How is your security access card? You probably have put it on the card reader to get into your office today. But what if someone had duplicated your card and broken into your office last night?
Some have shared their concerns about having their security access cards duplicated for quite some time, but most people still think the chance is slim. Today, let’s see how these security access cards can be duplicated.
How does security access card duplication work, and how can one break into an office with a duplicated card?
Security access cards have their own chip serial number (CSN) and unique identifier (UID) created by the provider. Security access equipment generally uses UID to make a list of those who are allowed to access. Many of you may think it’s quite difficult to duplicate UID but it actually isn’t, and here is why.
- CSN and UID can be read without any verification process: Anyone with a dummy reader can read CSN and UID. You can do this without actually stealing the card, since security access cards are basically a type of RF card, and they can be read simply by swiping the card over the reader.
- Once read, CSN or UID can be easily copied to another card: It’s easy to get cards with alterable CSN and UID on ebay, but they don’t even have to be transferred onto a card shaped object. All that’s needed is a PCD board that can send out an RF signal when CSN is requested.
Some access control systems use not only CSN but also data on a memory block. These are safer since the data is encrypted. Yet, it’s still quite easy to duplicate them as all you need to do is copy the encrypted data onto the memory block of a new card.
Then how can we prevent card duplication and keep our offices safe from these card duplication threats?
The first thing is to get security access cards which havean arithmetic function instead of the common memory cards. Have a look at how smart cards, which are considered the best example of the solution, work.
As you see from the image above, it operates by giving a problem to the smart card asking for the authenticator (T) for a random number (R), and checking if the right authenticator (T) was given by the card.
What should be remembered here is as follows.
- The random number changes each time.
- The logic used to get the authenticator with a random number should use the encrypted algorithm which qualifies the safety standards created by the card and the reader.
- The notarized encrypted algorithm (ALG) logic is open to others, so it’s important for smart cards and card readers to safeguard the encryption key (K). The authenticator (T) which is created through this process is eventually examined for its authenticity.
In other words, smart cards respond with the authenticator (T) = ALG (R, K) with a changing random number (R), and the card reader checks if the given T is the same as the T it got from the R and ALG (R, K).
Once the reader verifies the security access cards authenticity, it takes the information about the card owner from the card to decide on whether access can be granted.
On the other hand, the card has to decide whether it should give information recorded on the card to the reader. This is when the card asks the reader for the authenticator (T) by giving it a random number (R), just like the reader did to the card for authentication.
How can the encryption key, which plays the most critical role in creating the authenticator, be kept safe? If someone who wants to duplicate the card is able to get the encryption key (K), then finding out the right authenticator (R) would no longer be difficult at all. Some technologies used to keep K safe are as follows.
Technologies to keep encryption keys safe
- It is important to make removal of encryption keys embedded into cards impossible from the designing phase of the card. Not only should there not be any command which enables this process, but the smart card should also destroy K automatically if one tries to get it by physically disassembling the card.
- T should use not the entire ALG (R, K) but only a part of it, so that K cannot be traced back from T.
Card readers, which also have the same K, need to find ways to keep it safe.
Would encryption make everything safe, then? Brochures from solution providers sometimes say “our data is kept safe by the algorithm we use.” This statement can be true in some cases but not always, because it’s all about keeping the encryption key safe when protecting data.
Encryption keys cannot be taken out of smart cards as explained earlier, and the card would destroy itself if one tried to take it out physically. How do card readers keep K safe, though?
The card readers mentioned so far generally have CPUs capable of arithmetic operations as well as volatile memory, so many of you may think they could simply keep K in the internal storage and keep it safe.
The level of security could stay somewhat high in this way but it’s still not completely safe. Not only can the key be exposed to the developer, but also one can take out the key file from the reader and analyze the program run on the reader to extract the key file.
As you see from the image, card readers entrust request security access module (SAM) to examine and respond instead of keeping its key as itself and reading the file for calculation.
In other words, card readers don’t actually know the key, and it only mediates the communication between smart cards and SAM. It is SAM which not only has the key, but also verifies the given authenticator.
In this case, SAM is designed to never let the key out no matter what command has been given, and destroys itself when there is a physical attempt to take the key out.
Client administrators or the card issuer/provider should also be blocked from knowing the encryption key when embedding the original key to smart cards and SAM.
A separate piece of key managing equipment called a hardware security module (HSM) is used when generating the initial key, and an encrypted channel is used to embed this key to smart cards and SAM.
There are other security threats and countermeasures for them, and hopefully they can also be addressed soon as well.
As we have seen earlier, it’s important to make sure your card and everything on it is kept safe when using it each morning.
Many of us think it is safe because we use smart cards with smart chips, but this may not be true, if they only have CSN like other memory cards. Maybe this is a chance for you to check whether your security access cards are simply smart cards which won’t really provide much security.
What we discussed today may feel quite complicated, but it doesn’t have to be. Once you apply the LG CNS Saferzone IDP security access system to your office, you’ll be able to keep your office safe from all these security risks.
Written by Taehoon Kim, LG CNS