reader information.

[0147] The above-described methods and systems and can be implemented in a software module, a software and/or hardware module, a security management device or interface, a wired and/or wireless wide/local area network system, a satellite communication system, network-based communication systems, such as an IP, Ethernet or ATM system, ROM, or the like, or on a separate programmed general purpose computer having a communications device or in conjunction with a wired or wireless communications protocol.

[0148] Additionally, the systems, methods and protocols of this invention can be implemented on a special purpose computer, a programmed microprocessor or microcontroller and peripheral integrated circuit element(s), an ASIC or other integrated circuit, a digital signal processor, a flashable device, a ROM, secure ROM, a hard-wired electronic or logic circuit such as discrete element circuit, a programmable logic device such as PLD, PLA, FPGA, PAL, any comparable means, or the like. In general, any device capable of implementing a state machine that is in turn capable of implementing the methodology illustrated herein can be used to implement the various methods, protocols and techniques according to this invention. While the systems and means disclosed herein are described in relation to various functions that are performed, it is to be appreciated that the systems and means may not always perform all of the various functions, but are capable of performing one or more of the disclosed functions.

[0149] Furthermore, the disclosed methods may be readily implemented in software using object or object-oriented software development environments that provide portable source code that can be used on a variety of computer or workstation platforms. Alternatively, the disclosed system may be implemented partially or fully in hardware using standard logic circuits or a VLSI design. Whether software or hardware is used to implement the systems in accordance with this invention is dependent on the speed and/or efficiency requirements of the system, the particular function, and the particular software or hardware systems or microprocessor or microcomputer systems being utilized. The systems, methods and protocols illustrated herein can be readily implemented in hardware and/or software using any known or later developed systems or structures, devices and/or software by those of ordinary skill in the applicable art from the functional description provided herein and with a general basic knowledge of the computer and security arts.

[0150] Moreover, the disclosed methods may be readily implemented in software that can be stored on a computer-readable storage medium and/or ROM, executed on programmed general-purpose computer with the cooperation of a controller and memory, a special purpose computer, a microprocessor, or the like. In these instances, the systems and methods of this invention can be implemented as program embedded on personal computer such as an applet, API, JAVA or CGI script, as a resource residing on a server or computer workstation, as a routine embedded in a dedicated communication system or system component, or the like. The system can also be implemented by physically incorporating one or more portions of the system and/or method into a software and/or hardware system, such as the hardware and software systems of mobile device.

[0151] While the invention is described in terms of exemplary embodiments, it should be appreciated that individual aspects of the invention could be separately claimed and one or more of the features of the various embodiments can be combined.

[0152] While the systems and means disclosed herein are described in relation to various functions that are performed, it is to be appreciated that the systems and means may not always perform all of the various functions, but are capable of performing one or more of the disclosed functions.

[0153] While the exemplary embodiments illustrated herein disclose the various components as collocated, it is to be appreciated that the various components of the system can be located at distant portions of a distributed network, such as a telecommunications network and/or the Internet or within a dedicated communications network. Thus, it should be appreciated that the components of the system can be combined into one or more devices or collocated on a particular node of a distributed network, such as a communications network. As will be appreciated from the following description, and for reasons of computational efficiency, the components of the communications network can be arranged at any location within the distributed network without affecting the operation of the system.

[0154] It is therefore apparent that there has been provided, in accordance with the present invention, systems and methods security system access and management. While this invention has been described in conjunction with a number of embodiments, it is evident that many alternatives, modifications and variations would be or are apparent to those of ordinary skill in the applicable arts. Accordingly, this disclosure is intended to embrace all such alternatives, modifications, equivalents and variations that are within the spirit and scope of this invention.