Patent Description:
Security monitoring systems for monitoring premises typically provide a means for detecting the presence and/or actions of people at the premises, and reacting to detected events. Commonly such systems include sensors to detect the opening and closing of doors and windows, movement detectors to monitor spaces for signs of movement, microphones to detect sounds such as breaking glass, and image sensors to capture still or moving images of monitored zones. Such systems may be self-contained, with alarm indicators such as sirens and flashing lights that may be activated in the event of an alarm condition being detected. Such installations typically include a central unit, generally mains powered, that is coupled to the sensors, detectors, cameras, etc. ("nodes"), and which processes received notifications and determines a response. The central unit may be linked to the various nodes by wires, but increasingly is instead linked wirelessly, rather than by wires, since this facilitates installation and may also provide some safeguards against sensors/detectors effectively being disabled by disconnecting them from the central unit. Similarly, for ease of installation and to improve security, the nodes of such systems are typically battery powered rather than mains powered.

As an alternative to self-contained systems, a security monitoring system may include an installation at a premises, domestic or commercial, that is linked to a Central Monitoring Station (CMS) where typically human operators manage the responses required by different alarm and notification types. In such centrally monitored systems, the central unit at the premises installation typically processes notifications received from the nodes in the installation, and notifies the Central Monitoring Station of only some of these, depending upon the settings of the system and the nature of the detected events. In such a configuration, the central unit at the installation is effectively acting as a gateway between the nodes and the Central Monitoring Station. Again, in such installations the central unit may be linked by wires, or wirelessly, to the various nodes of the installation, and these nodes will typically be battery rather than mains powered.

In both these types of systems, the central unit is typically responsible for arming and disarming the system but may not be located close to an entrance door. When the house owner returns to the monitored premises where the monitoring system is in an armed state, the system must be disarmed fairly quickly, for example within <NUM> to <NUM> seconds of opening an entrance door. If the central unit is not located close to the entrance door, it may be difficult for the owner to reach the central unit and enter the disarm code - which may typically be <NUM> to <NUM> characters or digits, in time. This is obviously poses an even greater challenge for the elderly or infirm. For this reason it is known to provide a unit close to the entrance door by means of which the owner can disarm the system. Such a unit, which may be termed a disarm node, may be provided inside the protected premises close to each main entrance, but in other installations only the single main entrance will be provided with a disarm node. The disarm node will typically be fixed, for example to a wall or other surface of the premises, close to the relevant entrance to the building or protected space.

Although the provision of a disarm node adjacent the entrance to the protected premises means that the householder doesn't have to walk all the way to the central unit to enter the disarm code, there are occasions when it is inconvenient to have to enter the disarm code manually even through a disarm node. For example, if the householder is carrying an infant, packages, or is otherwise encumbered, or if the householder is on crutches, it may still be extremely inconvenient to have to enter a disarm code manually.

It would be desirable to be able to reduce or even eliminate this problem while still retaining a high level of security.

Embodiments of the invention enable hands-free disarming of a security monitoring system while retaining a high level of security.

<CIT> discloses a security system having a central unit, a disarm node and a portable authentication device configured to communicate a unique identifier with a registration signal.

<CIT> discloses an automation system that enables a user to deactivate a security portion of the automation system using a mobile device. The automation system detects the presence of an authorized mobile device which may modify the status of at least one component of the automation system.

According to a first aspect, the present invention provides a security monitoring system for a building or a secured space within a building, the system including:.

Such a system provides the convenience of hands-free disarming while maintaining the security of the system.

In one embodiment, the central unit is configured to:.

In another embodiment, the disarm node is configured to:.

In an embodiment, the central unit is configured, in the event that the requested status change is implemented, to transmit, using the central unit's transceiver, a status change confirmation message.

According to a second aspect, the invention provides a method of disarming a security monitoring system for a building or a secured space within a building, the system including:.

Preferably, the method further comprises:.

The method may further comprise:
in the event that the requested status change is implemented, transmitting, using the central unit's transceiver, a status change confirmation message.

Other aspects of the system are the following:
By providing a disarm node inside the protected space, close to the door whose opening has been detected, to transmit a wake up beacon signal to the portable authentication device, it is possible to use short-range transmission so that only a portable authentication device in the vicinity of the disarm node (and hence of the door whose opening has been detected) will respond to the disarm transmission. This improves security compared to transmitting the disarm transmission directly from the central unit, because the necessarily relatively long range transmission from the central unit would trigger any portable authentication device within range of the central unit, rather than only those adjacent the disarm node associated with the door that was opened. By transmitting the response from the activated portable authentication device directly to the central unit rather than via the disarm node not only does the central unit receive the disarm instruction from the portable authentication device more quickly (since the disarm node doesn't need to receive the signal and process it for retransmission to the central unit), but importantly this approach eliminates a source of considerable battery drain for the battery of the disarm node - as it is likely that the disarm node would otherwise need to perform the reception, processing and transmission of disarm instructions from a portable authentication device several times a day. Given the importance of maintaining good battery life in the nodes of security monitoring systems (the goal is typically an installed battery life of at least <NUM> years using only a small battery), this is a significant saving.

The security monitoring system of the first aspect may include multiple disarm nodes each associated with different door giving access to the building or the secured space, each disarm node having a unique disarm node ID, each of the different doors having a respective door sensor with a different respective ID, and the central unit storing the disarm node IDs, the door sensor IDs, and an association between each door sensor and an associated one of the disarm nodes; wherein
the central unit is configured, in response to receiving a door opening message from a door sensor, to use a door sensor identifier included in the received message to identify the associated disarm node and to include the disarm node identifier for the identified disarm node in the transmitted wake-up message to selectively target the identified disarm node among the multiple disarm nodes of the system.

The selective targeting of the disarm node associated with the door whose opening has been sensed improves security by ensuring that disarm is not caused by the presence of a portable authentication device near one of the other disarm nodes.

In this way, only the disarm node associated with the opened door is caused to transmit a wake signal or beacon, so that only portable authentication devices in the vicinity of that door will receive the signal or beacon. This increases security by reducing the risk that a portable authentication device left near another door, or carried by a user near another door, might trigger a hands-free disarm of the system - something that might otherwise happen if a bad actor without an appropriate portable authentication device were responsible for the door being opened.

According to a second aspect helpful for understanding the invention, a central unit for controlling, arming and disarming a security monitoring system has a radio frequency transceiver and being configured:
in response to receiving a door opening indication/message from the door sensor, to:.

As already noted , by sending the wake up message to the disarm node associated with the door whose opening has been sensed to transmit the wake up instruction to the portable authentication device, rather than sending a disarm instruction directly to the portable authentication device from the central unit, security is enhanced because only portable authentication devices in the vicinity of the relevant disarm node will receive the disarm instruction.

According to another aspect helpful for understanding the invention, a disarm node for disarming a security monitoring system for a building or a secured space within a building is provided, the system including:.

According to a still further aspect helpful for understanding the invention, a portable authentication device or tag for use with a security monitoring system for a building or a secured space within a building is provided, the system including:.

By arranging for the portable authentication device or tag to send the message containing the disarm transmission identifier and the portable authentication device ID on the second radio channel on a channel whose specified transmission parameters differ from those on which the disarm instruction message was received, and which are specified in the instruction from the central unit, it is harder for bad actors to impersonate a valid portable authentication device and hence the security of the system is enhanced.

According to another aspect helpful for understanding the invention, a method of controlling a security monitoring system for a building or a secured space within a building is provided, the system including:.

The method enables hands-free disarming of the system while maintaining the security of the system and avoiding excessive battery drainage in the disarm node(s).

<FIG> is an overview of a security monitoring system according to a first aspect of the invention. The Figure shows a rough plan view of a domestic dwelling <NUM>, which may be a building such as a house or a secured space, such as an apartment, in a building and which is protected by a security monitoring system <NUM>. The dwelling has a front door <NUM>, which is a main entrance giving access to the entrance hall <NUM> of the building or the secured space. The door <NUM> is fitted with a door sensor <NUM> to detect the opening of the door. The door sensor <NUM> is typically, but not necessarily, a magnetically triggered switch which is fitted to the opening side of the door, opposite to the hinge side. The door sensor <NUM> includes an RF transmitter, not shown, that transmits an entry violation signal to a central unit <NUM> of the monitoring system <NUM> in the event that the door is opened. In this installation, the central unit <NUM> is mounted under the stairs <NUM> that lead to an upper floor. The central unit includes at least one first RF transceiver to receive transmissions from the door sensor and other nodes of the system. The central unit communicates with a Central Monitoring Station <NUM> either through a wired connection via a wired data link <NUM> to a broadband connection <NUM> within the premises to the internet <NUM>, or wirelessly, typically using a second transceiver. The central unit may also communicate using a Wi-Fi connection, for example to a Wi-Fi access point that gives access to the Internet over a broadband or other data link. The first RF transceiver(s) for communication with the nodes of the system will typically use an ISM (Industrial Scientific and Medical) band, such as the <NUM> band in Europe. The first RF transceiver(s) may also support Bluetooth. The second transceiver, for communication with the Central Monitoring Station <NUM> may also be able to use an ISM band, such as the <NUM> band in Europe, but may also be able to use a mobile (PLMN) network such as GSM <NUM>, <NUM>, or UMTS. Preferably the central unit <NUM> has several ways of communicating with the Central Monitoring Station <NUM>, so that even if one route is jammed or otherwise unavailable, the central unit is still able to report to, and receive communications from, the Central Monitoring Station.

The residence of <FIG> includes several rooms <NUM>, <NUM>, <NUM>, in addition to the entrance hall <NUM>. Rooms <NUM> and <NUM> lead off the entrance hall, and have windows <NUM> but no external doors. Typically all of the windows will be provided with one or more sensors <NUM> to detect window opening, glass breakage, tampering or the like. Room <NUM> is a combined kitchen and dining room which has an external door <NUM>, which is also fitted with a door sensor <NUM>. The kitchen dining room <NUM> also has a row of sliding and folding glazed doors <NUM> for which door sensors <NUM> are also provided.

As is conventional, the system also includes motion detectors, such as PIR detectors <NUM> to monitor all or selected ones of the rooms or spaces within the building, some or all of which may have associated image capture devices such as video cameras. These or other motion sensors may also be used to detect the opening of an entrance door, instead of utilising a door sensor such as a magnetic contact device. The system may also include one or more microphones to detect, and capture, sounds such as breaking glass, and other sensors to detect the opening of internal doors, the occurrence of flooding, the incidence of fire or smoke, etc..

In the hall <NUM>, close to the front door <NUM>, a disarm node <NUM> is mounted on a wall. The disarm node <NUM> has a user interface, including a touch screen or keypad to receive a user input to disarm the system, and a radio frequency transmitter, not shown, to transmit, in consequence of the user input, a disarm instruction to the central unit <NUM>. A similar disarm node <NUM> is also mounted on a wall of the kitchen <NUM> near to the back door <NUM>. Although the doors <NUM> also give access to the secured space, and are provided with door sensors to detect when they are opened, no corresponding disarm node is provided for them. This is because the sliding doors <NUM> are normally kept bolted on the inside, so that there is no expectation that an occupier or resident will ever enter the building through these doors when the security and monitoring system is armed. As such, any entry through those doors when the system is armed is likely to be an unauthorised entry. Similarly, it may be that the back door is always bolted on the inside when the house is left unoccupied, so that there is no expectation of a legitimate entrance through the back door when the security monitoring system is armed - in which case, the disarm node <NUM> for the back door may not be provided. Conversely, the owner may want to arm the system whenever she works in her back garden, which is accessed via the back door <NUM> - so that it is useful to provide a disarm node in the kitchen by the back door. Indeed, a gardening owner might find it very attractive to be able to disarm the system from the kitchen rather than having to walk to the central unit <NUM>, as this would reduce the likelihood that mud from the garden would be walked through to the hall, for example.

The system is arranged so that it can be disarmed from the armed state by using the disarm node adjacent to or near the door through which the protected space was entered. Once the door sensor is triggered, detecting the opening of a door, it transmits an RF signal to the central unit, including an identifier for the door sensor - so that the central unit can distinguish between signals received from door sensors at different doors. In response to receiving a door opening indication/message from a door sensor, the central unit starts an entry period timer - which sets a time window within which the system must be disarmed, failing which, the central unit will cause the security monitoring system to enter an alarm state. Entering an alarm state may involve the sounding of alarms and flashing lights in or at the premises. If the alarm installation is connected to a central monitoring station, the central unit will generally signal the alarm state to the Central Monitoring Station - which may lead to human intervention, video scanning, audio monitoring, etc..

In order to disarm the system, typically a code may need to be entered into the system, either at the central station, or at a disarm node. If there is more than one disarm node, the central unit may use knowledge of the proximity of particular disarm nodes and particular door sensors to permit disarm only from the disarm node adjacent the door sensor (e.g. movement detector such as a PIR device, or magnetic contact device) that transmitted the door open signal. The disarm nodes will typically include a physical keypad or a touch screen to enable a user to enter an appropriate disarm code, and may include visual indicators and/or a display panel to indicate progress and current system status. This approach to disarming an armed system requires manual interaction with the disarm node. The disarm nodes may also each include a near field communication (NFC) antenna and transceiver for communication with an NFC-enabled device, such as a portable authentication device, a mobile phone, a fob, a watch, etc. to enable the system to be armed and disarmed by bringing the NFC-enabled device within a few centimetres of the disarm node. But again, in order to be able to disarm the system with such an NFC-enabled device, a user must have a hand free to bring the NFC-enabled device into near-contact with the disarm node.

In order to permit hands-free disarming, the system is further provided with one or more portable authentication device, or key tags. The or each portable authentication device has a portable authentication device identity that is registered with the central unit, and a transceiver to receive signals from a disarm node and to transmit signals to the central unit. The operation of the system using one or more such portable authentication devices will now be described with reference to <FIG>, <FIG> and <FIG>.

<FIG> shows a stylised building in which a security monitoring system according to an embodiment of the invention is installed. The installation includes a central unit <NUM>, and a door <NUM> giving access to the building has a door sensor <NUM> to detect the opening of the door <NUM>. Adjacent the door <NUM> and inside the secured space is a disarm node <NUM>. The disarm node is preferably secured to the structure of the building so that its location with respect to the door <NUM> is fixed and the association between the particular door sensor and the disarm node. The property's owner/resident <NUM> has a portable authentication device <NUM> which can be used to enable hands-free disarming of the monitoring system. The portable authentication device has an identity that has been registered with the central unit, and there may be more than one such portable authentication device, each with a unique identifier which is registered with the central unit and stored in its memory.

<FIG> shows the main components of the various devices that take part in the hands-free disarming process. The central unit <NUM> includes a processor <NUM> with an associated memory <NUM> which stores, among other things, identities for the portable authentication devices that are registered to the system, identities for the detectors (e.g. PIRs and/or magnetic contact devices) and disarm nodes of the system together with an association between each disarm node and the detector for the access door closest to the relevant disarm node. These identities and associations are stored in a database <NUM> within the memory <NUM>. The central unit includes at least one RF transceiver <NUM>, with associated antenna <NUM>, for communication with the various nodes and sensors of the monitoring system. Typically, there will be a second transceiver <NUM> as shown , also with an associated antenna <NUM>, for communication with the central monitoring station <NUM>, as a backup or alternative to a wired data connection to the Internet via a network interface <NUM>. The antennas of the various transceivers will typically all be internal to the central unit. The processor <NUM> is connected to, and controls, the memory <NUM>, transceivers <NUM>, <NUM> and the network interface <NUM>. The central unit generally draws power from the domestic power supply ( generally referred to as a mains power supply) which feeds a power supply <NUM> within or associated with the central unit. The central unit also includes a backup battery power supply which automatically becomes operational in the event that the external power supply fails. The internal battery power supply is based on rechargeable cells <NUM> that are kept continuously topped up by the power supply <NUM>. The central unit may also include a user interface <NUM>, including a display <NUM>, a keypad or keyboard <NUM>, a loudspeaker <NUM>, and a microphone <NUM>. The keypad or keyboard may be a provided by making the display a touch-sensitive display, or as a unit distinct from the display. The central unit may be arranged to accept through the keypad or keyboard a code or codes to arm and disarm the system. The central unit may also include a near field communication (NFC) antenna and a corresponding NFC chip or equivalent circuitry which can be used, for example, to detect the presence of a "disarm dongle" provided to the user of the system and which is capable of communicating with the central unit using Near Field Communication. The portable authentication devices may also be provided with an NFC antenna and chip or equivalent circuitry, so that they can be used as "disarm dongles" with the central unit and with NFC-enabled disarm nodes.

The disarm node <NUM> includes a processor <NUM> with an associated memory <NUM> that stores an ID for the disarm node. The disarm node also includes a user interface <NUM> comprising a display <NUM> (optional), indicators, e.g. LEDs, <NUM>, a keyboard or number pad, <NUM> - although this functionality can alternatively be provided through the use of a touch screen display in place of display <NUM>. A transceiver <NUM>, with an associated antenna <NUM> (which will typically be internal, rather than external as illustrated), is controlled by the processor <NUM>, and is used for communicating with the central unit <NUM> and the portable authentication device <NUM>. The disarm node includes a battery power supply <NUM>, and in general this will be the only power supply as typically it is preferred not to have to connect disarm nodes to the mains power supply. A loudspeaker <NUM> is provided so that audible messages and instructions can be given to a user at the disarm node. These audible messages an instructions may be automated ones, generated by the central unit or by the disarm node itself, but additionally the loudspeaker <NUM> can be used to relay messages from a central monitoring station <NUM>. For example, the loudspeaker may be used to provide a disarm success or failure message, and to provide a prompt for the user to enter credentials (e.g. passcode) in the event that hands free disarm has failed. Conveniently, the disarm node may also include a microphone <NUM> to permit a user at the disarm node to hold a conversation with a human operative in, for example, a central monitoring station <NUM>, or even with the emergency services - for example if patched through by the central monitoring station. Preferably, the disarm node <NUM> is secured to the building protected by the security monitoring system, for example attached to an internal wall at a height convenient for user operation - for example fixed at a height between <NUM> metre and <NUM> metres from the floor. The system may be so arranged that a disarm node can only be used for disarming the system from an armed state, or may be arranged to permit the system to be armed and disarmed from a disarm node. Like the central unit, the disarm node may also include a Near Field Communication antenna and chip <NUM> to enable a disarm dongle, such as an NFC-enabled portable authentication device, to be used to disarm the system by bringing the dongle within a few centimetres of the disarm node.

The disarm node may also be configured to encrypt its radio transmissions, and to decrypt received signals, so that secure communications with the central unit are possible. The encryption may be based on a secret shared between the central unit and the disarm node.

The detector to detect the opening of the door is here illustrated as a door sensor <NUM>. This door sensor includes a processor <NUM>, with an associated memory <NUM> which stores an identifier for the door sensor, a transceiver <NUM>, with an associated internal antenna <NUM>, connected to, and controlled by the processor <NUM>, all powered by a battery power supply <NUM>. As with the disarm node, typically the battery power supply <NUM> will be the only power supply for the door sensor. The door sensor includes in addition a switch, for example a pair of contacts, <NUM>, that are controlled by the opening and closing of the door with which the door sensor is associated. Typically, the contacts <NUM> respond to the presence of a magnetic field provided by a magnet <NUM>. The magnet is typically attached to the leaf of the door, while the contacts are typically secured to the frame of the door. The contacts <NUM> may be closed in the presence of the magnetic field, opening when the contacts and the magnet are moved apart as the door opens, or they may be open in the presence of the magnetic field, closing when the field is taken away as the door is opened. Alternatives, such as Hall effect sensors, or an optical sensing arrangement, can be used in place of magnetically controlled contacts. But, because the door sensor is battery powered, the sensor arrangement is preferably one that consumes no or very little power in the resting (door closed) state - which makes the use of magnetically controlled contacts attractive.

The portable authentication device <NUM> includes a processor <NUM>, with an associated memory <NUM> that stores an identifier for the portable authentication device, a transceiver <NUM>, and a battery <NUM> that provides power to the processor and the transceiver. Transceiver <NUM>, which has an associated antenna <NUM>, may be a wake on radio transceiver. The use of a wake on radio transceiver typically enables a reduction in the amount of power consumed by the portable authentication device, thereby extending the life of the battery of the portable authentication device , typically to several years. Alternatively, the transceiver may be a conventional polling transceiver designed for low power consumption. Such a polling transceiver, when in a resting state, periodically powers just the front end of its receiver circuit to listen for polling signals. If a polling signal is detected, possibly subject to some power level minimum, the rest of the receiver circuit is energised to receive transmissions. Such a polling transceiver may listen for no more than about <NUM>, e.g. for <NUM> each second, or every two seconds, unless polling signals are detected. The frequency with which the transceiver carries out polling is a compromise between battery life and responsiveness. A period between poling events of <NUM> to <NUM> seconds will typically give satisfactory responsiveness with acceptable battery life. Typically the system will be configured to enable the poling period to be set, and changed, via an RF configuration command from the central unit.

The transceiver, of whatever kind, is controlled by the processor and enables radio communication with the central unit <NUM> and the disarm node <NUM>. The portable authentication device may also include one or more buttons <NUM> which a user can use to issue commands or responses. The portable authentication device may also include one or more visual indicators <NUM>, for example one or more LEDs, to indicate a status, to confirm a button press, or the like. For example, a single multi-coloured indicator, such as an LED, may be used to provide multiple different indications while keeping component count low and enabling the portable authentication device dimensions to be made compact.

The portable authentication device is preferably configured to encrypt its radio transmissions, and to decrypt received signals, so that secure communications with the central unit are possible. The encryption may for example be based on a secret shared between the central unit and the portable authentication device.

<FIG> is a timing diagram showing the sequence of events and actions of the various elements of the security system that characterise a method, according to an embodiment of the invention, of controlling a security monitoring system to achieve hands-free disarming of the system. The diagram concerns the operations of the door sensor <NUM>, the central unit <NUM>, the disarm node <NUM>, and the portable authentication device <NUM>.

The method start at <NUM> with the detector <NUM> sensing an event, the opening of the door whose status it senses, and responding to this by using its RF transceiver to transmit an entry violation message. This entry violation message, which includes the detector's ID, is received at a transceiver of the central unit <NUM>. In this example it is assumed that the detector is a magnetic contact device, but the method is the same or essentially the same if door opening is detected using a motion sensor such as a PIR device.

The central unit starts, at <NUM>, an entry period timer, which is set for the duration of the period within which the disarm process needs to be completed before the central unit causes the system to enter an alarm condition - for example in the range <NUM> to <NUM> seconds. The central unit identifies the detector that transmitted the entry violation message from the detector ID contained in the received message, and retrieves from the database <NUM> the ID of the disarm node that is associated with the identified door sensor. If no disarm node is associated with the identified door sensor, the central unit waits for the input of a disarm code at the user interface <NUM> or for the arrival of a message from another disarm node (e.g. a message to the effect that the disarm passcode has been entered at that disarm node) if that is permitted by the set-up of the system. But, if the database reveals that the door sensor is associated with a disarm node, the central unit includes the ID code for that disarm node in a message which it transmits, at <NUM>, to the disarm node <NUM> to cause the disarm node to activate, at <NUM>, an indicator, an LED <NUM> for example, or to make a sound through loudspeaker <NUM>, to indicate to the person entering the secured space that the system is armed and that action must be taken to disarm the system within the period set for the entry period timer. The message also causes the disarm node to transmit, at <NUM>, a beacon signal or a polling signal to wake the transceiver in any portable authentication device within the vicinity of the targeted disarm node, and includes a special identifier to be included in the beacon signal or polling signal, and details of the packet countdown to be used. The special identifier will typically be a random or pseudo random number whose value changes at each use. The portable authentication device listens for beacon signals on one or more channels whose parameters are known to each of the portable authentication devices - for example by having been pre-programmed, but more preferably having been communicated to the or each f portable authentication device when that portable authentication device first registered with the central unit (although of course the central unit could periodically update these parameters through an exchange of messages with the portable authentication device (s). At this time, the central unit <NUM> preferably also starts, at <NUM>, a hands-free disarm beacon valid timer, which determines the time within which reception by the central unit of a message from a portable authentication device that includes the special identifier will be effective to disarm the system. The hands-free disarm beacon valid timer setting is also included in the message sent to the disarm node. The characteristics of beacon or polling signal transmitted by the disarm node are chosen to make the effective range of the beacon signal small - preferably of the order of a few metres, e.g. no more than <NUM> metres for detection by a portable authentication device, so that it will only be effective in waking a portable authentication device in the immediate vicinity of the disarm node. These characteristics will be discussed in more detail later.

The transceiver <NUM> of a portable authentication device <NUM> that is within a few metres of the disarm node receives the beacon signal and wakes up. The transceiver <NUM> receives and decodes the beacon signal, retrieving the special identifier. The controller of the portable authentication device then causes the transceiver <NUM> of the portable authentication device to transmit, at <NUM>, a message including the portable authentication device ID and the special identifier to the central unit <NUM>. The central unit checks that the special identifier is valid (meaning that it is one issued within the current period of the hands-free disarm beacon valid timer) and also checks to see whether the portable authentication device ID corresponds to one registered with the central unit. If both of these checks are passed, the central unit at <NUM>, will disarm the system if the message from the portable authentication device, containing the portable authentication device id and the special identifier, was received before expiry of the hands-free disarm beacon valid timer. The central unit may also at this stage send a further message to the disarm node to cause the disarm node to provide a notification of the fact that the system has been disarmed - for example, the disarm node may activate an appropriate indicator light <NUM> and/or provide a "disarm success" sound or announcement through the loudspeaker <NUM>. The central unit may also send a further message to the portable authentication device to cause the portable authentication device to generate a signal indicating successful disarming of the system - for example, by illuminating an indicator on the portable authentication device.

As will be described later, the disarm request message sent by the portable authentication device to the central unit may also include a report on the RSSI levels of messages received by the portable authentication device from the wake up node, and the central unit may use the information about measured RSSI levels in such a report in determining whether or not to trust the received disarm request - i.e. whether to disregard the disarm request as invalid on the basis that it is likely to have come from a rogue actor (outside the usual range of the disarm node) rather than from an authorised user within range of the disarm node.

If the hands-free disarm beacon valid timer expires without the central unit having received a message from a portable authentication device including a registered portable authentication device ID and the special identifier, the central unit preferably transmits another message, at <NUM>, to the disarm node (including the relevant disarm node identifier) to cause the disarm node to provide a visual or audible prompt, or both, indicating the need for the system to be disarmed in some other way - e.g. by entering appropriate credentials (such as a password or PIN) at the disarm node. The disarm node then provides this prompt, visually or audibly, or both, at <NUM>. Any credentials entered at the disarm node are forwarded by the disarm node to the central unit. If appropriate credential are received by the central unit before expiry of the entry period timer, the system is disarmed.

It will be noted that the disarm credentials are not checked at the disarm node - with the disarm node sending a "success" message, if appropriate to the central unit, but rather that the entered credentials are transmitted from the disarm node to the central unit where they are checked.

The disarm node may be configured to send, at <NUM>, if no disarm success/failure message has been received from the central unit, a polling message to the central unit after expiry of the hands-free disarm beacon valid timer period to check whether the disarm node should provide a disarm success indication. If the central unit receives such a polling message, it transmits a polling response to indicate success/failure and to cause the disarm node to provide a disarm success indication, or to indicate to failure - and the need to provide disarm credentials of some kind, as appropriate.

If no appropriate message is received from a portable authentication device within the hands-free disarm beacon valid timer and no appropriate disarm credentials are received before expiry of the entry period timer, the central unit identifies an alarm state. If the system is backed up by a central monitoring station (CMS), the central unit will send a status change message to the CMS, typically with the identifier of the door sensor that first indicated a door opening event. The CMS may then cause the central unit to activate relevant video cameras or other image capture devices, audio capture devices, etc. and provide data feeds from these to the CMS. The CMS may also invoke human intervention as appropriate.

The system may be set up in such a way that, if the disarm node detects an input at its user interface <NUM>, of if a near field communication (NFC) sensor <NUM> in the disarm node detects the presence of an appropriate NFC tag (disarm dongle), the transmission of the disarm beacon by the disarm node is halted or forestalled. In which cases the system is disarmed by the central unit if the appropriate disarm credentials are provided at the disarm node (or at the central unit) through a user interface or by means of a registered NFC tag (that is, a tag that has previously been registered with the central unit), before expiry of the entry period timer.

In an alternative embodiment, the central unit does not start a hands-free disarm timer, but instead the disarm node starts such a timer on receiving the message sent at step <NUM> by the central unit. If the disarm node does not receive a disarm success message from the central unit before expiry of the hands-free disarm timer, the disarm node provides an audible and/or visual warning to the effect that hands-free disarm has failed and that the system must be disarmed in some other way - e.g. by entering a PIN or passcode, or using a registered NFC tag, to avoid the system going to an alarm state. The hands-free disarm timer run by the disarm node has, of course, a duration short enough to ensure that it expires before the entry period timer that is run by the central unit. If the security management system can provide entry period timers of different lengths, then the central unit is set up to inform the or each disarm node of the duration of the entry period timer that has been set - and an allowance is made for the time taken for the central unit to process a door open message and for a disarm node to respond to the message sent at step <NUM>, so that the length of the hands-free disarm timer can be adjusted appropriately to suit the length of entry period timer selected.

Preferably, RF communication between the central unit and the nodes and sensors of security monitoring systems according to embodiments of the invention use the industrial, scientific, and medical (ISM) radio bands, such as in Europe the <NUM> band. Within the <NUM> band are several sub-bands dedicated to "non-specific SRD" which are of interest. For the beacon/polling signal that is used by the disarm node to activate nearby portable authentication devices we are actually interested in engineering short range communication, as will shortly be explained with reference to <FIG>. portable authentication devices according to the invention may be configured to listen for instructions related to hands free disarm only on a particular channel or channels, with given frequency and given modulation, but to listen to another channel or channels on a different frequency and possibly with different modulation for other kinds of instructions.

Disarm instructions received from a disarm node do not typically contain a portable authentication device ID - because, if more than one portable authentication device is registered with the central unit, it cannot be assumed which if any portable authentication device is being carried by the person who opened the door whose opening has been sensed. But other message may be targeted to a particular portable authentication device or to a group of portable authentication devices that is a subset of all the registered portable authentication devices. Consequently, a portable authentication device according to embodiments of the invention may also be arranged to check the contents of received messages for the presence of that portable authentication device's ID. In this way, the central unit can target an individual portable authentication device or group of f portable authentication devices. For example, in the event that a portable authentication device has been mislaid, a "announce myself" message could be transmitted by the central unit flagged with the ID of the particular portable authentication device that has been mislaid. If other portable authentication devices receive the message, they do not respond to it , because it is flagged as an "announce myself" message and does not contain their ID. Whereas the missing portable authentication device sees that the message is flagged as an "announce myself" message, recognise its own ID, and announces its presence using one or more of its inbuilt indicators.

In general, monitoring systems according to embodiments of the invention will not be configured to transmit only disarm messages to portable authentication devices, but will also be configured to send other types of messages to portable authentication devices. In systems that do only send portable authentication devices disarm messages, a portable authentication device just needs to recognise a received message as a disarm message and respond with the disarm transmission identifier and the portable authentication device ID. But in systems where there are additional message types, message types will typically fall into two classes: targeted messages that are targeted at a subset of one or more of all the registered portable authentication device s, that include one or more portable authentication device IDs, and in respect of which a reaction is sought only from the portable authentication device (s) having an ID included in the message; and group or general messages, in respect of which a reaction is sought from any portable authentication device that receives the message - and which therefore do not need to include a portable authentication device ID (and which hence will generally not include any portable authentication device ID). For example, a central unit may be configured to instruct the portable authentication device involved in a hands free disarm event to provide a disarm success indicator on a successful disarm event. Such an instruction will preferably include the ID of the portable authentication device that transmitted the disarm request to the central unit (the portable authentication device ID having been included in that disarm request).

Messages may be sent to portable authentication devices at least from the central unit (of which, in some systems, there may be more than one) and disarm nodes. Where there are multiple message types, they may be labelled Disarm Message, Group, and Targeted - labels which can be considered to be class flags. If finer granularity is required, a further level of flags may be provided - so that a message type is indicated by a primary flag (Disarm Message, Group, or Targeted), and (at least for Group and Targeted) a secondary flag that indicates the specific message type within the class. Alternatively, a single level of flags may be provided, with typically multiple flags for each of the Group and Targeted classes.

<FIG> is a schematic diagram illustrating why we want the range of the beacon signals from disarm nodes to have shorter range than transmissions from the central unit of a monitoring system. A first person entering a secured space opens a door, for example the front door that gives access to a street, which is monitored by door sensor <NUM>. The person is carrying a portable authentication device <NUM> which is registered with the central unit of the monitoring system. Adjacent the door that is opened is a disarm node <NUM>. The system's central unit <NUM> includes a database <NUM> that stores an association between an identifier for the door sensor <NUM> and an identifier for the disarm node <NUM>. The secured space can also be accessed by another door of the building, for example a back door that gives access to a back garden of the building, and that door is fitted with another door sensor <NUM>. Also near the back door, within the secured space, is another disarm node <NUM>. A second portable authentication device, <NUM>, is carried by another person who is also an occupier of the secured space, who is working in the back garden.

When the first person opens the front door, and the central unit causes the first disarm node to transmit a beacon signal, it is desirable that the beacon signal is received by the first portable authentication device <NUM> which is adjacent (say within a metre or two at most) of the first disarm node <NUM>, so that the first key tag or portable authentication device wakes up, but that the second portable authentication device <NUM>, that is carried by the second person who is working in the back garden, does not receive that beacon signal and therefore does not wake up. Of course in the scenario just described, the person opening the front door and the person carrying the second portable authentication device are both "legitimate" occupiers of the secured premises, so that there would be no problem inherently in sending a disarm signal from the second portable authentication device in respect of an entrance made by the first person (such as might happen if the first person had forgotten to carry their portable authentication device) - as might happen if the effective range of the beacon signal from the first disarm node <NUM> were received and acted upon by the second portable authentication device <NUM>. But of course, it would be a different situation if the person opening the front door were a villain who was entering the premises unlawfully through the front door. In this case, if the villain didn't have a registered portable authentication device, their entry would still result in the system being disarmed if the effective range of the beacon signal from the first disarm node was such as to cause the second portable authentication device to send a disarm signal to the central unit. For this reason we want the effective range of beacon signals from disarm nodes to be restricted to the immediate vicinity of the disarm node and including the space between the disarm node and the door with which it is associated.

These scenarios also illustrate why we want the central unit to target beaconing messages just to the disarm node that is associated with the door sensor that has detected and reported a door-opening event. If instead the beaconing messages were generic, causing all disarm nodes to transmit beaconing signals, the second portable authentication device of the person working in the back garden might be triggered by beaconing signals from the second disarm node, when a villain without a portable authentication device was effecting illicit entrance through the front door - even if the beaconing signals from the disarm nodes were all very short range.

Within the <NUM>/<NUM> band in Europe, the sub-band between <NUM> and <NUM> is interesting for use when transmitting beaconing signals from the disarm nodes because it provides a relatively wide channel, the beacon channel, which allows the use of a high data rate, e.g. <NUM> kbit/s, which is helpful in reducing the effective range of the beacon signal. The effective radiated power ceiling of 5mW also poses no significant constraint for this application.

Achieving effective battery life of nodes and sensors in alarm and monitoring systems is a constant concern, because battery failure disables the relevant node or sensor, which can lead to loss of security, and battery replacement may involve a site visit by the system supplier - which is expensive and inconvenient. For a portable authentication device, loss of battery power means that the portable authentication device stops working, which is inconvenient for the user, and the cause of the failure may not be apparent to the user so that the user may require a site visit to identify and fix the problem. Consequently, we are interested in reducing power consumption in all of the battery powered components of the system, including the portable authentication device. For this reason the use of a wake on radio receiver in the portable authentication device is attractive, although acceptable battery life can also be obtained using a more conventional radio receiver that periodically wakes to listen (poll) for beacon signals.

One way of reducing portable authentication device power consumption during the wake up process is for the portable authentication device to use <NUM>-stage detection. A first detection stage of the transceiver of the fob (portable authentication device) may be used to perform a first step which involves checking an RSSI level. For example, the transceiver in the portable authentication device may periodically perform a brief RSSI check polling the beacon channel, using just the RF front end of the transceiver, for example for a first period of less than a few milliseconds, preferably a fraction of a millisecond, e.g. around <NUM> milliseconds and then revert to its rest state if the sensed RSSI level is below some pre-set threshold. If the sensed RSSI level is above threshold, the portable authentication device listens for a brief period for a synch word from the disarm node - for example for a second period of a few milliseconds , for example for less than <NUM> milliseconds, e.g. <NUM>. If no synch word is detected, the transceiver reverts to its rest state. But if a synch word is detected, the transceiver starts the full radio receiver which remains powered up, for example for a third period of between say <NUM> to <NUM>, for example <NUM>, to receive the full WoR packet. Each packet will typically last of the order of <NUM>, and the disarm node may transmit for <NUM> to <NUM> seconds, e.g. for <NUM> seconds - meaning that the portable authentication device should be able to receive <NUM> to <NUM> packets. Clearly, the choice of duration for the various periods is a trade-off between power consumption, user experience and accuracy - but the timings given represent a reasonable compromise as a starting point to be adjusted as necessary.

RSSI detection can be achieved by activating just front end components of the transceiver, avoiding the need to power up all of the transceiver. If the detected RSSI level is below a threshold, the portable authentication device determines that there is unlikely to be valid data available and halts its RSSI check until the next cycle. The cycle period determines the length of time for which the disarm node needs to transmit its beacon and also sets a lower bound on how quickly hands-free disarm is likely to occur on average. The portable authentication device wake up interval, which is controlled by a clock in the portable authentication device, will typically be chosen based on the duration of the disarm node beacon. For example, if the disarm node transmits its beacon for <NUM> seconds, then a portable authentication device wake up interval of one second would provide a good likelihood that a portable authentication device within range of a broadcasting disarm node would be able to wake and retrieve the necessary information from the beacon signal. A portable authentication device wake up of interval (period between poling events) of <NUM> seconds will often be frequent enough when the disarm node is configured to transmit its beacon signal for <NUM> seconds. The portable authentication device wake up interval can conveniently be set at between a quarter and two thirds of the beacon duration. By having the portable authentication device check the RSSI for a very brief period, for example a few milliseconds, at each polling event, good battery life can generally be obtained. A shorter relative cycle time is not technically problematic, but it is likely to use proportionally more battery power and hence shorten battery life commensurately. The cycle time could be more than one half of the beacon duration, provided the system enables the portable authentication device to capture the beacon quickly after wake up, so that the necessary special ID can be recovered by the portable authentication device.

The disarm node transmits a beacon signal, on the beacon channel, which includes the special codeword (shown as ID in <FIG>) received from the central unit for this hands free disarm event. Typically, the beacon signal will be made up of a sequence of packets, each beginning with a preamble, followed by a synch word, then an identifier which may be the special ID from the central unit. Preferably, each packet includes a countdown value, the countdown value decreasing by one in each subsequent packet (to zero in the final packet of the sequence) and indicating the number of packets until the end of the sequence of packets. The system will typically be configured to cause the disarm node to transmit only one beacon sequence, with a single series of countdown values.

The beacon signal is recognised as such by the portable authentication device, because it is the only message of that kind with the relevant format in that channel, causing the portable authentication device to transmit a response including the special codeword (id).

By including sequence information in the beacon from the disarm node, it becomes possible for the portable authentication device to determine when the beacon transmission will end. Using this information, the portable authentication device can delay transmitting its response to the central unit until after the disarm node has finished transmitting - so that it is easier for the central unit to detect the response from the portable authentication device without local interference. This means that portable authentication device transmit power can be kept low, prolonging the life of the portable authentication device's battery, while still enabling the central unit to receive the portable authentication device's response. In addition, when the portable authentication device captures beacon packets, it can calculate how long it will be before the sequence ends. If the captured packets are early in the sequence, the portable authentication device can "snooze" or power down while waiting for the sequence to end, and then wake again in order to transmit its response to the central unit just after the sequence ends.

The portable authentication device will listen to multiple packets to be able to use statistics to get a reliable RSSI figure.

In order to reduce the effective range of the radio beacon, it is transmitted from the disarm node at a low power (e.g. -20dBm or less)with a high data rate (for example, 250kbps or more, say <NUM> kbps ) and with a low modulation index, to give an effective range of no more than about <NUM> metres? We limit out power from the disarm node to limit range. To make it harder to receive from a greater distance we have a high modulation and low modulation index. However the main reason is not the poor link budget but the speed. The higher the bitrate the more packets can be used for estimation. Sensitivity is in the range of around -90dBm at this settings and we try to be in line of sight, then the distance from the transmitter is given as the fading of the channel with distance, using Friis formula.

Encryption, for example based on shared keys, is preferably used for all transmissions from and to the central unit in each of the embodiments of the invention.

As mentioned previously, a further option to improve security, which may be used with any or all of the preceding options to further enhance the security of the system, is for the portable authentication device to include in the response message sent to the central unit details of the results of RSSI determinations made by the portable authentication device. In particular, the disarm node may be configured to send a series of wake up messages upon being prompted by the central unit to send a disarm instruction, including a disarm transmission identifier, to the portable authentication device. And the portable authentication device may be configured to determine the RSSI level of each of the messages of the series that are received from the disarm node. The portable authentication device may be configured to include in the disarm request sent to the central unit a report based on the determined RSSI levels. For example, the portable authentication device may be configured to send a summary of the RSSI levels measured, such as the number of messages/packets measured or measured above a certain level, maximum RSSI level, etc. Inclusion of the RSSI data can be used by the system to reduce the susceptibility of the system to "relay attacks" of the type used to fool passive entry systems (PES) of cars. The portable authentication device would report RSSI values as, for example, max/min values, and an average, and the central unit may hold factory pre-set values for a "real" disarm, and/or these may be supplemented or replaced with real world values obtained during commissioning/testing of the system.

In addition to being useable within the monitored space, a disarm node according to an embodiment of the invention could usefully be disposed outside the monitored space or building as a means for a user to unlock a door that gives access to the monitored space of building and that has an electronically controlled lock, and to disarm the monitoring system. Such a system and its operation are represented schematically in <FIG> and <FIG>. The provision of such an externally located disarm node could also permit a user to lock the electronically controlled lock of an access door with or without arming the system. For this use, a disarm node would preferably include a selector arrangement to enable a user to initiate an event. For example, the disarm node could include a selector to enable a user to unlock the electronically controlled lock of a door and disarming the monitoring system from an armed state, a selector for locking the lock of the door, and another selector for arming the system or for locking the lock of the door and arming the system. Such an electronically controlled lock would typically include an RF receiver, e.g. an RF transceiver, to receive control messages to lock and unlock the lock, and would typically also include means to decrypt encrypted messages received by the receiver. The selectors could be provided in the form of a keypad or as individual "buttons", preferably using capacitance sensing technology rather than as mechanical switches.

In use, according to a first embodiment, illustrated schematically in <FIG>), such an externally located disarm node would react to operation of one of the selectors (event #<NUM>) by starting a "wake on radio" process (event #<NUM>) effectively to search for any user portable authentication device within range ( within <NUM> metres or less, e.g. within <NUM> or <NUM> metres) of the disarm node by transmitting wake up messages generally as previously described. The wake up message includes a unique event ID (e.g. a random number) which serves the same function as the unique event ID that the central unit has previously been described as generating for each door opening event.

In addition, the disarm node would also transmit (event#<NUM>) a report to the central unit indicating the selector that was activated - i.e. informing the central unit of the user's request. The report from the disarm node also includes the disarm node identifier and the unique event ID. A user portable authentication device receiving such a wake up message responds by transmitting (event #<NUM>) a message to the central unit, including the unique event ID and its own ID. Preferably, the user portable authentication device is also configured to perform RSSI measurement on wake up messages received from the disarm node and to include information on these RSSI measurements in the message sent to the central unit.

In an alternative second embodiment, illustrated schematically in <FIG>, the externally located disarm node would react to operation of one of the selectors (event #<NUM>) by using its RF transceiver to send (event #<NUM>) a change status request message to the central unit, including the details of the change requested, together with the disarm node ID. The central node would transmit (event #<NUM>) a response including the disarm node ID together with a unique event identifier (e.g. a random number) which is effective to cause the disarm node to start a wake on radio process. The response from the central unit could include a command for the disarm node, or the system could be arranged so that the disarm node responds to receiving a message from the central unit that includes a unique event identifier together with the disarm node's ID by starting the wake on radio process. The disarm node receiving such a response, including its own ID, would use its RF transceiver to transmit wake on radio signals (event #<NUM>), including the unique event identifier. A portable authentication device receiving the wake on radio signals would wake and transmit (event #<NUM>) a signal including its own ID, and the unique event identifier. Preferably, the user portable authentication device is also configured to perform RSSI measurement on wake up messages received from the disarm node and to include information on these RSSI measurements in the message sent to the central unit.

With both the first and second embodiment of this external disarm node variant the sequence of operations continues as follows.

The central unit, on receiving the message from the user's portable authentication device checks to determine whether portable authentication device ID included in the message is one registered with the central unit, and also whether the event ID matches that of a "current" event. If the message received from the user portable authentication device includes RSSI information, the central unit will also take this into account in deciding whether the status change request is a valid one. If the central unit is determined to be valid, then the central unit actions the request by, for example sending an unlock command to the relevant door lock (event #<NUM> in <FIG>, event #<NUM> in <FIG>) and disarming the security monitoring system, or by sending a lock command to the relevant door lock and arming the system. In addition, the central unit may be configured to send a status change notification to the disarm node(event #<NUM> in <FIG>, event #<NUM> in <FIG>), including the disarm node ID, so that the disarm node can indicate the change of status visibly and or audibly.

Also, if the user portable authentication device includes a haptic device, the central unit may transmit an instruction to the portable authentication device to cause the portable authentication device to activate the haptic device to indicate completion of the requested action. A portable authentication device having one or more visual indicators, e.g. one or more LEDs, may also be triggered to provide a visual indication of completion of a requested action.

A portable authentication device having a haptic element may also be configured to provide haptic feedback on receipt of a wake up message from a disarm node (preferably a different mode of feedback from that for successful completion of a requested action), so that a user knows that the portable authentication device has been "found" by the disarm node.

The central unit may optionally transmit an action request "failure" message, including the disarm node ID, that the disarm node can use to provide feedback of failure to complete a requested action. The central unit can also send a failure message, including the portable authentication device ID, that the portable authentication device can use to provide feedback of failure to complete a requested action.

Claim 1:
A security monitoring system (<NUM>) for a building or a secured space within a building, the system including:
a central unit (<NUM>) for controlling, arming and disarming the security monitoring system (<NUM>), and having a radio frequency transceiver (<NUM>);
a door (<NUM>) giving access to the building or the secured space;
an electrically controlled lock which is lockable to lock the door to prevent the door being opened from outside the building or the secured space, and which can be unlocked to enable the door to be opened from outside the building;
a disarm node (<NUM>) for disarming the system, the node having a user interface (<NUM>) to receive a user input to change the status of the system, and a radio frequency transmitter to transmit, in consequence of the user input, a status change message to the central unit (<NUM>), the disarm node (<NUM>) being located outside the building or the space;
and a portable authentication device (<NUM>) to permit hands-free disarming of the security monitoring system (<NUM>), the portable authentication device (<NUM>) including a radio transceiver (<NUM>) and having a portable authentication device identity that is registered with the central unit (<NUM>);
the disarm node (<NUM>) being configured to:
(i) transmit from the disarm node's transceiver, using a short-range transmission mode, a wake up message including a status change event identifier;
the portable authentication device (<NUM>) being configured to respond to receipt of the wake up message by transmitting, using the portable authentication device's transceiver (<NUM>), a response message including the status change event identifier and the portable authentication device identity;
the central unit (<NUM>) being configured:
in response to receiving the response message from the portable authentication device (<NUM>), to :
(v) check whether the status change event identifier is for a current status change event;
(vi) check whether the portable authentication device identifier is for a portable authentication device (<NUM>) registered with the central unit (<NUM>); and
(vii)if the two checks both give positive results, to implement the requested status change, and, if the status change request includes a request to unlock the electronic lock, to use the central unit's transceiver (<NUM>) to transmit a signal to cause the electronic lock to be unlocked.