search

noisebridge / rfid-access-control

Little system to handle RFID access control at Noisebridge
GNU General Public License v2.0
48 stars 19 forks source link

produce binary that opens bottom gate / upper door #7

Open patrickod opened 9 years ago

patrickod commented 9 years ago

It'd be neat to have a binary that opens the gate and door such that it could be used to buzz people in remotely. This use case has come up recently so opening an issue to note it. Hopefully will get a chance to do this myself soon.

hzeller commented 9 years ago

For the immediate case: Have a look in the home-directory pi@earl - there I have a rough script that opens the toplevel door with 'manual' means operating the GPIO pins directly. it needs to be adapted to take a parameter to distinguish between upper and lower which essentially selects the GPIO 8 or 7.

Having said that, something that remotely (and securely) opens the gate would be good. In general, there is the problem of authentication. RFID IDs must be considered public knowledge as anyone can read them out if they have access to the token. Often the ID is even printed on the token itself.

Our current (somewhat weak) security is based on the assumption that only someone with sufficient hardware building capability is able to radio-simulate the physical token towards the RFID reader if (s)he knows the token ID. Having said that, such a person is probably welcome in a Hackerspace :)

So to generate some authentication token, we would require reading in the physical RFID somewhere, e.g. the door, and with that create an 'application token' of some kind that is valid for some time. It could be a HMAC from the RFID key + ticket timeout, or, probably more secure w.r.t. leaked earl keys, simply random string that is valid for a while and kept in earls volatile memory, mapping that random key to the actual authentication token including its expiry time.

This authentication token can be used for temporary door accesses like these (and later to authenticate users on terminals etc.)

patrickod commented 9 years ago

Opening the door via some remote API would be a neat extension in the future.

or the moment however the use case I have in mind is: someone I know / trust is at the door and unable to gain access to noisebridge. It'd be neat to have a way to do this this remotely with access to earl via SSH.

On Fri, Apr 10, 2015 at 03:35:36PM -0700, Henner Zeller wrote:

For the immediate case: Have a look in the home-directory pi@earl - there I have a rough script that opens the toplevel door with 'manual' means operating the GPIO pins directly. it needs to be adapted to take a parameter to distinguish between upper and lower which essentially selects the GPIO 8 or 7.

Having said that, something that remotely (and securely) opens the gate would be good. In general, there is the problem of authentication. RFID IDs must be considered public knowledge as anyone can read them out if they have access to the token. Often the ID is even printed on the token itself.

Our current (somewhat weak) security is based on the assumption that only someone with sufficient hardware building capability is able to radio-simulate the physical token towards the RFID reader if (s)he knows the token ID. Having said that, such a person is probably welcome in a Hackerspace :)

So to generate some authentication token, we would require reading in the physical RFID somewhere, e.g. the door, and with that create an 'application token' of some kind that is valid for some time. It could be a HMAC from the RFID key + ticket timeout, or, probably more secure w.r.t. leaked earl keys, simply random string that is valid for a while and kept in earls volatile memory, mapping that random key to the actual authentication token including its expiry time.

This authentication token can be used for temporary door accesses like these (and later to authenticate users on terminals etc.)

Reply to this email directly or view it on GitHub: https://github.com/hzeller/rfid-access-control/issues/7#issuecomment-91709525

Patrick O'Doherty +1 (650) 701-7829

hzeller commented 9 years ago

or the moment however the use case I have in mind is: someone I know / trust is at the door and unable to gain access to noisebridge. It'd be neat to have a way to do this this remotely with access to earl via SSH.

Yes, for that, the existing script is perfect.