Adopting Mobile Credentials Into Your Access Control Infrastructure

Transcription

1 Adopting Mobile Credentials Into Your Access Control Infrastructure Jeremy Earles Credentials Business Leader, Allegion 1 Overview Security Where do we start? Evolution of the credential Convenience The demand for mobile Technology Opportunities Raising the bar on security/convenience dynamic Pros & cons of mobile credential options What can I do? Implementation & Rollout recommendations 2 2 So in war, the way is to avoid what is strong and to strike at what is weak. So in war, the way is to avoid what is strong and to strike at what is weak. The Art of War Lesson 6: Weak Points and Strong Sun Tzu The Art of War Sun Tzu 3 3 1

2 Security technology in credentials today Multi factor + + ( ) Biometrics Security 13.56MHz Smart Cards Mag Stripe 125kHz Proximity US Credit/Debit Cards (Today) Keys PIN/Passwords 4 4 The current weak link in payments 5 5 The Weakness in Access Control Magnetic Stripe magstripe reader/writers are widely available as well as software for analyzing data encoded on the cards. By swiping a valid card, it becomes trivial to make any number of duplicates that function as the original

3 The Weakness in Access Control 125kHz Proximity 7 7 Higher Security Option for Access Control: Transitioning to Smarter Cards Mutual Authentication The card and reader communicate back and forth Each verifies that the other is legitimate Key Diversification Each card has a unique key, so transactions are unique Prevents compromise of the entire card population ϖ ßƔϘϞѪ ᴕ Encryption The card and reader communicate in secret code An algorithm (very large and complicated) prevents the ability to discern the communication 8 Sniffing, Replay, & Brute Force Attacks Putting smart card encryption into perspective undecillion 340,282,366,920,938,463,463,374,607,431,768,211,456 ounces of water on Earth grains of sand in Sahara Desert 680,564,733,841,876,926,926,749,214,863,536,422,912 quattuorvigintillion atoms in atoms on 115,792,089,237,316,195,423,570,985,008,687,907,853,269, 984,665,640,564,039,457,584,007,913,129,639,936 ounces of water on grains of sand Earth in Sahara Desert 9 3

4 Brute force attack Fastest super computer: petaflops (10.51 x operations / second) Operations required per combination check: 1,000 (optimistic, assume for now) Combination guesses / second = (10.51 x ) / 1000 = x Seconds in one Year = 31,536,000 Years to crack AES with 128 bit Key = (3.4 x ) / [(10.51 x ) x ] = (0.323 x )/ = 1.02 x = 1,020,000,000,000,000,000 years (billion billion) 10 Contactless Market Making slow progress toward higher security 125 khz Prox Cards 70% MHz Smart Cards 30% How can we move faster? Ranked Credential Benefits (student user perspective, Villanova survey) Americas Market for Electronic Physical Access Control Contactless credentials by type: IHS, % More Convenient 15% Faster 14% Less likely to break 11% Innovative Technology 6% More Secure 6% Easy to Replace Convenience in credentials Convenience

5 Consumer Demand for Convenience and beyond 90% of American adults have a mobile phone 58% of American adults have a smartphone Nomophobia An overwhelming fear of being out of mobile phone contact Short for no mobile phone phobia Security vs. Convenience They have been brutal enemies for a long time Created a stalemate that is difficult to disrupt, except in very small increments The Mighty Compromise Multi factor Mobile Credentials Biometrics Security Smart cards Prox cards Mag stripe Keys Convenience Passwords

6 The Best of The Best Mobile credentials offer the best of both worlds Convenient & easily accessible Password protected Biometric option Screen lock Remote data wipe for lost phone Tracking data available Security inherent in a mobile device How many times do you look at it vs. your keys/wallet/id/etc? Technology Opportunity Today s Options Pass through request Wifi/Cellular network Credential or Token on phone NFC Bluetooth (BLE) iphone and/or ibeacon Technology

7 Pass through request options Internet/Clould Security Panel Phone Advantages Infrastructure exists No special reader requirements Phones already equipped Shows user intent GPS Location option but sacrifices convenience Lock/Strike Disadvantages Internet connection required Wifi or Cellular Data Both panel & device must stay connected Delay expected Must find door in a functional list No credential ever created NFC: Level Set Near Field Communication (NFC) technology makes it simpler to make transactions, exchange content, and connect electronic devices with a touch. Enables contactless solutions in: Payments Access control Consumer electronics Loyalty and coupons Information collection and exchange NFC A Little Tech Talk Based on 13.56MHz Convenient for MIFARE users (very popular globally) Many companies have been developing this tech for years Modes of NFC 1. Read/Write usually for card/tags, check in, posters, etc. 2. Peer to Peer Designed for two devices to communicate with one another Can be used for access control as well, if configured properly 3. Card Emulation Secure Element Mirrors today s smart cards Significant industry/business complexity within TSM/Carriers/OS/others fighting for money/control. Service Providers on the outside Host Card Emulation Opens the industry: Security is in the software, not stored in Secure Element. SP control. Becoming the method of choice in the payments world

8 NFC Advantages No network connection needed Once the credential is downloaded it acts just like your ID card Minimal latency Shows clear user intent short range Added Security Screen Lock End to end 128 bit AES encryption Anti playback credential exchange (patent pending) Convenient No extra steps required Based on existing card reader infrastructure MIFARE becoming more popular in the US, already there in Europe Transition to smart cards make this an easy decision NFC Disadvantages Not available in all phones Widespread use of android worldwide iphone distribution limitation Main reason for the delay in adoption Relies on phone battery Dead battery Limited reader infrastructure for non access applications Multiple use credentials will drive demand Terminal transition to 13.56MHz payment readers will assist Many existing prox & mag stripe readers in access control Business Model to access secure element still undefined TSM, Carriers, Payments, Service Providers, etc. Where does the money go? Lack of standardization in payments space will delay widespread adoption of the technology elsewhere Apple Pay, Google Wallet, Softcard, Independent Wallets, etc The iphone Situation iphone 5 and prior No NFC antenna External sleeves the only option Not a sustainable model Sleeve not an attractive customer solution iphone 6 launched with NFC! Exciting for the growth of the technology in payments and other uses, such as access control But Only used for Apple Pay today Cannot yet use for access control Locked from developers/sps so far Standard Apple launch practice

9 The Future of NFC Android jump started the movement Open tech welcomes innovation Excellent global strategy, but US share less than 40% Future adoption speed relies on Apple & Payments Industry Need a standardized, stable method of using NFC across platforms Must open it to SP s to move forward What if Apple doesn t open NFC to Service Providers? Still working through TSM/Carriers/Device Manufacturers/etc. business relationships via Secure Element The ibeacon possiblity ios 7/8 indoor positioning system Uses BLE for Immediate, Near, and Far location Good idea, but not universal or standardized (again) Still in its infancy Bluetooth LE BLE Bluetooth 4.0 Bluetooth Smart Bluetooth LE Bluetooth Low Energy All essentially the same thing 2.4GHz radio frequency Much lower power than traditional (classic) Bluetooth with comparable communication range Does this compliment or replace NFC? Advantages On nearly all smartphones No waiting for device adoption Widespread technology use today Mitigates end user tech hesitation Built for convenience Could be always on Automatic connections Long range operation Good for specific use case Solitary entrance, long range, nondirectional application 26 Disadvantages Full reader replacement required Early phase technology in access control No current door based market trails yet publicized The Intent Problem Works from a distance (maybe too much) Unlock by passing by is undesirable Multiple doors in an area which unlocks? No current reliable solution for this Development work still needed to solve standard install access control problems 26 So what do I do now? Opportunities for you to get involved in the discussion

10 Recommendations Technology Making the right choice now is extremely important 1. Do NOT choose mag stripe 2. Do NOT choose 125kHz proximity The push from manufacturers to migrate to smart cards will continue Consistent story for years Now even more powerful as we move to mobile Preferably an open technology like MIFARE that can accept both cards and phones Provides a solid future migration path Recommendations Technology The best thing you can do for existing low tech credential users: Install multi tech readers Provide a migration path from mag stripe or prox up to smart cards and mobile Include PIN for multi factor if applicable Recommendations Mobile Rollout Small group that you can manage: Go for it! Ambulance service example Large Enterprise: Take baby steps University example Ease into larger implementations with a pilot program Device type control (iphone vs. Android) Commercial Building rollout example Sexy tech for executives, then push downward Bluetooth trial example Test the technology and how it works for you

11 Recommendations Mobile Rollout Use a backup plan when necessary Sticky tag backup example Alleviate NFC dead battery issue Provides phased approach to mobile credential rollout Introduces dual credentials (possible management issue) Cards are another likely alternate Final thoughts Convenience is king to consumers, but we cannot sacrifice security for it Mobile allows these two principles to peacefully coexist Cards are not disappearing anytime soon Cards, fobs, mobile, and wearables will coexist Plan ahead Multi technology options for transition path Improve security of current credentials and open the door to future innovation First identify your need, then select a technology One size does NOT fit all Start small Date before you marry Technologies AND companies Many providers will give trial samples of mobile credentials Contact Information Jeremy Earles Credentials Business Leader, Allegion jeremy.earles@allegion.com aptiqmobile.com allegion.com 33 11