IoT - How it Works in Access Control

Internet of Things - How it Works in Access Control 

The "Internet of Things" precisely known as IoT is an integrated network of intelligent computing devices connected through the internet to communicate with each other without any human interference.

What is IoT?

The Internet of Things (IoT) is a technological concept of connecting multiple devices that have the possibility of switching on and off the web in order to use software and automation processes for smart living. IoT is an innovation that changes the way we organize our lives at home and at work, as well as the way we move and use transportation means and manage industrial machinery. Any object, even people, in terms of smartphones and wearables, can be a part of the IoT grid.

The IoT is not limited to computers or other most common devices used for web connections. It’s typical to expect a desktop, a tablet, and a mobile to find their place in the IoT, but the concept encompasses way more. For example, smart vehicles, whose navigation systems depend on a computer dashboard connected to the web can be part of the Internet of Things. Any equipment that can support the smart sensor technology is viable for the IoT environment.

It’s not too difficult to imagine how the IoT grid is and how it will be transforming our workplaces. The Internet of Things at work enables smart buildings that automate business processes and improve security. In a way, IoT office solutions are a bridge from the physical to the virtual workplace.

Taking the physical information and transforming it into virtual data via IoT sensors results in the ability to manage many processes from anything that has a computer processor. Although we haven’t exhausted all IoT ideas for offices, many organizations have benefited from accepting the basics of the concept, creating smart lighting and aircon systems, as well as smart access control systems.

The access control mechanisms restrict unauthorized users from accessing the system by introducing appropriate mechanisms. Data sharing is the process of exchanging information among IIoT users. The access control and data sharing strict the legitimate users can only exchange their data. The access control defines which type of users can access the information of the particular IIoT system and is permitted to perform the control activities.

Internet of Things Ecosystem

IoT is a new concept of integrated network of different kinds of computing devices in the field of information technology. It is based on the IP network in which every individual machine used in manufacturing, security, transportation, and other fields of our day-to-day life is assigned a unique IP to communicate with each other.

Every machine/device is connected with the related sensors, which trigger the control system to issue instructions to a particular machine for some action to perform automatically. This network can communicate through both wireless and wired internet connectivity.

How is IoT used in access control system?

Internet of things is a backbone of modern IoT access control system commonly known as intelligent door locking systems. In this system, every lock, lock access controller, card reader and other associated devices are assigned a separate IP address, which is used for communication among the devices.

In a single building, all those intelligent machines are normally connected through wireless networks to their consolidated management software or mobile application. These applications can be configured for automatic as well as manual operation of different locks and controllers. The security alerts and notifications can also be configured to receive on mobile apps in real time.

Each device/machine is configured for its operating conditions, criteria, sensitivity and authority in core management control software, which is used as controller of the entire system. A duplicate control of this system is used as a mobile app on your mobile devices too; you can receive the status of your access system and you can also issue instructions from your app. Any malicious activity in your access system generates an alert and detailed notification on your mobile app or main management software controller.

What products use it?

Internet of things is used by thousands of types of products in general and almost all parts of the IoT security system commonly used in modern buildings. In access control, intelligent locks, card readers, keypads and other related devices use the technology behind the concept of the internet of things.

Every authorized mobile device also uses its unique IP address in the network to get an access into the main controller for using the intelligent locking system. The main server also has a unique IP address to establish iot communication among the components of entire IoT access control ecosystem.

Advantages of IoT in Access Control

The main benefits of using IoT security system based on IoT include:

- Fully integrated and highly intelligent system

- Accessible from anywhere around the world

- Capabilities to configure for different level authorities

- Can be used for both automatic and manual operations

- Easy to track the records of events

- A comprehensive approach towards secure life

Disadvantages of IoT in Access Control

The main disadvantages of using IoT access control system include:

- Certain hacking and security related issues still persist

- Not so mature technology

- Complex and costly

The nodes maintain an access control list that includes information about IoT devices, users, and associated access levels. Generally, the IIoT is formed using a group of embedded devices like sensors, cameras, and actuators to achieve a specific task. Designing access control and data sharing in such environments are very challenging owing to limited resources and heterogeneity. Context awareness, inter-domain operation, privacy assurance, resource efficiency, manageability, and accountability are some of the requirements of IIoT access control. The access control strategies are categorized into rule-based, capability-based, user control, and attribute-based.

The phrase “knowledge is power” has been taken to a whole new level by IoT technology that has been adapted in diverse areas. Governments have implemented the use of IoT devices in their activity processes such as the use of military drones while IoT devices are used by healthcare facilities and hospitals to provide high-quality healthcare services.

While smartphone and computers have been around for a long time, IoT is a relatively new phenomenon. Therefore, manufacturers and software developers have had sufficient time to address the susceptibilities pertaining to their data breach. IoT devices, alternatively, are extremely useful and come with various capabilities. Manufacturers still encounter problems such as dearth of passable hardware that is strong enough to examine and encode data yet trivial enough to fit inside the restricted space. Cybercriminals can access your home Wi-Fi network through such indiscreet devices and use the opportunity to watch your home surveillance camera to carry out a crime.

The fundamental purpose of implementing IoT devices across numerous segments is to create a completely cohesive smart city. With this integration, any device used in a manufacturing industry can link to another being used by government organizations, healthcare providers, trades or even one’s home network. Nevertheless, the law is yet to formulate privacy protection laws that cover all weaknesses across the different sectors. Cybercriminals continue to take advantage of this shortcoming, which results in the loss of revenue already invested into the project.

How to secure IoT networks

Here are some of the steps that can boost the security of your IoT network.

Know your IoT network

The first measure to take to enhanced security is to recognize and learn what you have and what needs to be protected. While it may appear one of the initial and basic steps, many companies tend to ignore this. Having an appropriate list of what’s on your IoT network and updating it frequently is key to security in any IoT network.

An IoT network usually comprises numerous devices and any of these devices can be used as a source to upset an entire IoT network. Organizations should focus on fixing the fundamentals to face the mounting cyber-risks in IoT.

IoT network security architecture

Most of the normally used surveillance devices barely support the wireless network security standards such as WPA2 or WPA3, which makes them highly vulnerable, capable of easily falling into the hands of hackers. Companies find upgradation of all these devices extremely expensive, so they should think about redesigning their network security architecture.

Divide the responsibility

One of the main problems with IoT security is that businesses often end up with security flaws since they have too much to achieve. Organizations that have their own IoT network characteristically purchase or hire paraphernalia and services from numerous services or device providers. Because IoT has to do with all these devices working together in a network, this medley of equipment can open up numerous holes that can be used to disrupt the system.

Setting up one-way connections

Setting up one-way connections is very important in an IoT network. If the endpoints in an IoT network have more privileges, cybercriminals can exploit them for cyberattacks. With the rise in the number of devices being a part of the IoT, the surface area for the invaders to attack is also increasing. Hence, businesses should restrict the skills of these IoT devices for security motives. Frequently, IoT devices are arranged in a way that they can start network connections by themselves. Although this provides much flexibility and other benefits, it can also lead to numerous security problems. By applying the exercise that all IoT devices are able to stay linked or start connections only using network firewalls and access lists will guarantee better safety.

Accepting Real-World Access Control Challenge

I write about change quite a bit because I am fascinated with all of the various elements that make change both interesting and dreaded by most people. To write about a subject, many writers research the subject matter they are tackling. I do this too, but I prefer hands-on experience. Reality changes in a hurry in our business world. What can this principle teach us in the world of convergence security technology?

Plenty, if it means you have the responsibility of delivering sustainable security solutions your customers count on every day. So let’s use a real-life example to more closely examine the tactical side of security. The challenge was to design, sell, install and commission a replacement of a 30-year-old+ mag stripe electronic access control system with a new IP-based system. Now, for plenty of you this challenge is a walk in the park, part of your everyday security business life. For others, it is not — including yours truly. Yes, I have security system integrator experience with a large company and founded an IP video integration company, but it’s been a few years since I strapped on a 33-inch tool belt. Wisdom and waist size have both grown a bit over the years, but that didn’t stop me. I was up to the challenge and charged forward.

Changing the Mindset on Decades-Old Ways

What I know about security technology from an application and elemental building blocks perspective is much different than putting the IP system puzzle pieces together onsite at 5:30 a.m. because the customer opens for business at 11 a.m. Ladders are unsightly, liability increases and the business operations are impacted — not to mention dropping fiberglass from the ceiling tiles into someone’s glass of beer.

The pressure of doing an IP installation properly in the correct sequence, and coordinating other contractors and supplier support while wrestling with old technology, is as close to “ground truth” as you can expect in the civilian world. Schedules and timing are important when you cut over an access control system. The old system has to continue operating while a new system is readied to take over the workload on a very specific date (no pressure here to get it right!). Now add to this the expectation of your customer for a significant operational improvement and you are involved with a bare-knuckle fight with change. Did I mention that I love a good challenge with change?

Here’s how this installation tale began. An acquaintance is a controller for a chapter of a large, well-known fraternal organization that has thousands of chapters worldwide. And he is not just any controller ... he was recognized nationally in 2012 as the best in the country, a guy who knows a thing or two about business and return on investment. He knew I worked in the security field so we started talking about the mechanics and costs of membership-based organizations that restrict/permit access based on bylaws and being current with their dues. Now add some size to this challenge. This particular chapter has approximately 800 male and female members, each with separate requirements.

So how were they managing access privileges? Every year the chapter needed to order new magstripe cards for all its members. This is an old credentials technology, so you can understand some of the cost factors. These credentials had to be replaced every year when membership dues were due. To this cost add the management time for physically handing over a new credential once dues were paid. This process has obviously worked for 30+ years, but what would the future look like for 30-year-old+ magstripe readers and 24VAC electric strikes? How long would they last? Could they even be repaired? How long could they disrupt operations if they did fail? Perhaps it is time to consider a change in electronic access control technology and upgrade the system.

Analyze Your Recommended Technology Applications to Ensure They Are Appropriate

I initially recommended a biometric solution since it would entirely eliminate the cost and management of card credentials. I like cool technology that is affordable and reliable (and I just wrote about this technology a few months ago, noting that it is an obvious solution to recommend).

But not so fast — remember, blindly recommending the application of technology can be dangerous, as well as narrow-minded and myopic. Does this sound like anyone you know or work with perhaps? We all are guilty of sticking with a “true blue” product or supplier because it is the path of least resistance. Guilty as charged.

How can you avoid the automatic product choices in your comfort zone? Ask the right questions. While biometric fingerprint technology is affordable and reliable, it isn’t a panacea. There is a large percentage of chapter membership groups that evolved in the late 1950s, and using new technology can be intimidating and less effective with their older members. Consider the lifetime use of older members’ hands and the gradual deterioration of their skin.

Biometric fingerprint technology has come a long way in the past five years but still has its limitations. What about facial recognition biometrics? Yes, the technology does work better in this application, but consider the perception of the older members and their comfort level of using card credentials for the past 30+ years vs. presenting their face to a reader or camera … it might feel a bit Orwellian, no?

Applying new technology and, more importantly, the right technology means asking your prospect/customer the right questions then considering the impact of change your solution delivers.

In this particular installation challenge, what was the best choice? An RFID credential solution made the most sense from a cost, application and functionality perspective. With several good choices for reliable IP access control systems I chose a new supplier, breaking out of my comfort zone, that I had done some consulting with to test my thinking.

I started by asking the appropriate questions to ensure the technology would fit the application. For example, how simple would it be to manage from a customer’s perspective? How cost effective would it be now and in the future? Once I got the answers I needed, it was time to kick the tires and light the fires.

The hardware and software components were fairly straightforward and not overly complex to process. Actually they were quite simple, and who doesn’t love simple? The documentation gets a C+ in my book and has room for improvement.

The supplier’s customer support in the field at crunch time — you know, when the customer is looking over your shoulder — was an A. The price vs. value delivery was in the A+ range, allowing me to provide additional spare parts and lots of extra credentials, which all IP systems you sell should absolutely have. This will ensure that any future service or maintenance will be fast, which is especially pertinent for electronic access control installations. What other challenges should you consider?

Thanks to Mr. Paul Boucherle for help.