Adding encryption to an access control system
One aspect of securing a card’s information is to make the internal numbers unusable; in other words, they must be encrypted. To read them, the system needs access to a secret ‘key’ or password providing decryption. Modern encryption algorithms play a vital role in ensuring data security via:
- authentication (ensuring the origin of a message);
- integrity (ensuring contents of a message have not been changed); and
- non-repudiation (ensuring the message sender cannot deny sending the message).
The number is encrypted using an encryption algorithm and an encryption key. This generates cipher text that can only be viewed in its original form if decrypted with the correct key. Encryption algorithms are divided into two categories: symmetric and asymmetric.
Symmetric-key ciphers use the same key for encrypting and decrypting a message or file. The most widely used symmetric-key cipher is AES, employed by the government to protect classified information. Another common symmetric cipher, noted for its high speed of transaction, is the TEA (tiny encryption algorithm). It was originally designed at the Cambridge Computer Laboratory.
Asymmetric cryptography uses two different, but mathematically linked, keys—one public and one private. The public key can be shared with everyone, whereas the private key must be kept secret. RSA (named after its inventors, Rivest, Shamir, and Adleman) is the most widely used asymmetric algorithm.
Today, 13.56 MHz smart cards are used to provide increased security compared to 125 KHz proximity cards. One technology, used to enable two-way communications between card and reader, stores the card number on one of its sectors, then encrypts the communication between the card and reader to theoretically make it impossible or, at least, very difficult to clone. Unfortunately, a security flaw was discovered in this version that meant with the right knowledge and hardware, a card could still be cloned or another card in the series created.
Additional encryption on a card, transaction counters, and other methods known in cryptography can be employed to make cloned cards useless or enable the back office to detect a fraudulent card and put it on a blacklist. Systems that work with online readers only (i.e. readers with a permanent link to the back office) are easier to protect than systems that have offline readers, since real-time checks are not possible and blacklists cannot be updated as frequently with offline systems.
Ensuring anti-hacking compatibility throughout the system
The Open Supervised Device Protocol (OSDP)is a communication standard adopted by the Security Industry Association (SIA), which lets security equipment such as card and biometric readers from one company interface easily with control panels and equipment from another. In other words, OSDP fosters interoperability among security devices. It also adds sophistication and security benefits through features including bidirectional communication and read/write capabilities.
A two-way channel paves the way for forward-looking security applications such as advanced smart card technology, transparent operations, public key infrastructure (PKI), and mobile device access. Not only does it provide a concise set of commonly used commands and responses, but it also eliminates guesswork, since encryption and authentication is predefined. How will that impact security equipment manufacturers, integrators, and users?
As mentioned, Wiegand has traditionally been the industry standard, but is no longer inherently secure. The multiple definitions associated with the Wiegand name have also created confusion over the years, but OSDP moves the industry forward.
The protocol helps ensure that numerous manufacturers’ products will work with each other—interoperability can be achieved regardless of system architecture. For instance, the specification can handle smart cards by constantly monitoring wiring to protect against attack threats, and serves as a solution for high-end encryption, as is required in federal applications. The specification for handling light-emitting diodes (LEDs), text, buzzers, and other feedback mechanisms provides a rich, user-centric access control environment.
Significantly, the SIA Access Control and Identity Subcommittee is in the process of making OSDP 2.1.6 an American National Standards Institute (ANSI) standard. Many manufacturers have already implemented it, and many other companies have OSDP devices in development. In response, the SIA has released tools that will ensure these numbers continue to grow.
The SIA Open OSDP Test Tool is open-source software that lets manufacturers of OSDP-compatible equipment test their products against the specification. The test tool emulates an OSDP peripheral device or control panel or acts as a ‘message sniffer’ between two ‘real’ OSDP devices. It runs on several widely available, low- to no-cost platforms and hardware and reduces physical barriers to achieving interoperability, such as shipping prototypes to numerous vendors for testing. The underlying source code is another aspect of the tool that can generally be leveraged by device manufacturers in developing their OSDP interoperable products.
The fact OSDP is backed by the SIA means professionals can be confident it is going to become very visible. It is recommended those dealing with smart security in any format start incorporating the OSDP standard in their equipment and systems.
Conclusion
Protecting organizations from hackers is imperative. Hacking threats have grown to include anything from government entities to teenage mischief-makers, and in either case, both IT and OT systems are being targeted—often imperiling national security. With knowledge of what hackers seek and the remedies available to thwart them, anti-hacking specifications are now mandatory.
Scott Lindley is a 25-year veteran of the contactless card access control provider industry. Since 2003, he has been the president of Farpointe Data, which works with radio-frequency identification (RFID) systems, including proximity, smart, and long-range solutions, for many access control professionals around the world. He can be reached via e-mail at scottl@farpointedata.com.
