With the Master Token System Control (MTSC), organizations gain independence and control over access security. This is ensured by key and authorization management. For buildings, schools, offices and airports, access control is becoming more and more important to protect against theft, crime and physical access to practical data. In hospitals or nursing homes, effective and contactless access control ensures that pathogens (e.g. Covid-19) contained.
Beyond the automated authentication of individuals and qualifications using IT technology is now extremely secure. Access control systems often use symmetric encryption, such as that based on AES („military-grade encryption“). Thus, access to infrastructures with smart cards (badges) is largely secure, but only after the technology has been implemented.
Access security is only as plain as its weakest link
We use smart card based access control on a daily basis An ID card opens the door to our workplace, for example.No one is allowed to have access to the encryption code („password“), which is securely stored in the lock. With AES it is one 192-, 200- or 256 bit number. Modern „Secure Component“ technology prevents physical/electrical access to the code once the emergency room is stored in electronic locks, even for the most sophisticated cyberpunk. However, one shortcoming remains.
How are encryption keys installed?
For the question: „Who has access and how can this be managed?“ the most vulnerable point of attack is neither the access control system nor the encryption or physical media (ID cards). The problem is how the cryptographic key gets into the locks in the first place. A breach at this level can leave the entire access control vulnerable.
Disadvantages of factory programming
„Factory programming“ allows cryptographic keys to be securely installed in locks. However, there are three problems with this:
Castle blanks cannot be programmed over a network–encryption is only possible installed code possible. The individual who installs the key on site poses a risk. A visible key can easily be copied, memorized or photographed. To prevent the key from being revealed during initialization, Legic has developed MTSC („Master-Token System-Control“) for key and authorization management. This gives organizations right independence and control over the access security, including cards and readers.
A shared secret is not a secret
The most important thing about MTSC is the conscious avoidance of secrets (keys). through non-human readable, physical symbols ie uncopyable, contactless smart cards.Companies with a security system based on visible passwords often do not realize how easily they can be harmed.MTSC doesn’t use passwords, so there is better control over the security contactless smart car d applications possible.
MTSC is based on a unique, invisible „genetic code“ embedded in a Master Token. Emergency room is transmitted contactless to readers via RFID when the ID card is initialized and when the system is configured. It allows administrators to securely manage their badge population and easily add/remove applications (up to 127 Applications for access control, time and attendance, secure printing, ePayment and others).
Delegation to third parties from the MTSC system
Beyond partial delegation of code implementation to trusted third parties in remote offices or external card reader manufacturers is practical. A „limited initialization card“ is helpful here. Owners of an MTSC system do not have to have a system-wide code, but can give external readers and card manufacturers a physical token that only allows a certain number of feasible configurations. This makes the services strictly controllable, traceable, revocable and verifiable („Hierarchical Delegation of Rights“).
Security through organizational structure and processes
The security is achieved through the physical protection of the master token, because the codes remain hidden, similar to gold bars in a safe. By following basic measures, the reader initialization and the card production is secured by an appropriate level of security and authorized individuals. Master tokens can only be removed via a documented operation with the appropriate approval levels (four-eyes principle). In systems based on visible passwords, the key remains in the memory of at least one individual as soon as the emergency room is removed from the „safe“. With an MTSC master token, passes away does not happen.
With MTSC, basic, verifiable, organizational measures can be implemented for a high level of security for the master token. Physical objects, such as cash or precious metals, are subject to comparable protection. The process for human-readable data is more complex and entails higher security risks. MTSC thus enables the easy implementation of verifiable processes, as in ISO-27001, „Appendix A. 9 Access Control“.
Photo: Fraport The largest German commercial airport in Frankfurt employs about 81.000 Employees. To manage the security of access controls for employees and contractors, a multi-level MTSC security concept was introduced for numerous functions, processes and applications.
The biggest German commercial airport employs about 19. 19 Employees . To manage the security of access controls for employees and contractors, a multi-level MTSC security concept was introduced for numerous functions, processes and applications. Read about the implementation of „Frankfurt Airport: How do you protect an access control system so that it can easily be audited?“
NachrichtenJetRead MoreSicherheit, access, control, mtsc, Nachrichten, security, stay, with