GB2634559A

GB2634559A - Access control system

Info

Publication number: GB2634559A
Application number: GB2315705.0A
Authority: GB
Inventors: Bannister Paul; Stroud Adam
Original assignee: Paxton Access Ltd
Current assignee: Paxton Access Ltd
Priority date: 2023-10-13
Filing date: 2023-10-13
Publication date: 2025-04-16
Also published as: WO2025079033A1; GB202315705D0

Abstract

An access control system which operates both with legacy NFC credentials such as a fob or card and with a user device such as a mobile phone. A reader 204 is connected to a controller 206 via an interface device 226. The controller is also connected to an access control device such as a door solenoid 208. When a token or tag 202 is presented to the reader 204, it conveys a user code to the reader. The reader then transmits the user code as a serial signal to the controller 206 via the interface 226. The controller compares the signal to stored data and if there is a match the controller will instruct the access control device to open a door etc. In addition, the interface device 226 is responsive to a short-range wireless signal 236 from a user device 228. The signal carries a user code which is translated into a serial data signal by the interface and transmitted to the controller 206 which determines whether the code is valid. The interface may be retrofitted cheaply and easily to an installed system.

Description

ACCESS CONTROL SYSTEM

The present invention relates to an access control system.

Electronic access control systems are known in which a user presents a credential to a reader, a controller determines whether the credential is valid and, if so, allows the user through a door or other barrier into a secure area. The credential might be a swipe card, a barcode or QR code, a Radio Frequency Identification (RFID) tag and so on.

In a widely known prior art security system, each authorised user has a credential in the form of a passive tag, typically mountable on a keyring. When presented to a reader, the tag conveys a user code which the reader relays to a controller. The controller verifies the code and unlocks the door by activating a solenoid or similar.

One example is the Nett range of products available from Paxton Access Limited.

Another example is the Passan system from Urmet Communications and Security.

In passive access control systems, an electromagnetic signal generated by the reader is received by an antenna or coil in the tag and the energy is used to power the circuitry in the tag. The tag will then generate a user code and convey that code to the reader. In passive systems, this is typically done by modulating the electromagnetic signal (or carrier signal) generated by the reader. In the simplest case, the tag generates the same code each time but such an arrangement is vulnerable to replay attacks. More sophisticated tags will generate a time-varying code, a one-time code or a response to a challenge using public key cryptography. The skilled reader will appreciate the advantages and disadvantages of these options.

Passive access control system typically operate at 125kHz, in the range 125kHz to 135kHz (Low Frequency or LF) or at 13.56MHz (High Frequency or HF).

Alternatively, the access control systems may be active, meaning that the credential includes a power source such as a battery.

Active access control systems work in a similar manner to passive systems but, because a power source such as a battery is included in the credential, the signal from the reader is not used to power the tag. Active access control systems may operate at the same frequencies as passive systems and also between 868MHz and 930MHz (Ultra High Frequency or UHF) or 2.45GHz or 5.8GHz (Microwave).

Further features of such systems will also be apparent to the skilled reader such as the provision of an exit button (i.e. a switch to permit exiting from a secure area without use of a tag or other credential). The tags for such systems are small and cheap but still offer a good level of security.

However, modern access control systems have replaced the tags with a user device such as a mobile phone and installed security app. These systems operate on an entirely different basis to the tag-based systems, using computer cryptographic and signing techniques to maintain security. This provides many advantages such as eliminating the need to carry a separate tag, allowing user access rights to be modified and providing over-the-air updates to the system.

However, the problem is that there are millions of the legacy systems installed worldwide representing billions of dollars of capital expenditure and it would simply be too expensive to replace them. It is an object of the present invention to address this problem.

According to a first aspect of the present invention, there is provided an access control system comprising a reader, an interface device and a controller, 1. the reader comprising a transmitter for communicating with a token and a serial interface for transmitting data over a first multi-wire connection to the controller, 2. the interface device comprising a first connector coupling the interface device to the reader via the first multi-wire connection, a short-range packet wireless transceiver, and an interface module coupled to the first connector and the wireless transceiver, and 3. the controller comprising an interface for receiving serial data from the reader, means for comparing the received data with at least one stored item of data and means for generating an unlock signal in response to the received data matching the stored item of data, the short-range packet wireless transceiver being arranged: 1. to transmit a beacon signal, and 2. in response to receiving data in at least one data packet, conveying that data to the interface module, the interface module being arranged: 1. in response to receiving data from the wireless transceiver, to convey that data as a serial data signal via the first multi wire connection.

2. By adding the interface module to the existing access control system, the controller is capable of responding both to legacy tags or tokens and to a user device with a security app installed. 5 In one embodiment, the interface device is coupled "parasitically" to the multi-wire connection between the reader and the controller. That is to say that the existing connections between the reader and controller are uninterrupted. In practice, the multiwire connection between the reader and the controller will be cut and each wire within stripped and connected to a terminal connector on the interface. The individual connections between the reader and the controller, however, are maintained rather than interrupted.

In another embodiment, the interface device is connected in between the reader and the controller so as to interrupt the connections between them. This means that existing signals between the reader and the controller must be relayed, meaning that the interface module is further arranged: 1. in response to receiving a serial data signal at the first connector, to convey at least a portion of the serial data signal via the second connector, and 2. in response to receiving a success/failure signal at the from the controller, to convey that signal via the first connector.

The interface module is preferably further arranged, in response to receiving a success/failure signal from the controller, to transmit a success/failure message via the short-range wireless transceiver. This permits notification to the user via his or her device as well as via the reader.

The short-range packet wireless transceiver preferably comprises a BluetoothTM Low Energy (BLE) transceiver. This permits communication with a very large proportion of user devices which include a Bluetooth interface.

The wireless transceiver is preferably arranged to respond only to signals transmitted over a distance of less than substantially 10 metres. This is to ensure that the user device is actually close to the controlled door before it is opened by the controller.

The wireless transceiver is preferably arranged to respond to signals having a RSSI value above a predetermined threshold. This provides a preferred way to ensure that the user device is close to the controlled door.

The data in the at least one data packet is preferably encrypted and the interface module is further arranged to decrypt the data.

The multi-wire connections preferably comprise power (e.g. 12V), ground (e.g. OV), clock and data lines. This ensures broad compatibility with legacy access control systems and the multi-wire connections more preferably comprise success and failure lines. Other legacy access systems to which embodiments of the present invention may be applied include the Wiegand format and the Open Supervised Device Protocol (OSDP).

The interface may be provided on its own, to permit retrofitting to an existing access control system.

According to a second aspect of the present invention, there is provided an interface device for an access control system comprising a reader and a controller coupled to the reader by a multi-wire connection, the interface device arranged to be coupled to the multi-wire connection between the reader and the controller, the interface device comprising: 1. a first connector for coupling the interface device to the reader via the multi-wire connection, 2. a short-range packet wireless transceiver, and 3. an interface module coupled to the first connector and the wireless transceiver, the wireless transceiver being arranged: to transmit a beacon signal, and in response to receiving data in at least one data packet, conveying that data to the interface module, the interface module being arranged: in response to receiving data from the wireless transceiver, to convey that data as a serial data signal to the controller via the multi-wire connection.

The same preferred features of the access control system according to the first aspect of the invention may equally be applied to the interface device according to the second aspect of the invention. According to a third aspect of the present invention, there is provided a method of operating an interface device according to the second aspect of the invention, the method comprising: transmitting a beacon signal, and in response to receiving data in at least one data packet at the short-range wireless transceiver, transmitting that data as a serial data signal to the controller.

The method preferably further comprises transmitting, from the short-range wireless transceiver, a success/failure message to a user device.

The method preferably further comprises measuring the RSSI of signals received at the transceiver and discarding received signals having a RSSI value that does not exceed a predetermined threshold. The method preferably further comprises decrypting signals received at the transceiver before transmitting that data as a serial data signal.

The present invention will now be described, by way of example, with reference to the accompanying drawings, in which: Figure 1 shows a block diagram of a legacy access control system, Figure 2 shows a block diagram of an access control system according to an embodiment of the present invention, Figure 3 shows a block diagram of an interface device according to an embodiment of the present invention, Figure 4 shows a flow diagram of the operation of the interface device shown in Figure 3, Figure 5 shows a diagram illustrating the verification and signing of a user device, Figure 6 shows a block diagram of another access control device according to an embodiment of the present invention, Figure 7 shows a flow diagram of the operation of the interface device of Figure 6, and Figure 8 shows an open collector interface.

Figure 1 shows a legacy access control system 100 comprising a tag or token 102, a reader 104, a controller 106 and a door solenoid 108. The reader 104 is located on the unsecured side of a wall or barrier 110 while the controller and door solenoid are located on the secure side of the wall or barrier. The reader 104 emits an electromagnetic signal 112 at 125kHz which is used to activate and power the token 102. The token 102 comprises a passive tag arranged to wirelessly convey a code to the reader 104. This is typically done by altering the impedance of a receiver in the token and these variations in impedance can be detected by the reader 104. The reader further includes a visual indication of successful access (e.g. green LED 114) and an indication of failure (e.g. red LED 116).

The reader 104 is coupled to the controller by a multi-wire cable 118 including lines for power (e.g. 12 volt), Ov, clock, data and LED control. The cable 118 is attached to the reader by a connector 120 and to the controller by a connector 122. The connectors may comprise plugs and sockets or soldered or other contacts. The controller 106 is coupled to the door solenoid 108 by at least two lines for instructing the solenoid to unlock the door.

When a token 102 is placed within range of the reader 104, it receives electromagnetic energy from the transmission 112 which is used to power its circuitry. The token will then "transmit" a stored user code to the reader 104 typically by altering the impedance of the receiver in the token. These variations in impedance are detected by the reader and sent as a serial data signal to the controller 106 over the cable 118. The controller then compares the code with one or more stored codes to determine if it is valid. If the code is valid then the controller will instruct the solenoid 108 to open the door and signal to illuminate the green LED 114 at the reader. If the code is not valid, the controller will signal to illuminate the red LED 116 at the reader. The reader may also provide audible feedback of the success or failure of an access attempt.

While Figure 1 shows a system that operates with a passive tag at 125kHz, other frequencies may be used such as in the range 125kHz to 135kHz (Low Frequency or LF) or at 13.56MHz (High Frequency or HF).

The system could equally be an active system (i.e. the tag includes a power source) which operates at these frequencies or at higher frequencies such as between 868MHz and 930MHz (Ultra High Frequency or UHF) or at 2.45GHz or 5.8GHz (Microwave). An active system will comprise a transceiver in the reader.

Figure 2 shows an access control system 200 according to an embodiment of the present invention. Tag 202, reader 204, controller 206 and solenoid 208 may be identical to their counterparts in Figure 1. The system 200 further comprises an interface device 226 for interacting with a user device such as a mobile phone 228 upon which is installed a security app 230. This app may be a known app for use with a known app-based security system. The interface 226 is connected between the reader 204 and the controller 106. This is typically done by cutting the exiting multi-wire cable and connecting the reader side and the controller side to the interface. The interface is located on the secure side of a door or barrier (not shown). A connector 230 on the interface is coupled to a connector 220 on the reader 204 by a multi-wire cable 218. A connector 232 on the interface is coupled to a connector 222 on the controller 206 by a multi-wire cable 234. The interface device 226 includes a wireless transceiver (discussed further below with reference to Figure 3).

The access control system 200 is capable of responding to both legacy tokens 202 and a security app 230 installed on a user device 228.

As for the system of Figure 1, when a token 202 (being an active or passive token) is presented to the reader 204 it responds to an electromagnetic signal 212 and conveys its stored code to the reader. The reader sends the code, as before, as a serial signal via the connector 220 but in this case it is intercepted by the interface 226. Upon receiving such a signal, the interface simply passes it on to the controller 206 via the connector 232 and cable 234. The controller will decide whether the code is valid and send a success or failure signal to the LEDs 214, 216 via the connector 222 and cable 234. This signal will be intercepted by the interface 226 and passed on to the reader 204 to illuminate a green LED 214 or a red LED 216 and the door will be unlocked if appropriate. The interface may be installed by cutting the existing cable (118, Figure 1) and connecting the two new ends to the connectors 230, 232 on the interface 226.

The interface 226 is also responsive to a security app 230 installed on a user device 228 as will be described with reference to Figures 3 and 4.

Figure 3 shows a block schematic diagram of an interface device 300 according to an embodiment of the present invention. The interface device is intended to be located on the secure side of the barrier (110, Figure 1) but close enough to the reader that short-range radio signals can be received from the user device (228, Figure 2).

The interface device comprises an interface module 302 and a short-range packet radio transceiver 308 connected to the module. The transceiver 308 is arranged to transmit a beacon signal which is received by the user device 312. In response, the user device transmits a signal to the transceiver which relays data contained in that signal to the interface module 302. The module 302 converts that data into a serial signal having a format compatible with the controller (206, Figure 2) and transmits the serial signal to the controller. The controller treats the signal as though it had been received from the reader (204, Figure 2).

The signal transmitted by the user device comprises an authorisation code (or Auth token) which will be described further below. In order to conserve resources at the user device, it may be arranged to only listen for beacons in response to user action, such as opening the app or pressing a button on their device. Alternatively, the user device (under control of the app) may be activated to listen for beacon signals in response to receiving a Near Field Communication (NFC) signal or reading an optical code such as a barcode associated with the reader.

The short-range packet radio transceiver preferably has a receiving range not exceeding a few metres, for example substantially 10m, to ensure that the user device communicating with the transceiver 308 is actually close to the controlled door.

The short-range packet radio transceiver 308 may comprise a BluetoothTM or Bluetooth Low Energy (BLE) transceiver as these are widely compatible with user devices. The range of such devices can be up to 100 metres so the transceiver 308 is preferably arranged to respond only to signals from a user device that exceed a predetermined RS51 value.

Alternatively, or in addition, the app on the user device may be arranged to read the device's position (e.g. by way of GPS or triangulation, for example) and transmit that location to the interface device. The interface device will then determine whether the user device is actually in proximity to the controlled door. If not, the interface device will just not forward the user code to the controller.

Alternatively, the user may tap their device on a Near Field Communication (NFC) tag in the vicinity of the door or controlled area. The device may then receive a unique code that guarantees that the user device is in the expected location.

If the user device is determined to be too far from the controlled door, the interface device may send a message to the user device to indicate this.

Figure 4 shows the sequence of steps 400 in an access method according to an embodiment of the present invention. It is assumed that the user's device has an access app installed (either ab initio or via an app store) and that it has been verified as described below with reference to Figure 5. Figure 4 illustrates the main communications -the skilled reader will appreciate that there may be other handshakes, acknowledgements, timeouts etc. The method starts at step 402 and at step 404 the transceiver (308, Figure 3) starts transmitting a beacon signal. This beacon signal uniquely identifies a door or area (there may be multiple points of access to the area or multiple areas that are accessed on the same basis). The beacon signal is preferably transmitted periodically.

At step 406, the interface device determines whether it has received a signal from a user device, i.e. via the short range wireless transceiver (308, Figure 3). If yes, then the interface device optionally determines whether the RSSI of the received signal is above a threshold. If yes (or if no RSSI determination is made), then the interface device derives a serial data signal from the received signal at step 410 and transmits this serial data signal to the controller at step 412. The received signal will generally comprise an Auth token which the user device has received from a server or cloud service in known manner. If the RSSI signal is not above the threshold then these two steps are not performed and the interface device may transmit a message to the user device to inform the user that they are out of range.

Processing proceeds to step 414 in which the interface device determines whether it has received a data signal over the first multi-wire connection, i.e. from the reader. If yes, the interface device relays this signal to the controller over the second multi-wire connection at step 416.

Processing proceeds to step 418 in which the interface device determines whether it has received a success/failure signal over the second multi-wire connection, i.e. from the controller. If yes, the success/failure signal is relayed to the reader over the first multi-wire connection at step 420. In preferred embodiments, the interface device also transmits the success/failure signal to the user device at step 422.

Processing proceeds to step 406 and the method is repeated (it is assumed that the beacon continues to be transmitted periodically).

The user codes (or Auth tokens) sent by a user device to the interface device may be derived in any suitable manner. An Auth token may be obtained from a server or cloud service in response to the user device detecting a beacon signal or to a user activating the app on their device. Auth tokens may be downloaded to the user device in advance and stored locally, which is necessary if there is no internet reception near the controlled secure area. Such tokens will usually have a limited period of validity and will be updated periodically from the server or cloud service. The limited period of validity for such tokens means that the authorisation of a device may be suspended or terminated (by not sending any fresh tokens) in response to a loss of the user device etc. The Auth tokens may be compatible with another access control system to which the user has access. A user may thus, with a single app, intercat with both modern and legacy access control systems.

Figure 6 shows a block diagram 600 of another embodiment of an access control system according to the present invention. The embodiment of Figure 6 bears some similarity with the embodiment of Figure 2 but the interface device is arranged differently and has some different functionality. The interface device 626 comprises an interface module 632 and a short range packet transceiver 634 as for the embodiment of Figure 2. However, instead of being connected between the reader and the controller, the interface device is connected to the multi-wire link between the reader and the controller without interrupting the links between them. This is typically done by cutting the exiting multi-wire cable and connecting the reader side and the controller side to the interface.

A reader 604 transmits a carrier signal 612 and is responsive to a tag 602 as previously described. As before, the tag 602 may be a passive tag or an active tag and may operate at a variety of frequencies. The reader is provided with a success indicator such as a green LED 616 and a failure indicator such as a red LED 614. The reader also has a multi-wire interface 620 connected to a corresponding interface 622 on a controller 606. The controller 606 is also connected to a door solenoid 608. So far, the system comprises components equivalent to those shown in Figure 1.

The system further comprises an interface device 626 which comprises an interface module 632 and a short-range packet transceiver 634. The transceiver 634 corresponds to the transceiver 308 in Figure 3 and is arranged to communicate with a user device 628 which has a security app 630 installed.

The interface module 632 is arranged to convert Auth tokens received from the user device 628 to a serial data signal compatible with the controller 606. In contrast to the module 302 (Figure 3), the module 632 conveys this serial data signal to the controller 606 via an open collector connection. This will be described with reference to Figure 8 below.

The interface module 632 may optionally be connected to receive the success/failure signals from the controller and transmit a success/failure indication via the transceiver 634 to the user device 630. The security app 630 on the user device may then provide a success/failure indication to the user.

In this embodiment, since the connections between the reader and the controller have not been interrupted, the interface device 626 may be provided with less functionality than the interface device 226 (Figure 2). The reason is that the interface device is not required to forward the signals from the reader to the controller or the success/failure signals from the controller to the reader.

In order to facilitate the connection of the interface device 626, the interface device 626 uses open collector connections to the multi-wire connection between the reader 604 and the controller 606. The open collector connections allow the interface device to send signals to the controller (effectively imitating the reader) or to the reader (effectively imitating the controller. The latter case allows the interface device to control the green and red LEDs on the reader, for example. Open collector connections are described with reference to Figure 8 below.

Figure 7 shows a flow diagram for the operation of the interface device 626 (Figure 6). The process starts at step 702 and at step 704, the transceiver starts to transmit a beacon signal. At step 706, the interface device determines whether an Auth token has been received over the packet radio link from a user device. If so, processing continues to the optional step 708 in which the interface device determines whether the signal from the user device is sufficiently strong, implying that the user device is close enough to the secure area. If so (or if the ft55I test is not conducted), the interface module generates a serial data signal from the auth token at step 710. This serial data signal is in the format of the signals sent from the reader to the controller. At step 712, the module sends the serial signal to the controller by altering the state of a data line between the reader and the controller.

Processing proceeds to step 714 in which the interface module monitors the success/failure lines between the controller and the reader. If a success or failure signal is detected then this is relayed to the user device at step 716. Processing returns to step 706.

The flow chart of Figure 7 has many features in common with the flow chart of Figure 4 but lacks those steps concerned with relaying signals between the reader and the controller (since the lines carrying these signals are not interrupted in this embodiment). The auth tokens may be generated and distributed in the same manner as for the embodiment of Figure 4.

While measuring RSSI has been disclosed as a test of user proximity, the skilled person will appreciate that other techniques could be used such as geolocation or reading a NFC tag. Figure 8 shows a circuit diagram 800 of an open collector interface such as is typically used in readers to which embodiments of the present invention may be applied. The emitter 804 of a NPN transistor 802 is connected to zero volts or ground. The collector 806 of the transistor is connected to the positive supply (e.g. 12V) via a resistor 808 (known as a pull-up resistor). An output 810 is connected to the collector 806 and an input is connected to the base 812 of the transistor. When the transistor is not conducting, the output 810 is pulled high by the resistor 808. In order to provide a low output, a voltage is applied to the base of the transistor, the transistor conducts and the output 810 is at (or near) zero volt.

The beauty of such an arrangement is that further transistors may be wired to the open collector interface without interrupting any existing connections. A further NPN transistor 814 is connected with its collector 816 and emitter 818 connected respectively to the collector 806 and emitter 804 of transistor 802. The base 820 of transistor 814 comprises a second input. The output 810 will be pulled high by the resistor 808 unless either transistor 802, 814 conducts. Signals can thus be passed to the legacy controller by either transistor. Functionally, this operates as a NAND gate. This allows the interface device described with reference to Figure 6 to be retrofitted without interrupting the multi-wire connection between the legacy reader and legacy controller.

Figure 5 shows a process 500 whereby a manufacturer 502 initializes an app on a user device 504. The app may be pre-installed in the user device but will more typically be downloaded and installed from an app store.

The manufacturer has a private key 506 stored in a secure vault and a corresponding public key 508 which is shared with the app (or may be hard coded into the app). The app generates an app public key 510 and a corresponding app private key 512. The app public key is shared with the manufacturer.

The app receives a verification code 514 from the manufacturer via a suitable channel such as SMS or email. This code is only valid for a predetermined time. The app then encrypts the verification code using the manufacturer's public key 508 and its own public key 510 to generate encrypted data 516. This is shared with the manufacturer.

The manufacturer then decrypts the encrypted data 516 with its private key 506 and verifies that the code 514 is correct. The manufacturer then generates a signature 518 for the app's public key 510 and sends this to the app. The app can then authenticate itself to other elements of the access control infrastructure.

After initialisation, as shown in Figure 5, the phone app may be sent time limited 'Auth Tokens' which are specific to particular interfaces, or secure areas. The Auth tokens will be selected to allow access to the secure areas for which the owner of the user device is permitted. When an app scans NFC/receives beacon/has software button pressed, it identifies the 'Auth Token' for that particular door, and transmits it over the short range packet radio link to the interface. As stated above, the Auth tokens may be generated and distributed to user devices using any suitable technique.

For ease of description, the present invention has been described in the context of a door through which a user can enter a secure area. However, the skilled reader will appreciate that the disclosed access control may equally apply to a gate, turnstile, barrier, elevator or other means of accessing a secure area.

Claims

CLAIMS1. An access control system comprising a reader, an interface device and a controller, the reader comprising a transmitter for communicating with a token and a serial interface for transmitting data over a first multi-wire connection to the controller, the interface device comprising a first connector coupling the interface device to the reader via the first multi-wire connection, a short-range packet wireless transceiver, and an interface module coupled to the first connector and the wireless transceiver, and the controller comprising an interface for receiving serial data from the reader, means for comparing the received data with at least one stored item of data and means for generating an unlock signal in response to the received data matching the stored item of data, the short-range packet wireless transceiver being arranged: to transmit a beacon signal, and in response to receiving data in at least one data packet, conveying that data to the interface module, the interface module being arranged: in response to receiving data from the wireless transceiver, to convey that data as a serial data signal via the first multi wire connection.
2. An access control system as claimed in claim 1, wherein the interface device is coupled to a plurality of lines comprising the first multi-wire connection between the reader and the controller.
3. An access control system as claimed in claim 1, wherein the interface device is coupled to the reader via the first connector and is coupled via a second connecter to the interface of the controller, the interface module being further arranged: in response to receiving a serial data signal at the first connector, to convey at least a portion of the serial data signal via the second connector, and in response to receiving a success/failure signal at the second connector, to convey that signal via the first connector.
4. An access control system as claimed in claim 1, claim 2 or claim 3, wherein the interface module is further arranged, in response to receiving a success/failure signal from the controller, to transmit a success/failure message via the short-range wireless transceiver.
5. An access control system as claimed in any one of the preceding claims, wherein the short-range packet wireless transceiver comprises a BluetoothTM Low Energy transceiver.
6. An access control system as claimed in any of claims 1 to 5, wherein the wireless transceiver is arranged to respond only to signals transmitted over a distance of less than substantially 10 metres.
7. An access control system as claimed in any one of the claims 1 to 4, wherein the wireless transceiver is arranged to respond to signals having a RSSl value above a predetermined threshold.
8. An access control system as claimed in any one of the claims 1 to 7, wherein the data in the at least one data packet is encrypted and the interface module is further arranged to decrypt the data.
9. An access control system as claimed in any of the claims 1 to 8, wherein the multi-wire connections comprise power, ground, clock and data lines.
10. An access control system as claimed in claim 9, wherein the multi-wire connections further comprise success and failure lines.
11. An interface device for an access control system comprising a reader and a controller coupled to the reader by a multi-wire connection, the interface device arranged to be coupled to the multi-wire connection between the reader and the controller, the interface device comprising: a first connector for coupling the interface device to the reader via the multi-wire connection, a short-range packet wireless transceiver, and an interface module coupled to the first connector and the wireless transceiver, the wireless transceiver being arranged: to transmit a beacon signal, and in response to receiving data in at least one data packet, conveying that data to the interface module, the interface module being arranged: in response to receiving data from the wireless transceiver, to convey that data as a serial data signal to the controller via the multi-wire connection.
12. An interface device as claimed in claim 11, further comprising a second connector for coupling the interface device to the controller via a multi-wire connection, the interface module being further arranged: in response to receiving a serial data signal at the first connector, to transmit at least a portion of the serial data signal via the second connector, and in response to receiving a success/failure signal at the second connector, to convey that signal via the first connector.
13. An interface device as claimed in claim 11 or claim 12, wherein the interface module is further arranged, in response to receiving a success/failure signal from the controller, to transmit a success/failure message via the short-range wireless transceiver.
14. An interface device as claimed in claim 11, claim 12 or claim 13, wherein the short-range packet wireless transceiver comprises a BluetoothTM Low Energy transceiver.
15. An interface device as claimed in any of claims 11 to 14, wherein the wireless transceiver is arranged to respond only to signals transmitted over a distance of less than substantially 10 metres.
16. An interface device as claimed in any one of the claims 11 to 15, wherein the wireless transceiver is arranged to respond to signals having a RSSI value above a predetermined threshold.
17. An interface device as claimed in any one of the claims 11 to 16, wherein the data in the at least one data packet is encrypted and the interface module is further arranged to decrypt the data.
18. An interface device as claimed in any of the claims 11 to 17, wherein the multi-wire connections comprise power, ground, clock and data lines.
19. An interface device as claimed in claim 18, wherein the multi-wire connections further comprise success and failure lines.
20. A method of operating an interface device as claimed in any one of the claims 11 to 19, the method comprising: transmitting a beacon signal, and in response to receiving data in at least one data packet at the short-range wireless transceiver, transmitting that data as a serial data signal to the controller.
21. A method as claimed in claim 20, further comprising: in response to receiving a serial data signal at the first connector, transmitting at least a portion of the serial data signal to the controller, and in response to receiving a success/failure signal at the second connector, transmitting that signal to the reader.
22. A method as claimed in claim 20 or claim 21, further comprising transmitting, from the short-range wireless transceiver, a success/failure message to a user device.
23. A method as claimed in claim 20, claim 21 or claim 22, further comprising measuring the RSSI of signals received at the transceiver and discarding received signals having a RSSI value that does not exceed a predetermined threshold.
24. A method as claimed in any one of the claims 20 to 23, further comprising decrypting signals received at the transceiver before transmitting that data as a serial data signal.