3 ms·
Universities which use the popular and inexpensive Onity (nee TESA) lock systems, despite their overall problems, gain a bit of security from this problem in th
by jcrawfordor 12y ago
Universities which use the popular and inexpensive Onity (nee TESA) lock systems, despite their overall problems, gain a bit of security from this problem in that the track used by the locks is written at a nonstandard high bitrate that throws off inexpensive reader/writers. This actually helps prevent duplication, although it's only a measure against people without the resources to obtain the Onity equipment.
Outside of physical tricks like this (and various physical anti-deduplication tricks that are surprisingly limited), duplication is really not something you can ever control. So you need to train people to maintain physical custody of the credential and make it as difficult as possible to guess at a valid credential.
When cards are used for security identification purposes, the easiest thing to do (and this goes for NFC, RFID, etc) is to generate a long, non-sequential, random card value that is related to the identity of the person only by some database you control. That is, write your 9-digit student ID number to the card for convenience, but when checking identity read out a 16-byte random value that you put on the card just for this purpose. This at least requires that an imposter gain access to the card at some point (to skim it).
Ultimately, the best thing you can do in the context of identification cards is to verify the user photograph online. This is done actively by some police departments and guards in high-security installations by looking up the ID in an online system to retrieve the details and photograph of the cardholder for verification. This is also done passively in some high-security installations, for example by placing a monitor above an entry door that displays the photograph of each person unlocking the door, for casual verification by anyone nearby (particularly any guard nearby).
Physical access control is my favorite research area.
- hamburglar 12y ago> Outside of physical tricks like this (and various physical anti-deduplication tricks that are surprisingly limited), duplication is really not something you can ever control. This type of control is the point of smart cards. The card contains a private key which can't be extracted (or at least is difficult to extract and may involve destroying the card) and a processor that can do signing operations which prove to the kiosk/register/whatever that the card is physically present.
- jcrawfordor 12y agoSmart cards are super cool! The number of real applications is pretty limited, though, with computer authentication being almost all of them (payment cards, yes, but the fallback to 'conventional' processing negates a lot of the advantage). I think that challenge-response NFC authentication will make this kind of technique more practical for physical access control applications.
- hamburglar 12y agoMy view is that the scenarios described in the paper basically amount to "computer authentication", and smartcards would be completely warranted (and not at all unreasonable to implement) here.
- tallanvor 12y agoActually, verifying user photos is pretty common, not just in high-security areas. The residence halls at the university I went to had this setup as far back as the late 90s. --You had a proximity card that was read at the door, and your photo popped up on the computer. The gym I go to now does the same. --It's an easy way to prevent multiple people from trying to share a card.