门禁控制器安全漏洞81694242_北京低价安装维修监控摄像头01081694242_ ...

Access Control Systems Security Systems are the most important one of the subsystems, while the Access Controller Access Control System is the core. Lot of the production of security equipment manufacturers have their own brand Access Controller, and one of many foreign products. In addition to these products we need stability, reliability beyond, will have attached to some security problems do? This requires our full attention.
Second, Access Control System Overview
Access Controller in accordance with the structural distinction between the basic divided into two broad categories. One category is the access control machine, and the other is an independent Access Controller. Access control machine is a relatively low security of the structure type, because this type of Access Controller Access Control System will be part of identification and treatment control part integrated into a device. At the installation of such equipment must be installed on the outside machine, virtually an increase of equipment may be damaged. The Access Controller is a separate signal line and connect some identification, pass through the signal line identifying information to complete the open operation. At the installation of such equipment can be installed in the door controller to increase the safety of the equipment. Here we focused on independent access controller security issues.

      Independent access controller and front-end to identify the need for communication between devices, and now the use of means of communication are essentially two types of communications using the RS485 bus, another use of Wiegand communications lines.

      RS485 communications for the use of twisted-pair half-duplex communication, using a balanced differential receiver to send and therefore inhibit the ability of common-mode interference, transmission distance can reach several kilometers, can achieve high-speed information transmission. RS485 communication using bus-based connections, many devices can guarantee the normal work, but it is a serial communication, so each post at bus access equipment has its own ID address, data communications, the system to ensure that the total online only one piece of equipment to send data, other equipment in the receive data state; between devices using a custom protocol to transmit data.
      Way to communicate using RS485 Access Controller can be articulated in a number of readers, the process of transferring data in Figure 1. Each reader and the access controller has its own ID address, RS485 data transfer network contains the address information in the network there is only one device to send data, other devices will receive data, for the purpose of its own data, equipment will deal with accordingly, rather than for the purpose of their order will be discarded. In this access control system, the Access Controller through the Tour the way round to complete an Access Controller to manage multiple card reader functions.
Access Controller about security vulnerabilities of
      Apramycin Communications is a regular at the use of security systems, through the two-cored wire for general-purpose peer-to-peer communication at close range communications protocol, the most common format has Weigand26, through DATA 0 and DATA 1 data lines, respectively, the two transmission data "0" and "1", each frame of data transmission for 26Bit. It uses the two-line communications data separately to generate the data generated pulse sequence, communication distance of around 10 meters. Third, safety issues
      Comparison of two commonly used mode of communication. RS485 bus communication using their own definition of the protocol, and Wiegand to adopt a common protocol. Custom protocol design will have more space, here we mainly target at such a mode of communication for study and discussion. Because of the access control system, the Access Controller majority are connected through the RS485 bus sensor reader, keyboard, magnetic card reader, fingerprint reader, such as front-end equipment, the use of RS485 serial bus for communication equipment required in accordance with the self - the definition of the communication protocol for data exchange, so. Production access controller manufacturers will be compatible with the front-end production equipment. This will appear in the Medium Access Controller Access Control System, front-end equipment, as well as the communication protocol between them are designed by a manufacturer production. In this case, the Access Controller will not be able to exclude the "back door card" the possibility of existence. Here called "the back door card" means the Access Controller manufacturing plant for certain purposes, set aside at the back door access controller, when the use of certain specific card or a combination of certain operations, the use of these has not been Registration cards will be able to start Access Controller Open the door. If the access control systems have been "back door card" attacks, our access control system will be easily broken at the moment, but also meant to reinforce the efforts of perimeter moment they have been in vain. Although this is only a guess. However, the technical level, the implementation of this "back door card" function is possible. This is also our customers, especially for the safety of the users have special requirements, are worried about a problem. IV solutions
Access Controller Principle
      In order to block the "back door card" access. We must, first of all familiar with the Access Control System equipment, working principle, know how to coordinate the various devices are working to master its operation mechanism, so that can find solutions to the problem. To illustrate the problem, we can build a simplified model of Access Control Systems. In this model, using an Access Controller to control the management of a sensor reader devices for data communications through the RS485. Flow system in Figure 2:
Access Control System job flow
Figure 2 Access Control System Access Controller job flow in the two models under the job. One is the inspection mode, and the other is to identify patterns. At inspection mode, the controller continuously send reader inquiries to the code, and receive reader response command. This model has been maintained until the sensor to the card reader. When the reader detects the card, the card reader on the controller command inspection produce different responses, at the back order, the reader will read the proximity card code data to access the controller, so that access control controller into the identification model.
      Access Controller at the identification mode, the Access Controller code analysis card, with the equipment stored within the card data than the right, and implementation of follow-up action. Access Controller to complete the action of receiving data, it will send readers back order, so that the restoration of the status of the reader at the same time, Access Controller mode to return to patrol.
2. Data on the working principle of the filter
      Through the above controller and card reader access control work flow, we can see that in order to achieve open, need to go through the following steps:

      1) Sensor proximity card reader to read information, proximity card access code;
      2) induction reader proximity card information will be passed to the access controller;
      3) Access Controller on the card read sensor data and system memory to compare information;
      4) access controller according to judge the results, open the door control circuit implementation.
      One of the steps one at the completion of the internal card reader, steps 3,4 Medium Access Controller at the completion of that they have solidified to the device which can not be changed. And Step 2 is to connect the two devices through the RS485 communication line to complete, which for us to fundamentally prevent the "back door card" created the conditions.
      We design a filter known as the data equipment, the equipment installed in serial data communications channel for all credit card code to the device through more than right, right recognized data, the card code data is sent to the access control controller to carry out follow-up operation; for non-recognized data, directly to the data discarded; This makes those "back door card" data simply can not sent to the Access Controller, which basically cut off the "back door card" information pathways. The following is a data filter job diagram.

Job data filter block diagram



     Filter data, as access controller, the general work in the inspection mode, it constantly to send inspection data reader sensor, and proximity card access to Wait for coding data. In the process, sensors and access control card reader controller has been completely separated from the Access Controller of its inspection order fully completed by the data filter. Only when the data filter access to the card information and verify through their own only after the data to the Access Controller. Build sensors and access control card reader controller links. Filter data to validate their own data sources are as reliable access to data on the card code. "Back door card" code can not be delivered to the data filter, thereby preventing a "back door card" attacks.

3. Data filter hardware implementation

      Based on the above ideas, you can use single-chip implementation of hardware circuit design, the hardware block diagram shown in Figure 4. SCM ~ a serial, with the access controller and reader to communicate, the serial port through the switch circuit to ensure that at a point in time and the only one of two types of communications equipment, all sent to the Access Controller All orders are confirmed after the procedure Singlechip a lawful order, so you can achieve data selection and isolation. At the same time, single-chip through another serial port, monitor and control access controller of the communications between computers, through analysis of communication content, to obtain legitimate card code data and data stored in a large-capacity E PROM as the basis for data comparison.

Data filter hardware block diagram


Figure 4 data filter hardware block diagram

4. Data flow filter software

      Serial links are access control card reader controller and sensor communications port. At inspection mode, data filters through the serial port, analog access controller. Send inquiries to the sensor reader command; induction card reader is not, send no reply card orders; data filter for the next round of inquiries.

      When the sensors have card reader, the card data will be sent to the data filter. Filter data into the identification mode, the card data and local storage of data than the standard right, if the data does not exist. Data will be discarded, and respond to sensor data have been receiving reader. Data filter back to the inspection mode and start the next round of inquiries.

      If the data in memory has been found that this card is a legitimate card, the data should be sent to the Access Controller. At this point, the device first serial switching, and access control to enable single-chip controller to communicate. From the sensor reader to receive the data as it is sent to the Access Controller. Access Controller and waiting to receive a reply; Receive replies. Once again will switch back to serial port to communicate with the sensor reader, access controller forward back orders; after the completion of data transmission, data filter back to patrol, and the next round of inquiries. Specific than the flow shown in Figure 5.

Filter data on the flow than


     Filter data through real-time monitor and control access controller of the communications between computers, to obtain legitimate card code data and data stored in E PROM filter, as the future than on the basis of the data. Its work flow is as follows: the data filter to monitor the computer sent to the Access Controller to all orders, through the analysis carried out to obtain all of the cards by adding, changing the internal operation of the orders of the command, corresponding to stored in E2PROM induction card code data by adding, changing, and ensure data store filter data and Access Controller:

Data flow filter job, in reality, because of access controllers, front-end equipment, as well as the communication protocol between them by the same manufacturer of production, so there may be "back door card" security risks. For special departments, the crucial sector, they have special security requirements, access control system protection in the use of safety is also concerned about the device's own security, reliability. The author at the data presented in the text filter can effectively prevent the concept of "back door card" attack on the Access Control System, Access Control System to protect its own security. 86,324,822 access low-cost installation and maintenance