Transcription
PAGE 1ARTICLEUL’s Fire and Security Service SolutionsUnderstanding Line SecurityThe full value of a security alarmsystem can only be realized if thedetection of an intruder is madeknown to people who can take actionin response. UL Standards providerequirements for Line Supervision andLine Security that address this criticalelement of a security system. Line Supervision requirementsprovide increased assurance of afunctioning communication pathbetween protected property andmonitoring center Line Security requirementsprovide increased assurance thateven surreptitious attacks will bedetected and announced at themonitoring centerAs the level of risk increases at aprotected property, so does the valueof resiliency and reliability in alarmsignal communications. For lower risk applications, wherethe threat of surreptitious attackis low, a non-Line Security ratedsystem that checks the integrityof the communication path onceevery 24 hours may be adequate For higher risk applications, wherethe threat of surreptitious attackis high, a Line Security ratedsystem that checks the integrityof the communication path onceevery few minutes may be moreappropriate based on a reviewthe individual environmentSelecting an appropriate systemis about balancing the level of riskagainst the total cost of ownership,which includes the options availablefrom both your security andcommunications service providers, aswell as any consequences of signalingfalse alarms.building by cutting cables or damagingradio antennas, there is reason to treatthe event as a sign of an intrusion.Line SupervisionLine Supervision is the occasionalsignal confirmation of acommunication path accomplishedby regularly sending and receivingmessages over the path in a specifiedtimeframe. It is a foundationalrequirement in all UL Alarm SystemStandards. The 2-way exchangebetween the protected propertyand the monitoring station is oftenreferred to as a ‘check-in’.The frequency of check-ins requiredby UL Standards is driven by riskdetermination. Relatively low riskresidential scenarios may require onecheck-in every 24 hours. Higher riskcommercial applications, e.g. a jewelryoperation, may require a check-in asoften as once every 200 seconds.When the alarm system at aprotected property fails to check-inwith the monitoring station withinthe specified timeframe, the causeis usually uncertain. Since criminalsfrequently try to disrupt alarmcommunications prior to entering aOn the other hand, a failed check-incould have nothing to do with asurreptitious attack, but rather acommunications network problem.In this case, requesting a lawenforcement response could result infalse alarm fines and other negativeconsequences incurred by theproperty owner.For this reason, many contemporarysystem designs provide multiplecommunication paths, often usingdifferent technologies. For example,a system that uses both a wired andwireless communication method can
PAGE 2remain in contact with a monitoringstation even if one network goesdown, thus maintaining the desiredlevel of communication pathassurance and reducing the chances ofinitiating a false alarm.“Mission Impossible”AttacksWhile a simple signal check-inmay verify the existence of acommunication path, it does notprovide assurance that the receivedsignals are authentic.A staple of the popular Hollywoodheist movie is the trusty “alligator clipconnection” that feeds a prerecordedvideo loop of an empty room to aguard station. The bad guys cut thereal camera wires, attach the alligatorclips, and go about their dastardlydeeds undetected while the guardstation sees a vacant room andassumes everything is normal. Thisis known as a substitution attack.Early intrusion detection systemswere susceptible to similar kinds ofsubstitution attacks, where batteries,signal generators, or carefullyprepared replacement control unitscould be swapped for legitimatelyinstalled units.Smash-and-grab, or social engineeringbased attacks, may be more frequentthan “Mission Impossible” styletechnical attacks. However, high valuetargets like jewelry stores, are morelikely to attract criminals that possessthe high-level technical skills neededto successfully carry out such attacks.UL Line SecurityRequirementsTo address these higher leveltechnical vulnerabilities, surreptitiousattack testing and a Line Securitydesignation/rating, for productsthat meet the test requirements,were added to UL Alarm EquipmentStandards. Understanding that theseadvanced safeguards would be usedto protect high risk accounts, theconsensus of stakeholders was thatthe check-in frequency for a systemin Line Security mode should be 200seconds or less.Additionally, UL Alarm ServiceStandards gave alarm companiesthe ability to declare Standard LineSecurity service on certificatescovering protected properties, whena Line Security rated product isinstalled and properly configuredto operate in Line Security mode.When technological advancesmade encryption of alarm signalsfeasible, the Encrypted Line Securitydesignation was made available forproducts that could add encryptedmessaging on top of the ability todetect surreptitious substitutionattacks.Note that the complete Line Security2-way communication protocolrequires an “always on” typecommunication path. Line Securityrequirements cannot be met bysystems that communicate using10 digit dial-up service over wired orwireless public switched telephonenetwork (digital alarm communicatortransmitters – DACTs – in alarmindustry terminology).The Many Flavors of LineSecurity and How toChooseThe concepts underlying Line Securityare relatively simple and straightforward – check-in often, detect andannunciate surreptitious attacks inreal time.Line Security Rated equipment can beconfigured to detect attack straightout of the box; a user pays for thecapability as part of the productprice. However, the cost of check-infrequency depends on carrier pricingplans and can change as newertechnologies and/or pricing modelsare introduced.When requirements were firstdeveloped, telecommunicationssystems were much simpler andlimited in variety. Consensusamong UL Standard stakeholders,that balanced risk with availabletechnology and costs, established the200 second check-in frequency forcommercial burglar alarm systems.As telecommunication technologieshave evolved, the 200 second checkin frequency requirement becamedifficult to do at reasonable cost. Inresponse, the industry developedsystems that utilize multiplecommunication paths and supportless frequent check-ins. These typesof systems still maintain a high levelof communication resiliency, due tothe use of multiple communicationpaths, but can reduce the long termtelecommunication costs associatedwith frequent check-ins.That cycle of innovation has occurredseveral times and is reflected inthe set of Line Security optionsrecognized in today’s UL Standards.The cost effectiveness of some ofthese configurations depends on thetelecommunication provider’s pricingplans. In general, the configurationsoffer reduced check-in times foradditional (‘back-up’) communicationpaths. Selecting an appropriatearrangement is about balancing thelevel of risk against the total cost ofownership, which would include theoptions available from both yoursecurity and communications serviceproviders, as well as any consequencesof false alarms in your community.
PAGE 3Line SecurityWhen working with your alarm service provider, be sure that your expectation of receiving Line Security service is specified inyour contractual agreements. Most contemporary commercial security systems can be configured or programed to provideLine Security, but that Line Security configuration is generally not the default mode. The system will need to be programmedappropriately by your installation technician.UL Standard requirements call for annual or more frequent inspection and testing by your service provider. Asking your technicianto verify Line Security during each inspection can help to provide added assurance that your expectations are being met.Communication Method OptionsCommunication method options for Line Security are described in the UL Standard UL 681, The Standard for Installation of Burglaralarm Systems. A UL Listed alarm service provider will be familiar with UL Standards and can help clarify requirements to helpensure the choice you make meets your needs and expectations.The following descriptions start with the Single Path configuration, a simple arrangement that forms a baseline which can beadded to for increased security.Single ary of the protected property)Single path Line Security requires a communication technologythat can support the required 2-way communication protocolsand have sufficient bandwidth to check-in with the monitoringcenter every 200 seconds. Both wired and wireless datanetworks can generally support Line Security. The publicswitched telephone network, used by auto-dialers (DACTs),cannot.The use of a single path can help to minimize communicationcosts, however, the arrangement is more susceptible tonetwork interruptions. If a network interruption occurs whilethe alarm system is armed, the monitoring station is requiredto treat it as an ‘intrusion in progress’ and initiate the properprotocols. In many cases, this would mean dispatching lawenforcement, which brings the risk of false alarm fines or otherlocal measures/penalties.Pros: Minimizes initial cost of equipment and cost of maintenanceCons: Lack of a backup communication path in the event of a network interruptionIn some cases, the alarm system subscriber could end up paying multiple false alarm fines or other penalties, negating the costsavings of this option.
PAGE 4Dual PathControl unitA dual path system uses a communication path thatsupports the required 2-way protocols as its primarymeans of communicating to the monitoring station(the modem line in the above illustration). It also uses asecond communication path as a secondary means ofcommunicating. The secondary path is not required tosupport Line Security and is typically a phone line (10digit dial-up number, voice grade, wired or wireless).Modem*CommunicationcloudDACT(Boundary of the protected property)This configuration may help reduce communicationcosts in situations where communication costs arebandwidth sensitive. Providing a dual path reduces thefrequency of required check-ins on the primary pathfrom once every 200 seconds to once every 360 seconds.Check-in on the secondary path is only once every 24hours.In a Dual Path system, a communication failure on the primary path results in a signal being transmitted on the secondary path.If this event happens when the system is armed, it would be handled as an alarm signal. If the system is unarmed, it would be atrouble signal and a service technician would be dispatched.Until the primary path is restored, the alarm system would still be able to communicate via the secondary path, but in a degraded,non-line security mode.Pros: In the event of a communication failure on the primary path, the signal is transmitted on the secondary path (back-up). Thissignal is treated as a trouble signal if the system is unarmed, which results in the dispatch of a service technician, rather thanthe local law enforcement. May help reduce communication costs in situations where communication costs are bandwidth sensitive Reduces the frequency of required check-ins on the primary path from once every 200 seconds to once every 360 seconds;check-in on the secondary path is only once every 24 hoursCons: Initial installation costs for two communication paths Until the primary path is restored, the alarm system would still be able to communicate via the secondary path, but in adegraded, non-line security modeAlternate Primary PathAlternate primary path employs two communicationchannels, both of which support the required 2-waycommunication protocols and have sufficient bandwidthto check-in every 200 seconds. Use of a wired and wirelesstechnology reduces the risk of total communicationinterruption in the event of outage on one of thecommunication networks.Alternate Primary Path systems can reduce the risk ofunnecessary law enforcement dispatch in the event ofinterruption of the preferred communication path. Thesesystems monitor communication path integrity and if theControl unitWireless datanetworkCommunicationcloudModem*(Boundary of the protected property)
PAGE 5preferred path is not available, can switch to the other path quickly enough to check-in with the monitoring station on schedule.Under these conditions: The monitoring station does not treat the signal as an alarm and law enforcement dispatch is not required Line Security service is still in place - although until full communications are restored, it is of the Single Path varietyPros: Use of a wired and wireless technology reduces the risk of total communication interruption in the event of outage on one ofthe communication networks can reduce the risk of unnecessary law enforcement dispatch in the event of interruption of the preferred communication path Consistent Line Security Service, even if the preferred communication path is interruptedCons: Cost of equipment Costs associated with check-insAlternate Primary with Dual Signal PathControlunitAlternate Primary with Dual Signal Pathconfiguration provides the highest level ofresiliency currently described in UL Standards. Ituses two communication paths both of whichsupport the required 2-way communicationprotocols. The third path is not required tosupport the required 2-way protocols, and istypically a phone line.Wireless datanetworkModem*CommunicationcloudDACTThe addition of a third path reduces the requiredcheck-in frequency on the Line Security path inuse from once every 200 seconds to once every360 seconds. Check-in on the 3rd path is onceevery 24 hours.(Boundary of the protected Property)I’d suggest using a modified version of the tan box on page 5.Alternate Primary with Dual Path is built on top of AlternatePros:Primary,an illustrationflowcurrentlythat doesthe samemight help Providesthesohighestlevel of resiliencydescribedin UL Standardswithcomprehension. Theadditionof a third path reduces the required check-in frequency on the Line Security path in use from once every 200secondstoonce360 secondsBasically, justeveryeliminatethe DACT and associated lines. Let the Check-inonthethirdpathis once every24andhours. wa-la. you havemodem & wireless networkas isAlternate Primary Path for page 4Cons: Cost of equipment Telecommunications cost for 3 linesTo learn more about UL’s Fire and Security Solutions program, please visitUL.com/AlarmService or contact alarmservice@UL.com.UL and the UL logo are trademarks of UL LLC 2019
switched telephone network, used by auto-dialers (DACTs), cannot. The use of a single path can help to minimize communication costs, however, the arrangement is more susceptible to . support Line Security and is typically a phone line (
