WO2010076261A1

WO2010076261A1 - Security system comprising sensors in a corridor for uncovering hazardous items

Info

Publication number: WO2010076261A1
Application number: PCT/EP2009/067717
Authority: WO
Inventors: Jean-Luc Zolesio; Thierry Lamarque
Original assignee: Thales
Priority date: 2008-12-31
Filing date: 2009-12-22
Publication date: 2010-07-08
Also published as: EP2204783A1

Abstract

The invention is a security system for uncovering hazardous persons and objects carried by said persons entering sensitive areas. The system comprises a set of detection sensors and a supervisory sub-system connected to a check-in database. The sensors are for example capable of detecting metallic and non metallic hidden objects, mobile phones, explosive radiological, biological or epidemiological indices as well as abnormal behaviour. They are arranged in modules along a corridor. The persons going through the corridor are monitored by video cameras which allow for continuous matching of the sensors data and the identity of the individual going through control. Individual risk levels are correlated between the sensors and an aggregate risk level is calculated from at least two sensors, taking into account personalized alarm thresholds set by the authorities.

Description

SECURITY SYSTEM COMPRISING SENSORS IN A CORRIDOR FOR UNCOVERING HAZARDOUS ITEMS

The present invention relates to a security system to prevent people who are due to enter a sensitive equipment/area from carrying hazardous items. More specifically, security procedures and systems have been implemented at airport facilities to scan persons and luggage for detecting metallic, liquid or powder objects possibly used as weapons or explosives by terrorists to carry out an attack on board an aircraft. Implementing these procedures and systems post 9/1 1 has created a significant operational burden and cost for the airport authorities, airlines and passengers. The same problems arise at other passenger transportation terminals, such as railway or subway stations, and at facilities which gather a large number of people like department stores, museums, theatres, concert, congress or cult areas. Also, very sensitive areas which have normally a restricted list of persons who are granted access (nuclear power plants, explosive storing facilities, oil rigs, airport tarmacs, embassies, R&D laboratories, etc..) need a very efficient security system because introduction on these premises of hazardous items may have catastrophic consequences. The most common equipment used to detect objects carried by people entering a sensitive area is a dual lane scanning system. The portico lane comprises electro-magnetic detectors positioned at various heights (typically four sources) these detectors being sensitive to metallic objects. Passengers walk across the portico to check that they do not carry any metallic object. In parallel, their hand luggage is submitted to X-Ray scanning in the tunnel lane. The tunnel lane scanner produces an image which is continuously displayed to an operator tasked to check the content of the luggage. The gate scanner produces an alarm in case a metal object is detected on the passenger. Depending upon the sensitivity threshold of the gate scanner, belt buckles or shoe soles may trigger an alarm and the passenger will have to be manually searched. In addition to these controls, some airport authorities implement specific random or targeted manual searches for explosives with detectors to which samples of dust taken from the clothing of selected passengers are applied. Also, international regulations now prohibit transportation of any liquid in hand luggage. Liquids used for personal care have to be hand carried in a specific transparent bag and visually inspected by security personnel. All combined, on average 20% of passengers have to be manually inspected and/or searched. This generates significant operational cost, long queues and disturbance to passengers. Moreover, these procedures and control systems do not deal either with certain types of possible non metallic weapons such as ceramic knives or with explosives possibly carried by passengers not submitted to random or selective searching. This is a reason why improved scanning systems have been designed to overcome these perceived drawbacks and limitations. One improvement is to include millimetre wave active detectors to be able to visualize non metallic hidden objects. This kind of system has in turn encountered limitations because of the high power of the active source needed to comply with the specified sensitivity threshold in a stand alone configuration. This is costly and possibly dangerous to human health. A different kind of improvement consists in combining more than one type of sensor in one portico, for instance by combining X-Ray, millimetre wave and electro-magnetic detectors in a single portico. But the conditions of use of these sensors have generated resistance both among Government agencies and the general public because of the threats to privacy that they create: because of the inclusion of X-Ray scanning in the portico, the nudity of a person is accessible to the operator. Also, the person being scanned must stay immobile for long enough within the portico, which increases time needed for performing the whole control. Altogether (entry time, exposure time plus exit time) can take up to 1 minute. An other limitation of these multi-detector systems is that currently each detector operates independently from one another without any correlation, each detector having its own alarm threshold. There is therefore still a need for an improved security system capable of uncovering various types of objects carried by pedestrians moving in a flow, said system being non intrusive from both health and privacy standpoints, operating without slowing substantially the flow and more accurate thanks to the use of multi-detector correlation.

This is then an object of this invention to provide a security system for evaluating threat levels of elements moving proximal to at least one physical component of said security system, said security system further comprising a communication bus, a supervisory sub-system and a first detection subsystem both connected to said communication bus, said security system being characterized in that it further comprises a set of additional detection sub-systems connected to the communication bus and in that the supervisory sub-system further comprises a data fusion module fit to compute an aggregate risk level of an element as a function of individual risk levels output by the first detection sub-system and at least one additional detection subsystem. It is also an object of the invention to provide a security method for evaluating threat levels of elements moving in a control area, said method comprising a supervisory process and a first detection process, and being characterized in that it further comprises a set of additional detection processes in communication with the supervisory process which comprises a data fusion sub-process fit to compute an aggregate risk level of an element as a function of individual risk levels output by the first detection process and at least one additional detection process.

Another advantage of the invention is a modular architecture which allows various configurations comprising different types of detectors to be installed at one definite site. Specific modules target biological and epidemiological threats and are only needed in specific locations. These modules are designed to be easily plugged in the system, with stand alone energy supply, and sensor processing. Also, the security system of the invention can easily be coupled with a luggage scanning system using traditional X-Ray scanning and/or partly the same sub-systems as the persons' control system.

In addition, the scanning system may receive information from the check-in database (check-in may be operated by an airline in case of on-line check-in or an airport authority in case of on-site check-in ; it may also be a ticketing office operated on-line or on-site in museums, theatres, stadiums or other event facilities) and/or the cross-border identification database. In this manner, different risk profiles can be defined which will possibly impact the weight of the risk factors measured from each detector sub-system and the thresholds of the alarm functions. The invention will be better understood and its various features and advantages will be made more apparent from the description here below of some of the possible embodiments and from the appended drawings, among which:

- Figure 1 represents a schematic view of a security system of the prior art for controlling passengers;

- Figure 2 represents a top view of the physical architecture of a security system in an exemplary embodiment of the invention; - Figure 3 represents a top view of the physical architecture of a security system in a compact embodiment of the invention;

- Figure 4 represents an axonometric view of the physical architecture of a security system in an embodiment of the invention comprising a luggage screening chain; - Figure 5 represents a view of the logical architecture of a security system in an exemplary embodiment of the invention;

- Figure 6A represents a front view of an explosive trace detection subsystem in an exemplary embodiment of the invention;

- Figure 6B represents a detailed axonometric view of a laser sensor of an explosive trace detection sub-system in an exemplary embodiment of the invention;

- Figures 7A and 7B represent a front half view of a hidden object detection sub-system in two embodiments of the invention;

- Figure 8 represents a lateral view of a hidden object detection sub- system in one exemplary embodiment of the invention with an array antenna radar;

- Figure 9A represents a front view of a hidden object detection subsystem in operation in one exemplary embodiment of the invention with an array antenna radar; - Figures 9B and 9C represent respectively the formed beams without and with detection of a hidden object detection sub-system in one embodiment of the invention with an array antenna radar;

- Figure 10 represents a top view of an abnormal behaviour detection sub-system in one embodiment of the invention; - Figure 1 1 represents the flow chart of a risk assessment algorithm in an embodiment of the invention;

- Figures 12a, 12b, 12c, 12d and 12e represent an example of a logical decision table to calculate an aggregate risk level in an embodiment of the invention;

- Figure 13 represents the value domains of an heuristic function of a risk assessment algorithm in an embodiment of the invention.

As can be seen from figure 1 , a security system for controlling persons entering a sensitive area can be built around a traditional portico approach, one side (the left side on figure 1 ) of the portico comprising bulk identification detectors while the other side (the right one on figure 1 ) comprises trace identification detectors. Bulk identification uses imaging sensors capable of locating certain types of objects. Trace identification uses molecular laser absorption analysis to determine the type of substance carried by an individual.

Radio Frequency IDentification (RFID) - Detection is there to identify the passenger passing through the portico: an RFID tag is given to each passenger at check-in and he/she can be tracked on the airport premises; other types of machine readable ticket such as one carrying a bar code can also be used, but needs more cooperation from the passenger; Ray - Detection can be either X or y - Ray imaging. X-Ray imaging is routinely used to scan luggage because of its ability to see through most materials used for suitcases or bags, y - Ray imaging allows classification of the detected objects. Current regulations applicable in Europe forbid the use of X-Ray imaging for scanning human beings because of the intrusive character of such imaging

Metal - Detection is the classical sensor present in a portico to detect metallic weapons. TeraHertz (THz) - Detection is a new type of detection in the microwave band. TeraHertz detection is capable of identifying solid objects which are carried in contact with the body and mask the natural radiation of the body while the same radiation traverses the clothes; therefore a "spot" is detected by this system even when the object is concealed under the clothes. Nuclear Quadrupole Resonance (NQR) - Detection is based on neutron detection. If targeted at nitrogen, this type of detection can detect explosives, most of which contain a high concentration of this type of molecule. It uses the electric quadrupole interaction between the nuclear quadrupole moment and the electric field gradient (EFG) created by an electromagnetic source. The EFG depends strongly on the molecular structure of the targeted object. Trace identification comprises a sampling unit which deals separately with gas-phase and particles. Depending on particle size, different modules then analyze said particles: a Chemical Warfare Analysis (CWA) module is targeted at certain types of molecules known for being used as warfare agents; a Nuclid detection module is targeted at certain types of nuclids; alike, an Explosive detection module and a Biological detection module are targeted at other defined types of molecules/agents. The drawbacks of this type of systems are summarised hereunder:

- They need cooperative behavior from the screened person: for instance people must enter a cabin, stand with arms up and wait for a significant number of seconds that measures are conducted before going out, - They could create safety concerns as they use active sensors, potentially dangerous for human health;

- They usually don't respect privacy as they rely on imaging technologies able to produce very accurate body images with picture resolution good enough for revealing intimate parts of the person: tests in some airports have finally been cancelled;

- Each detection system brings an individual score related to the threat it is supposed to detect; this score is compared with a pre-determined threshold in order to eventually raise an alarm; as a result, whenever a passenger produces several alert scores but each less than its corresponding threshold, a potentially dangerous case due to a high risk combination will not raise an alarm;

- They do not address the whole scope of identified threats of aircraft boarding scenario; they usually do not detect systematically explosives (bulk or traces), non metallic weapons (ceramic guns or knives), biological components (infectious agents, viruses...), radioactive components (dirty bombs), epidemic threats, etc...

- They are stand-alone systems and most of the time they are not connected to any e-boarding solution or global security supervisory system in the airport;

- They do not store screening history and therefore do not offer any possibilities for background data mining;

- They do not feedback real-time individual information to people.

This invention has been designed to address eight operational goals commonly accepted as key to better address the security concerns at sensitive facilities, notably airports. These eight goals are:

- Improve the security control level by detecting metallic objects, plastic objects, ceramic objects, liquids, explosive materials, radioactive components (even if these different things are hidden under clothes), explosive precursor traces, pre-determined biological components, epidemiological risks ( fever, known viruses...);

- Give a risk assessment relating to the presence of non authorized objects or the presence of explosive precursor traces or the presence of biological and/or epidemiological threats;

- Alert competent people when the risk assessment is higher than a predefined threshold taking into account individual characteristics (such as flight destination, specific people profile);

- Improve the comfort level for people being checked by suppressing any cooperative specific action and by minimizing people body search

(people body search could be a major concern due to moral, legal or religious restrictions);

- Improve the overall approved level of security control by using mainly passive sensors, by hiding sensors in walls, or behind walls, and by respecting everybody's privacy (no display of body characteristics); - Increase people flow through the control security equipment by checking people in movement and reducing the use of specific in depth analysis such as body search;

- Recognize people identity inside the control system using a link with any previously captured data base enrolment system (for instance, up to a few minutes or hours before aircraft boarding, or coming from any pre-established data bases as it could be within specific sites like nuclear centers), and also interact with any passenger's mobile phone in order to cross-check his ID (Identity) with his SIM (Subscriber Identity Module) identifier or IMEI (International Mobile Equipment

Identity) number;

- Inform people with individual targeted information during the security control such as for instance his/her departure gate number, the available time before boarding, specific duty free advertisement in connection with his/her flight destination.

The physical architecture of the system according to one embodiment of the invention is depicted in figure 2.

The security system of the invention uses a multi-sensor approach and adapted information fusion algorithms. Its implementation is scalable, from one to N modules or sub-systems depending on any operational requirements. The system is made up of a corridor shown on figure 1 , with different embodiments which will be further described further down in the specification of the invention in relation with figures 2 and 3. This corridor is therefore modular. A corridor is made up of a succession of physical modules shown on figure 1 , each module having two walls perpendicular to the ground, each wall of each module comprising elements of said module as further described. Each module can be topped by a roof or by part of a roof to hold some of the sensors, namely the fish-eye camera which is a component of the abnormal behavior detection sub-system, as described further down in the specification. The physical appearance of the modules can be designed so that the corridor is seamlessly integrated in the environment of the control area.

The corridor has an entrance and an exit, one or both of which having an axis which may be non parallel to the axis of the corridor so that the flow of persons passing through the corridor may be regulated more easily. Additionally, a turnstile can be provided at the entrance of the corridor if there is a specific need to better regulate the flow. This configuration is also fit for optimization of the efficiency of one of the detection sub-system, namely the hidden object detection sub-system, as described further down in the specification.

It is also possible to install more than one corridor on the same premises. In this case, the different corridors may share the same supervisory sub-system as will be explained in relation with figure 5. Each module is independent and autonomous and communicates with the other using an ESB architecture (Enterprise Services Bus). The corridor is organized to include several modules totally independent in terms of power management and software systems as described in the specification of this invention. These modules are then easily linkable using a plug and play facility for power management and for software supervision. Each of the modules contains three kinds of sensors, a dedicated computer and interfaces dedicated to power management and plugging with a supervisory sub-system.

A definite module performs a specific detection function and comprises: - At least one video camera; for instance one may use a device of the same type as a Philips™ webcam SPC1300NC (CMOS - 1 ,3Mpixels - ΘMpixels interpolated); this camera has some features which are useful for this application (a wide-angle lens, motion detection and automatic face tracking); this video camera is used to identify the person passing in the corridor by matching his/her face to a picture taken either at a check-in facility or at the first module of the security system; in the first case, it is possible to fully identify the person going through the security system; in the second case, it is only possible to make sure that the sensors measurements of each sub-system are attributed to the correct person, matching is achieved by face recognition algorithms which are performed locally; the processing computer can be for example a personal computer like DELL™ T5400 - XENON™ E5405 QuadCore 3,16 GHz / Windows XP running image analysis algorithms of Cognitec™. Processing power needed is not excessive since recognition is performed against a small number of persons present in a local database and not against a massive number of persons present in a homeland security database. It is also possible to do the processing centrally (at the supervisory sub-system level described further down in the specification) provided that the number of sub-systems is not too high;

- At least two photoelectric cells; the first cell is located at the entrance of the module and triggers a first time top which is recorded both in the video stream and in the captured sensor data; the second cell is located at the exit of the module and triggers a second time top which is also recorded both in the video stream and in the captured sensor data; therefore, the identification of the person passing through the module and the captured sensor data can be matched without ambiguity, provided however that a single person passes through the module at the same time;

- A specific risk sensor chosen among the types described hereunder;

- A processing card connected to the system bus (ESB format) which processes the signals from the sensors and delivers data which are then interpreted by the supervisory module; a standard personal computer has sufficient processing capability to ensure this function.

The combination of the video camera and the photoelectric cells with the specific risk sensor of a detection sub-system allows complete tracking of persons who have to be checked within the security system of the invention. Other types of sensors than photoelectric cells could also be used. Another kind of identification could also be used such as an RFID tag (or a bar coded ticket, though this implementation needs more cooperation from the passenger) delivered to the persons to be controlled when checking-in.

For instance, as shown on figure 2, eight different types of sensors can be implemented in the corridor to assure the following functions: - Metal detection, 100 ; this sub-system is alike a classical electromagnetic portal; this sub-system, integrated in the walls (or behind); it is also possible to distribute the elements of the metal detection sub-system in the physical structures of the other modules, each part performing part of the detection at a specified height; this will allow a better decoupling of the magnetic flux created by the sources of the detectors; in this sub-system delivers (in real time) a file containing four information: o objects and body location assessment; o an evaluation of objects volumes; o temporal stop and go flags a as a result of a person passing through the photoelectric cells; o the captured image of the face of the person passing through the sub-system.

- Explosive precursor trace detection, 200; this sub-system will be further described in detail in relation with figures 6A and 6B;

- Hidden objects detection, 300; this sub-system will be further described in detail in relation with figures 7A, 76B, 8, 9A, 9B and 9C; - Mobile phone detection, 400; this sub-system is made of a cellular station emulator along with the associated antennas, integrated in the walls (or behind); this sub-system is based on components of radiofrequency control systems commercialized by the applicant; the security functions performed by this sub-system have two aspects: i) it allows correlation with detection from some other sub-systems (for instance, if a metallic object is detected at sub-system 100, with no hidden object being detected at sub-system 300 and a mobile phone is detected at sub-system 400, no alarm should be triggered, since the situation is totally normal: the person hand carries a mobile phone which has been identified; ii) in case this is needed, the identification of the person carrying the mobile phone may be cross-checked from the mobile phone operator database; this sub-system delivers in real time a file containing three pieces of information: o mobile phone information (SIM identifier, IMEI number and country location of commercial operator); o temporal stop and go flags as a result of a person passing through the photoelectric cells; o the captured image of the face of the person passing through the sub-system; - Radioactive detection, 500; this sub-system is made of gamma ray and beta ray detectors integrated in the sub-system's walls (or behind). In the present implementation of the system, the radiation measurement sub-system is based on COTS (Commercial of the shelf) equipment. It delivers in real time a file containing three pieces of information: o A radiation level score; o temporal stop and go flags as a result of a person passing through the photoelectric cells; o the captured image of the face of the person passing through the sub-system;

- Biological detection, 600; This sub-system, like shown in figure 5 for explosive precursor trace detection, is made of a ducted airflow system, integrated in a wall (or behind), and grouping several fans and producing a transverse wind from this wall to the one in front. On the second wall, facing the ventilation system and integrated in it (or behind), a collecting tunnel sucks in this wind and passes it through to a measurement cell; for industrial reason this module could also be associated with the explosive precursor trace detection system using the same ducted airflow system; a spectroscopic recording of the different compounds in the cell is compared to a data base of biological agents. This sub-system delivers in real time: o a measurement of the concentration of biological agents; o temporal stop and go flags as a result of a person passing through the photoelectric cells; o the captured image of the face of the person passing through the sub-system;

- Epidemiological detection, 700; this sub-system is made of at least one infrared camera, integrated in the module walls (or behind); body temperature is measured and compared to different sources of normal/abnormal values to detect an abnormal increase of temperature; in the present implementation of the system, these cameras are COTS (Commercial of the shelf) ; this sub-system delivers in real time: o A measurement of the body temperature; o temporal stop and go flags as a result of a person passing through the photoelectric cells; o the captured image of the face of the person passing through the sub-system;

- Abnormal behavior detection, 800; this sub-system will be further described in detail in relation with figure 10.

Also, a display 900 can be located on a wall near the exit to present information to the persons passing through the corridor. This information can be made specific to the person who is identified by the recognition of his/her face by the video camera of the first detection sub-system located nearest to the entrance of the corridor. This specific information may for example be: boarding gate number, expected time of departure for his/her flight, expected time of arrival, specific security, health requirements on arrival, luggage transfer information, etc... Also, this display may be useful in drawing the attention of the person entering the corridor to a point located at the distal end of the corridor, thus smoothly inducing a cooperative attitude of the person along the passage to the exit of the corridor.

Some detection sub-systems may be absent, for instance the epidemiologic detection sub-system when the corresponding risk is null. Some other kind of functions may be added, for instance a RFID detection sub-system, to supplement or replace the video camera tracking, and a NQR detection subsystem to correlate with the main explosive trace detection sub-system. Alternatively, some detection sub-systems can be grouped in a single physical module as shown for example on figure 3. In this manner the corridor will be made more compact, possibly more suitable to certain types of airports or other facilities (theatres, museums, department stores...) and more economical.

As can be seen on figure 4, in another embodiment of the system of the invention, the hand luggage scanning chain can be positioned on one side of a wall of the corridor. In addition to the traditional X-Ray scanning equipment, this chain can use some of the detection sub-systems of the corridor. For instance, the explosive trace detection sub-system can be adapted to detect the hand-luggage of the person going through the corridor at the same time: to achieve this result, i) the speed of the luggage chain should be adapted to the speed of the person; ii) the collecting tunnel should be placed behind the luggage chain.

The logical architecture of a security system according to an exemplary embodiment of the invention is shown on figure 5.

Each of the detection sub-systems represented described above is connected to a communication bus 1000, for instance an Enterprise Service Bus (ESB). An ESB allows communication between heterogeneous applications using a web protocol and a Java Messaging System (JMS). The ESB provides the following functions

Routing - sensor start and endpoint are listed with associated services;

Transformation - a sensor request or output can be transformed from one format to another (such as XML - extensible Mark-up Language - to XML using XSLT - extensible Stylesheet

Language Transformations);

Adaptation - messages in the ESB follows the standard SOAP (Simple Object Access Protocol) format; some sensors output may not support SOAP format and an encapsulation is designed to transform the message;

Messaging - the ESB provides asynchronous reliable messaging transport (sensor to sensor, sensor to supervisory sub-system) Orchestration - the supervisory sub-system manages an orchestration system that manages the overall workflow from one service to another, as well as the output to the control officer;

Registry - services (sensors start, stop, output value test) are registered in a registry for applications to discover them (local LDAP - Lightweight Direct Access Protocol - on VLAN - Virtual Local Area Network - is a potential implementation). A WSDL (Web Services Description Language) file could be use to collect details about the service; Registry could be used at run time to locate the valid endpoint for a service; any equivalent system depending on performance could also be implemented; Security - authentication and authorization of sensors data are controlled through the ESB infrastructure services. User validation - users are able to lookup the endpoint of a delivered alarm and redirect the service request to the right endpoint or another one in case of failure. Service integration - new services are validated and new policies are designed to implement secure service invocation.

The standard interfaces from a sensor to the ESB are the following:

• Public: o Configuration (Get/Set) o Start / restart / stop o Report status (MMI - Man Machine Interface - access)

• Private: o Initialize o Measure or measurement value o On alarm

In summary, standards used in the ESB are the following

Transport http (HyperText Transfer Protocol)

Messages SOAP

Services contract WSDL

UDDI (Universal Description Discovery and

Address book Integration)

HTTPR (Reliable HTTP), WS-Reliability (Web

Garantee delivery Services Reliability), ebXML (Electronic Business using XML) Messaging Service

WSUI (Web Services User Interface), WSIA

Graphic Interface (Web Servides for Interactive Applications), WSRP (Web Services for Remote Portlets)

Cryptology XML Encryption, WS Security

Signature XML digital Signature, WS Security Single Sign On SAML (Security Assertion Markup Language)

XACML (extensible Access Control Markup Access control list Language)

BTP (Business Transfer Protocol), XAML

Transactionnal (extensible Application Markup Language), WS- Transaction, WS-Coordination

XKMS - XML Key Management Specification -

Public/private keys (XKISS - XML Key Information Service management Specification, XKRSS - XML Key Registration

Service Specification)

BPEL (Business Process Execution Language), BPML (Business Process Modeling Language),

Process representation XLANG (WSDL extension), WSFL (Web Services Flow Language), WSCI (Web Services Choregraphy Interface)

Administration

OMI (Open Management Interface) management

In addition to the detection sub-systems, a security system according to an embodiment of the invention comprises the following sub-systems:

- A supervisory sub-system 1 100, integrated in the wall of a module, processes all the information delivered by the detection sub-systems and other sub-systems described hereunder; a personal computer with a dual-core can be used as the processor of this supervisory subsystem; the supervisory sub-system provides an aggregate risk level assessment and triggers adequate alarms in a manner which will be further described in relation with figure 10; the supervisory sub-system also perform system management (hardware and software configuration management, settings, etc .);

- These alarms are shown on a control display 1200 which may be located near the corridor or centralized in an operation centre; the control display allows visualization of synthetic information delivered by the supervisory system with the possibility for the control officer to focus on a specific detection sub-system by visualizing partial or complete sub-system results; - The control officer sub-system 1300 is used to set the different parameters of the system and to dispatch alarms, as explained in more details in relation with figure 10;

- A dynamic check-in database 1400 is connected to the ESB and managed by the supervisory sub-system; this database is populated by information from the check-in system 1500 which comprises full identification and status (passenger or visitor; crew, airport personnel with their accreditations, etc ..) of the persons who will be then submitted to security controls in the corridor; a reference photograph of the person is taken at the time of check-in or collected from his/her electronic passport; when it is not the case, the reference photograph for further matching in the other detection sub-systems is the one taken by the video camera located in the first detection sub-system at or after the entrance of the corridor; this information may be supplemented by airline information 1600 about the persons (frequent flyer status, VIP status, etc ..) and flight information (expected time of departure and arrival, connections, etc .).

As the detection sub-systems, the supervisor sub-system may be integrated in the walls of 3 physical modules like shown in figure 3.

For performing the system management function, one supervisory sub- system may monitor more than one corridor system, and control officer displays may be grouped in one common operation centre but from a risk level assessment point of view, it is currently preferable to keep one supervisory sub-system dedicated to a single corridor, while it may be envisaged to amend this architecture; for instance, the control of each corridor could be managed by a dedicated control display and and a dedicated control officer but an additional control facility served by a dedicated officer could be added to present to this control officer the alarms observed on all corridors during a preset time. We now present a more detailed description of the explosive trace detection sub-system 200 as shown on figures 6A and 6B.

This sub-system, shown on figure 6A, is made of a ducted airflow system, integrated in a wall (or behind), grouping several fans and producing a transverse wind from one wall to the other. On the second wall, facing the ventilation system and integrated in it (or behind), a collecting tunnel sucks in this wind and passes it through in a multi pass laser cell. This cell is described in figure 6B. A spectrometer analyzes the absorption of the laser beam and delivers a measure of the concentration of the detected compound. The laser system could be a multi wave lengths one. Each wave length is predefined to detect a specific chemical compound. Preferably, the laser is a quantum cascade laser that sweeps slightly to either side of a specific predetermined value; this value will be between 4 and 10 μ for the compounds of interest. In the present implementation of the security system of the invention, one can use the cell and laser equipment produced by "Cascade Technologies"™. Similar laser equipment from another supplier could also be used.

This sub-system delivers in real time: - a measurement of the concentration of the analyzed chemical compounds; temporal stop and go flags as a result of a person passing through the photoelectric cells; the captured image of the face of the person passing through the sub-system.

We now present a more detailed description of the hidden object detection sub-system 300 as shown by figures 7A, 7B, 8, 9A, 9B and 9C. This sub-system, two embodiments of which are shown on figures 7A and 7B, is made of:

- At least one passive millimeter wave camera integrated in a module wall (or behind); this camera delivers low resolution body images in the millimeter range; - And possibly at least one scanning or array antenna 77 GHz active radar integrated in a module wall (or behind) to deliver a more accurate image of an object pre-detected by the millimeter wave camera; this radar is activated only if the millimeter wave camera detects an object of interest as shown on figure 9A, 9B and 9C.

The 77 GHz wavelength is preferred over other wavelengths because:

- It is well suited to the size of objects which are searched for;

- It is already used for automotive adaptive cruise control which guarantees that it is authorized for used in most countries and that the transmitters and receivers can be produced economically.

In the present implementation of the security system of the invention, one can use a millimeter wave camera commercialized by BRIJOT™. This camera functions at 100 GHz and is capable of detecting metallic and non metallic objects and liquids, even hidden under clothes. A similar camera from another supplier could also be used.

In the case of a scanning antenna radar, a radar receiver rotates around the transmitter at a frequency which is determined by the speed and distance of the target so as to simplify processing

In the case of an array antenna, the transmitter antenna is in the middle of the module wall. The receiver antenna elements are located in a non regular array (see figure 8) such as a virtual antenna could be computed in real time and then several adaptive beams be formed such as the object surface is covered like shown on figure 9A, with details on figure 9B. On figure 9C, the details of the objects detected (a gun and a knife) by the formed radar beams are shown. Different possibilities to implement these elements are available, for instance a randomized array or an multi regular k.λ mesh pattern where λ is the wave length of the radar and k is the number of mesh patterns. An implementation of such an array antenna radar is given in patent FR2875912 for a linear array. Typically, the array antenna should cover a square of from 30 by 30 centimeters to 60 by 60 centimeters and include between a few tens up to a few hundreds of receivers, depending on the level of the secondary lobes. Alternatively, the array antenna can be constructed as a network of antennas having holes which are located at points the positions of which are calculated using the method disclosed in patent FR 2902935. With this method, the number of receivers can be reduced to a few tens and the array can be formed with a network of patch antennas which can be integrated in the painting of the wall.

The signal processing algorithms which are disclosed in this patent are used to reconstruct a full linear antenna and they can be applied twice for the two dimensions needed in this application. This sub-system delivers in real time: an objects body location evaluation; an evaluation of objects size and shape; temporal stop and go flags as a result of a person passing through the photoelectric cells; - the captured image of the face of the person passing through the sub-system.

We now present a more detailed description of the abnormal behavior detection sub-system 800 as shown by figure 10. This sub-system is made of at least one fish-eye camera integrated into the walls of the module. One equipment which may be used is a network AXIS™ 221 camera with a CCD image sensor and a FUJINON™ lens ICAFYV2.2X1.4A-SA2 - 1 /3" with variable focal length from 1.4 to 3.1 mm with automatic DC iris and a fish-eye of 185° aperture and the following mounting and physical specifications: CS F:1 .4 MOD O.2m L:54.7mm x 0:41 mm 8Og. The AXIS™ camera demonstrates features well suited for this application, specifically a progressive scanning capability which delivers clearer pictures of moving elements than interlaced scanning, thus facilitating image processing. Image processing is performed by a dual-core personal computer. Video streaming is continuously delivered to detect abnormal behavior inside the corridor such as U-turn, people running or trying to conceal something, people being nervous...

This sub-system delivers in real time: the camera video streaming; temporal stop and go flags as a result of a person passing through the photoelectric cells; the captured image of the face of the person passing through the sub-system.

The flow chart of the processing performed by the supervisory sub-system is described on figure 1 1.

The data used to calculate an aggregate risk level for a definite individual are:

- the video analysis of the captured image of people, specifically of the objects which are hand carried and of abnormal behavior;

- the data passed to the supervisory sub-system by each individual detection sub-system; - the dynamic check-in database possibly supplemented by airline information which defines different alarm thresholds for the individuals; these thresholds are determined by national or international authorities.

A first manner of determining an aggregate risk level is to compound the outputs of the detection sub-systems in a discrete manner using a logical decision table.

To achieve this goal, a spatial correlation between detected objects is performed. As an example: - the metal detection sub-system delivers a body location evaluation and an object volume evaluation;

- the hidden object detection sub-system delivers a body location evaluation and an object surface evaluation.

- the two sensor detections and the possible two body localizations are compared with a decision table: o two detections, the two localizations are compatible, the same object is detected, it's a metallic one hidden under clothes o two detections, the two localizations are not compatible, two objects have been detected, a metallic one and a non metallic one, the second being hidden under clothes; o only metallic detection occurs, the object is a metallic one, it is not hidden under clothes, confirmation could be obtained by the video camera of the different modules and/or by the fish-eye camera; o only hidden object detection occurs, the object is a non metallic one, hidden under clothes.

A more detailed view of a logical decision table is shown on figures 12a, 12b, 12c, 12d and 12e where the crosses in the "Detection" columns stand for a positive reading, the "Detection confirmation" column indicates which type of confirmation is performed, the "Recognition" column indicates if there is or not a need to precisely identify the object and, if so, the result; then the "Alert type" and "Aggregate risk level" are indicated. These five sub-tables present different combinations of positive readings as examples only.

A second manner of determining an aggregate risk level is to compound the outputs of the detection sub-systems using a continuous function. An example of an aggregate risk level calculation using a continuous function is given on figure 13 where only two detection sub-systems are taken into account and where the relationship between the variations of the two individual risk levels is linear: the "diffuse alarm" area would not trigger an alarm in a system of the prior art where only individual detection trigger alarms. After more experimentation, the linear relationship will be easily changed to optimize the detection/false alarm rate.

More generally, let's consider the mathematical space R^π where n is equal to the number of independent detections.

We note Vi the measured value and Ti the threshold value of detector number i. The thresholds Ti are depending on the dynamic profile definition.

The risk assessment algorithm provides different types of alarm: Alarm with discrete scoring when at least there is one Vi such as Vi > Ti Diffuse alarm when F(V1 , V2,..., Vn) >0 and VkTi where F is a function in the Rⁿ space such as F(0, 0,Ti,..., O)=O for every I from 1 to n. A third manner of computing the aggregate risk level is to calculate an "a priori" probability using the Bayes rules considering the probabilities of alarms P(Vi>Ti) adjusted during an experimentation phase of the system.

The main features of the security system of the invention as described hereinabove can be now put in relation with the eight operational goals pursued by authorities which specify said systems which have been presented before:

- Improve the security level of the control: a security system according to the invention detects metallic objects, plastic objects, ceramic objects, liquids, explosive materials, radioactive components (even if those different things are hidden under clothes), explosive precursor traces, pre-determined biological components, epidemiological risks (fever, known viruses...) while systems of the prior art only detect metallic object;

- Give a risk assessment related to the presence of non authorized object or the presence of explosive precursor traces: a security system according to the invention, via the supervisory system, is able to deliver a true risk assessment indicator regarding a multi-criteria analysis. This indicator is much more efficient than the state of the art as it takes into account all the potential threats and does not overestimate the level of influence due to a specific individual profile; For instance in an airport, a frequent flyer person is less safe than normal passengers regarding epidemiological aspects; a security system according to the invention delivers an aggregate risk level assessment taking into account all these aspects;

- Alert competent people: a security system according to the invention gives a more elaborate alarm than prior art systems as it delivers information concerning the object location on the body, characteristics of this object ( metallic or non metallic, shape, surface, volume) while prior art systems generally only deliver an alarm for metallic objects;

- Improve the comfort level for people under check: a security system according to the invention does not need cooperative actions from people, who only need to walk through. This feature is advantageous over systems of the prior art as the one of figure 1 , where there is a need to stop during many seconds, hands up. As all objects, even non metallic ones, are detected despite the fact that they could be hidden, percentage of random body search should largely decrease compared to prior art systems;

- Improve the acceptability of security control: the diminution of body searches is also a factor of comfort compared to today installed porticos; as a security system according to the invention uses mainly passive sensors (except for the magnetic detector as common ones, and except eventually the active 77 GHz used only if some suspected hidden object has been detected) there is not at all any risk for health when passing through the system, even when staying in;

- Increase people flow through the security control equipment: a security system according to the invention controls on the move and reduces body searches because hidden objects are detected without these body searches;

- Recognize people identity inside the security system: a security system according to the invention could use (depending of the deployed type of system) enrolment information collected pre hand or some time before (for instance some minutes or hours before from airport boarding check in), or pre-established into data bases for specific secured zones like nuclear centers;

- Inform people with individual targeted information during the security control : the passenger display which can be included in a security system according to the invention informs users in real time, possibly with personalized information taken from the dynamic check-in data base.

The invention is not limited to the specific embodiments, which have been described in this specification. The scope of the invention is only defined by the appended claims, which follow.

Claims

1. Security system for evaluating risk levels of elements moving proximal to at least one physical component (10) of said security system, said security system further comprising a communication bus (1000), a first detection sub-system (100) and a set of additional detection sub-systems (200, 300, 400, 500, 600, 700) connected to the communication bus and a supervisory sub-system (1 100) connected to the communication bus which comprises a data fusion module fit to compute an aggregate risk level of an element as a function of individual risk levels output by the first detection sub-system and at least one additional detection subsystem, said security system being characterized in that the at least one physical component is shaped as a corridor having two walls both perpendicular to the ground between which the element moves, said first and additional sub-systems being positioned proximal to one another along the length of the corridor.

2. Security system according to claim 1 characterized in that the first detection sub-system and the additional detection sub-systems each comprise at least one video camera, two photoelectric cells, a specific risk sensor, a processor and interface connectors to a data bus and to a power supply.

3. Security system according to claim 1 characterized in that the corridor- shaped at least one physical element has an entrance and an exit, one of them at least having an axis which is not aligned with the axis of the corridor.

4. Security system according to claim 1 characterized in that the first detection sub-system and the additional detection sub-systems each perform at least one detection function chosen from the group comprising hidden object detection, metal detection, explosive trace detection, biological detection, epidemiologic detection, radioactive detection and mobile phone detection.

5. Security system according to claim 4 characterized in that the hidden object detection sub-system comprises at least one passive millimetre wave camera.

6. Security system according to claim 6 characterized in that the hidden object detection sub-system further comprises a scanning antenna active radar operating substantially at 77GHz.

7. Security system according to claim 6 characterized in that the hidden object detection sub-system further comprises an array antenna active radar operating substantially at 77GHz,.

8. Security system according to claim 4 characterized in that the explosive trace detection sub-system comprises at least a quantum cascade laser spectrometer.

9. Security system according to claim 9 characterized in that the explosive trace detection sub-system comprises at least a collection of fans producing an airflow in the direction of the spectrometer.

10. Security system according to claim 1 characterized in that it further comprises abnormal behaviour detection sub-system

1 1 . Security system according to claim 10 characterized in that the abnormal behaviour system comprises at least one fish-eye camera fit to produce a continuous video streaming of elements moving proximal to the at least one physical component of said security system.

12. Security system according to claim 1 characterized in a database connected to the supervisory sub-system comprises identification and profile information about the elements moving proximal to the at least one physical component of said security system.

13. Security method for evaluating risk levels of elements moving in a control area, said method comprising a supervisory process, a first detection process, a set of additional detection processes in communication with the supervisory process which comprises a data fusion sub-process fit to compute an aggregate risk level of an element as a function of individual risk levels output by the first detection process and at least one additional detection process, said security method being characterized in that said control area is defined by a corridor along which said first detection and additional detection processes are executed while the elements are moving through the corridor.

14. Security method according to claim 13 characterized in that the first detection process and the additional detection processes each perform at least one detection function chosen from the group comprising hidden object detection, metal detection, explosive trace detection, biological detection, epidemiologic detection, radioactive detection, mobile phone detection and abnormal behaviour detection.

15. Security method according to claim 13 characterized in that the first detection process and the additional detection processes each comprise at least one element tracking sub-process using a video stream of an identifying part of said element synchronized on start and finish of a detection process of said element by two photoelectric cells.

16. Security method according to claim 14 characterized in that the hidden object detection process comprises a pre-detection sub-process using at least one passive millimetre wave camera for determining areas on which a confirmation sub-process using a radar of a wavelength substantially equal to 77GHz.

17. Security method according to claim 13 characterized in that the individual risk levels of elements are computed by taking into account elements' risk profiles determined from a database comprising personal profiles of said elements.

18. Security method according to claim 13 characterized in that the aggregate risk levels of elements are computed by taking into account a logical decision table determined from a logical function algorithm of the output of at least two detection processes.