One of the Protagoras's widely-recog­nized aphorisms that when learning the world it makes no sense to seek the starting point beyond the knower. This can and is being disputed but in refer­ence to its natural definition area the specified principle is certainly true: what should be evaluated within the anthropocentrism paradigm shall be measured precisely by this measure.

This is especially obvious within the sys­tems for accessing the banking account, information system or room. A person shall be or shall not be accepted for an object that is allowed or not allowed to him not because he knows, is able to or possesses something but because this is that very person. And everything else - methods and techniques to more or less accurately assure the autho­rized person or the adjusted mechanism of his self-identity. That predetermines aim­ing for the use of biometric authentication never leaving people for good even after the latest campaigns about the cut off fingers and gunmen with the eyes taken out.

In the latest issue of the journal I wrote about of biometric authentication integration into the terminal access sys­tem as a particular case of the biometrics application not for the security improving (the security level rather slightly depends on the fact which attribute precisely is used as a authenticating one) but for improve­ment of the system controllability and its comfortability to the users and managerial staff*. I would like to continue considering this subject and cover some options of "hom-inization" of the access control systems.

INTEGRATION OF SPA UAI AND AMSC

Systems of protection against unauthor­ized access to information (SPA UAI) and the access monitoring and control sys­tems (AMCS) have been designed to solve the same task - control over the access by people (employees and non-employees) to the company resources. The first ones provide protection against unauthorized access to the information resources stored and processed in the information systems and employees' workplaces. The latter -monitoring of the physical access to any of the company (enterprise) objects (facilities).

At the same time the efficient integra­tion thereof is hardly to be found at the informatization objects since the AMCS and SPA UAI are designed, implemented and supported at the local level by special­ists of different profiles and originally for different purposes.

However, it should be recognized that protection of the informatization objects cannot be comprehensive and efficient to the full extent even in the case if the orga­nizational-engineering measures suggest actions on the protection of the automated systems and perimeter but these measures and security modules implementing the specified measures are not interacting.

Let's consider one of the examples. It is obvious that unlocking of the blocked user session and activation of the auto­mated workstation (WKS) are the two pro­cesses that are completely different from the information perspective. Similarly, the pair "session lock - WKS shutoff" is the pair of different events that shall occur under dif­ferent circumstances and elicit different response of the IS-subsystem. It is rather absurd if the system begins to confuse them and shut off the WKS of the user that left for a smoke instead of locking his session or demand for the WKS activation at the shift start the identifier of the use that completed his session the previous evening.

These are different events, they are processed in a different way and that is correct. It is reasonable that quite differ­ent restrictions are set in the SPA UAI for performance of such actions. For example, it is often possible to unlock the session not only by the user of the session but also by the administrator or other user with a similar role (or included into the shared account). In this case the same session is unlocked without interruption. Another situation that may happen by switching on the WKS that was previously shut down: by switching on of the WKS the profile of the user who turns it on will be loaded and not of that who worked as the last one. In order to unlock the session one may set restric­tions in respect of the time during which unlocking is allowed that are completely different from the time during which the WKS is allowed to be switched on (continu­ing operation after expiry of the operating time and switching on the computer dur­ing off-duty hours are completely different sorts of things). Therefore, if before leav­ing his working place a user (accidently or intentionally) did not shut down the WKS but only locked the session, he makes it possible for an intruder to perform any manipulations with his workplace which he would not be able to perform if the WKS would have been shut down in appropriate manner. Such situation cannot be consid­ered as the SPA UAI error or even an error in its settings. Each operation was com­pleted according to the standard procedure, however, a possibility of the incident occur­rence appeared.

This possibility appears due to the fact that the SPA UAI itself is not able to deter­mine which events in the material world accompany one or another event in the information system - if the WKS user left for good or is somewhere nearby, if he was at work today or someone took the identi­fier out his pocket.

Integration of systems for access con­trol, video surveillance and information protection will allow ensuring the new level of the informatization object protec­tion and not result in complications at the same time (and in the common case will lead to a significant simplification) of the system administration, support, servicing and maintenance. The main prerequisite of the specified condition is precisely that the actions of the same people constitute the item monitored by the both systems.

Integration of SPA and AMCS will allow achieving tangible advantages that may be significantly enhanced by applica­tion in the combined system for the employ­ee identification and authentication by the palm blood stream.

Let's give an example of case develop­ment scenario at attempt of an employee to set to work at the beginning of the day in such integrated system on the basis of PAC SPA UAI "Accord" with a biometric reader (scanner of the blood veins in the palm PalmSecure) in which the pattern of the user's biometric indicator is written in the AMCS-card and this very card is registered as the user identifier in the "Accord".

• An employee applies the AMCS-card and this hand at the security control point at the entrance to the enterprise territory.
• The picture of the employee associated with this card is displayed on the guard's screen (on the as well as the results of verifying the blood veins against the pat­tern from the card.
• The guard evaluates the verification result and compares the picture with the employee's face.
• The employee passes to the enterprise territory.
• The information that the employee has passed successfully is forwarded to the control element of the integrated access control system for accounting if the employee attempts to enter one of the enterprise premises.
• Where necessary it is possible to set rules regulating the standard time between passage to the territory and entering the room, to set appropriate response to vio­lation of the specified time.
• Upon entering the room identification by the card and authentification on the basis of biometric verification are also per­formed, thereafter the access control sys­tem waits until the WKS is switched on.
• Upon switching on the WKS SPA UAI "Accord" requests the card and the palm, performs the control procedures on the basis of which the user profile is loaded and the latter may set to work within the frameworks of the assigned privileges as to access to access to the information resources of the system.
• The WKS operation is performed pro­vided that the card is in the reader.
• When the card is removed from the read­er for exiting the room the WKS is locked and unlocking is performed upon repeat­ed submission of the card and the palm.

The system may be additionally com­plicated by the most diverse scenarios (working with controller or team opera­tions, reporting different events, etc.).

In order to implement such system in the OKB SAPR the "Tools for integration with the video monitoring system" (hereinafter referred to as the Tools) have been designed to combine the SPA UAI and AMCS into an integrated system for video monitoring and control of access (SVMaAC) to the automat­ed workplaces (WKS).

The Tools include:

• the SPA UAI and SVMaAC integration server,
• universal hub "Rassvet",
• a suite for integration of SPA UAI with the video monitoring and access control system "Rassvet-SVMaAC".

Upon application of these tools it is possible to integrate the systems at several levels (according to the specific informati­zation tasks):

• integration of the AMCS and SPA UAI identifiers,
• integration of the AMCS and SPA UAI access objects, integrating the equipment for control of access to the WKS AMCS, video monitoring and SPA UAI into a single subsystem.

1) Integration of the employees' per­sonal identifiers used by the them in the

SPA UAI and AMCS will allow reducing the number of incidents related to forget­ting the identifiers, transfer of identifiers to a third person, leaving the identifiers unat­tended while absence of the employee at his workplace as well as to almost exclude the human factor - failure to comply with the requirement to lock the user's workplace at the absence of the user at his workplace.

In order to pass through the AMCS the user needs the identifier which cannot be left in the SPA UAI for the avoidance of locking.

This level of integration at the separate WKS' and entrances into particular rooms may be enhanced by application of the bio-metric authentification (both in the AMCS and SPA UAI). The suggested method of verification by the palm blood vein pattern as an alternative for typing the password from the keyboard allows achieving the two principal advantages: substantial simplifi­cation of administration due to excluding the incidents caused by forgetting the pass­words by the users, improving safety and workplace discipline due to excluding the cases of transfer the passwords and identi­fiers by the users to each other.

This functionality is provided by the universal hub "Rassvet" (as a separate com­ponent or part of the "Rassvet-SVMaAC" suite) and the readers of the relevant identi­fiers that are connected to it.

2) Integration at the level of joining the access objects suggests logical inter­connection of the rooms and computers. This will allow to create the new rules of access both to the PCs and to the rooms which will improve the safety of the infor­matization object as a whole. For a PC will be accessed only provided that the user entered the room in which the relevant computing unit is installed. On the other hand, by exiting the room the AMCS-con-troller will open the door only provided that the user has performed the assigned actions. Thus, the user is allowed to exit the room at any time after having locked the access to the computer by means of a screen saver but he can pass through the AMCS-controller at the building exit only provided that the processes started at the WKS have been completed in appropriate manner. And vice versa, the SPA UAI will not enable access to the information sys­tem if there are no data from the AMCS confirming that the user has entered the enterprise territory, etc. Besides, all the facts of such abnormal situation will be certainly registered and may be (and shall be) analyzed by the security officer.

In order to ensure such interaction it is needed to integrate the control sys­tems AMCS and SPA UAI by means of creating the third control system. This will allow generating the access rules with due regard to the interconnection of the results of accessing the information resources and rooms.

The specified functionality is imple­mented by means of the SPA UAI and AMCS integration server. The specific sets of rules and conditions of combining them are developed separately for each system by the managerial staff.

3) Integration at the level of interaction of the components of AMCS, video moni­toring and SPA UAI into a separate network independent from the basic network for the computer equipment (SVT) interac­tion of the informatization object will allow excluding the possibility of the undesirable effect of the integrated security system pro­cesses on the basic functional system and vice versa. In particular, the load on the communication channel at the moment of forwarding the logs from the subordinated units to the control server, especially by transferring the video stream may signifi­cantly reduce the data transmission rate within the basic functional system which is unacceptable. At the same time there are WKSs at the informatization object the functionality of which requires video moni­toring of the operator (by means of a cam­era mounted at the workplace monitor or otherwise and focused on the operator) as well as transmission for the on-line moni­toring of the video stream from the moni­tor screen and archiving such video stream for the incident disputes. Such information has a large volume; the filming equipment shall meet the high-level requirements oth­erwise it will be impossible to perform the data analysis and data compromise during their transfer or storage will stultify all the efforts applied.

The function of allocating the interac­tions into a separate network is performed by the universal hub "Rassvet".

The function of the data transmission from the WKS monitors and video cam­eras to the AMCS control servers without the use of the basic network of the func­tional system is provided by the "Rassvet-SVMaAC" suite.

AUTHENTIFICATION FOR THE RICH

There is one more sector within which it is rather difficult to overestimate the effect of the biometrics application. It is very impor­tant to choose the biometric technology that does not feature any negative conno­tations (related either to the criminal activ­ity or law-enforcement authorities). This is the VIP-customers support. The practice of interacting with such customers is of great importance to the banking institutions and application not a password or any other device but reading the palm blood veins by means of a convenient and aesthetically pleasing reader may add new colors to such a practice.

The global experience also speaks for this technology: the ATMs of a number of commercial banks in Japan use the palm blood veins scanner for the non-card cus­tomer servicing - a customer touches the reader with his hand and gets money with­out submitting any cards.

A person needs to feel unique and special. Moreover, uniqueness is really one of its immanent features. There is every reason to use this feature in the most efficient way.

* S. V. Konyavskaya. Does it make sense to use biometrics? // National Banking Journal. 2014. No. 4 (April). PP. 104-105.