By By Marc Howe
Facilities owners and managers across multiple sectors have long made recourse to smart card access systems for building security purposes, increasing the convenience of building access by dispensing with the need for burdensome keys or comparatively time-consuming lock manipulation.
The occupants or users of facilities can gain access to them with far greater ease by means of such systems, unlocking key entryways simply by waving their smart cards within sufficient proximity of detectors. This, in turn, makes it far easier to manage secure access points that are frequently traversed by a large number of building occupants.
Contactless smart cards have been around for more than two decades and were first pioneered in Finland during the early 1990s for use with the country’s transport ticketing system. Use of the systems has since spread around the world and to other sectors of the economy outside of public transit, such as personal identification and building security.
Smart card systems make use of radio waves to transmit information between smart cards, the card readers or radio frequency identification (RFID) devices and central administration systems. The cards themselves possess the same dimensions as credit cards, with ISO-IEC standards defining their measurements as 85.60 by 53.98 by 0.76 millimeters.
Smart card systems are of course designed to be tamper resistant, and the Wiegand protocol used to connect card readers and electronic entry device was long considered to be highly secure because of its obscure nature.
As is the case with any long-standing technology of renown, however, determined malfeasance worked out how to hack the Wiegand protocol, making RFID devices then on the market potentially vulnerable to malignant attack.
Some experts subsequently contended that smart card readers could become a vulnerable point in building security, leaving users exposed to ID harvesting in the form of skimming or eavesdropping by hackers.
Skimming refers to the use of a special reader to access or tamper with data on the RFID token of card holder directly, while eavesdropping, as the name implies, involves accessing data illicitly during the process of communication between a token and reader. Both of these forms of hacking can be performed remotely using equipment that is readily obtainable as well as comparatively inexpensive.
Thankfully for building owners and facilities managers who seek to retain the immense convenience of access provided by smart card readers, companies have made a range of best practices available in order to firmly secure the devices from malignant attacks by hackers.
A recent white paper by Legic Identsystems on best practices for using contactless smart cards for secure applications outlines a number of means for safeguarding the devices from malignant intrusion or tampering. Chief amongst them are measures in relation to data security and the deployment of physical measures to safeguard the devices from tampering.
A range of data security measures for smart card access readers is currently available, including encrypted data on cards, encrypted data transmission on RF interfaces, data integrity checks on the RF and host interface, data integrity checks of card data, as well as authentication between reader and card. These measures can be made continually active in order to achieve a high level of protection against illicit attempts by hackers to steal or manipulate any transmitted data.
Tamper proof enclosures are another highly effective means for safeguarding smart access systems from unwanted interference – particularly in the case of outdoor readers. The enclosures can be rendered tamper proof by means of a number of measures, including recessed mounting, special screws and tamper detection mechanisms.
Other physical measures for enhancing the security of smart card systems include using reader cables covered with continuous foil shields that block signals during the process of transmission and running the cables for readers through conduits that increase their protection from outside attacks.
Another key means for shoring up the security of smart card access systems is the introduction of multi-factor verification, as opposed to the single-factor verification of solely bringing the card within close proximity of readers. Multi-factor verification can be as simple as introducing the requirement that occupants enter a PIN code after waving their smart cards before RFID devices.
Contact Godby Safe & Lock if you have any questions regarding Safeguarding Smart Card Access Systems from Attack.