PKI is fast becoming a leading driver in controlling physical access 
 The Public Key Infrastructure is beginning to be adopted as a driver in physical access 
Traditionally associated with logical access and the digital signing of documents, Public Key Infrastructure (PKI) is now also being used to control physical access. Their use in physical access control is likely to be more prevalent with the implementation of the FIPS 201-2 recommendations this year. Derek Scheips of ASSA Abloy Future Lab explores the benefits of this key infrastructure for physical access systems.


PKI is fast becoming a leading driver in controlling physical access largely due to FIPS 201 (Federal Information Processing Standards Publication 201), US government physical-access control specifications recommending PKI at the door. Recommendations since 2005, they are expected to become mandates with FIPS 201-2 later this year.

FIPS explained

FIPS offers standards for not only what information should be stored on an ID card, but also best practices for verifying the credential is authentic and in the right person's possession, says Kevin Graebel, product manager of HID credentials at HID Global, a leading manufacturer of physical and logical access control solutions. "A digital certificate is placed on the card with the user's key information/access levels. Then the PKI process sends that information via an electronic bridge to a federal certificate authority, making sure access hasn't been revoked or information tampered with."

Benefits of PKI-based access systems

The primary benefit of a PKI-based access system is that it does not depend on a shared secret key 

PKI boils down to the use of a mathematically linked pair of keys, one designated public and the other designated private. The linkage ensures that information processed with one key can only be decoded or validated using the other key.

"The primary benefit of a PKI-based access system is that it does not depend on a shared secret key; instead it uses an asymmetric key pair," says Graebel. "In traditional access systems, the reader and the access card share a symmetric key used to authenticate each other. This requires a great deal of coordination between the cards and readers, especially when the cards may be used at more than one location. Using PKI, only the public key of the card needs to be shared, and it can easily be revoked or changed in the event of a breach. The private key is stored securely within the card."

Many advances in deploying PKIs have led to efficiency and interoperability that make it a natural choice not just for logical but also physical access control. "An organization can use a single PKI smart card, such as a PIV (Personal Identity Verification) card, for physical access to a building and to certain rooms, and for logical access to workstations, servers, VPNs, and so on," notes Dave Coombs, director of PKI Standards and Policy at Carillon Information Security, a Canadian air transport and aerospace identity management consulting firm. "This reduces the complexity of managing access control: manual provisioning or removal of access for a person in dozens of different systems is replaced with the issuance or revocation of a single credential."

Furthermore, recent interoperability advances allow one organization that accepts PIV cards to understand the identity of a visitor with a PIV card from a completely separate organization.

Many advances in deploying PKIs have led to efficiency and interoperability that make it a natural choice for not just logical but also physical access control 
 Advances in deploying PKI-based have led to interoperability that make it the natural choice for physical access control
Cost of adopting PKI

But despite PKI's promise, there can be disadvantages, including cost and speed. "At a minimum, organizations will need to create or have access to a Certification Authority to manage the generation and validation of certificates," says Graebel. Depending on how this is implemented, it may require costly rewiring and upgrading of all of their readers."

Contact versus contactless access control cards

The speed is also a bottleneck for physical access control. For durability and vandalism reasons, it is more practical to use contactless rather than contact communication between the card and the reader and then communication can take as much as 1.5 to 2 seconds. This may not seem like a long time, but when users are used to the fraction of a second read times offered by technologies like Prox or iCLASS, it can cause issues.

"One disadvantage we hear about is the perceived slowness of PKI at the door," observes Coombs. "This can be mitigated by caching revocation information or OCSP (Online Certificate Status Protocol) responses, or even by pre-validating every morning each credential that was used at that site the previous day." He predicts that in the coming years: "more and more public and private organizations will be going this route, particularly given the work being done in the US right now."

PKI development in Europe

Of course, many countries have been developing their own PKI methodologies in parallel.

 An organization can use a single PKI smart card, such as a PIV (Personal Identity Verification) card, for physical access to a building
Organisations can use a single PKI smart card for physical access to a building, and access to workstation and certain rooms
The French government issues PKI credentials to its citizens every year to file their income tax, and its General Security Framework (RGS) includes recommendations on securing large-scale IT systems using PKI. "The Belgians have done something similar with their eID card," says Coombs. "It's a PKI-enabled smart card issued to Belgian citizens to authenticate their access to government systems and programs online."

Meanwhile, the German government is leading the way in implementing the European Union directive concerning ‘qualified signature' certificates, the only kind of digital signature that carries the force of law in Europe. 

It should be noted that these European initiatives concern only logical access control to information systems, and it is still early days for PKI as a physical access control. At this point, very few public companies are choosing to use PKI for physical access control because of the newness and relative complexity, observes Graebel. "I suspect it will become more common as FIPS 201-2 is implemented and there is a wider variety of products available on the market to support it."

 Derek Scheips of Assa abloy Future LabsDerek Scheips
Freelance Writer
Assa Abloy Future Lab
Download PDF version

In case you missed it

4K analogue cameras are still an ideal solution for video surveillance systems
4K analogue cameras are still an ideal solution for video surveillance systems

One of the toughest business decisions companies need to make is when selecting a new video surveillance system, as it’s a rigorous process to compare camera offerings and technologies, and to evaluate price structures. With its proven performance over the last several years, IP surveillance systems have become the defacto standard for most professionals. Those experts typically cite the numerous benefits that IP cameras offer, including higher image resolution, ease of installation, scalability, and analytics as rationale – which are all valid. However, the biggest drawback is the high price tag when considering making the switch from an analogue to a dedicated IP surveillance system. In reality, many end users don’t need networked IP cameras in every location throughout their facility, as the additional features and benefits IP cameras typically provide may not be necessary in every location. Ultimately, the decision to stick with analogue or move to IP needs to be based on your surveillance objectives and future needs. Advantages of 4K Consider this – you’re managing an analogue surveillance system and your primary goal is to increase image resolution; 4K analogue cameras may be your ideal solution. Advanced 4K analogue surveillance cameras deliver a myriad of advantages, including: Superior resolution Lower cost and easy installation. Picture clarity even under changing or difficult lighting conditions Models with 2 and 4 megapixel resolution, such as Dahua’s HDCVI 4K cameras with scalable HD-over-coax technology, provide security professionals with greater situational awareness and are available in multiple form factors to provide exceptional quality video & audio for a wide range of surveillance applications.Since 4K analogue cameras are not connected to an IP network, they do not present the cybersecurity risks that are typically associated with IP cameras Greater distance, greater definition Another benefit of 4K analogue cameras is that their higher number of pixels provides increased digital zoom performance without pixilation versus traditional HD or 2K cameras. This allows security operators to see further into the distance with greater definition. The added resolution is especially important for popular applications that require higher levels of detail, such as face and licence plate recognition or object analysis, as well as emerging video analytics and artificial intelligence applications for future system enhancements. 4K analogue applications 4K analogue cameras are also ideally suited to cover large fields of view such as in sports stadiums or airports with great detail and accurate colour reproduction. Their superior digital zoom capabilities can allow 4K analogue cameras to do the work of two cameras – one for a wide view and another for close-up – without sacrificing quality or compromising security. This can also help dramatically reduce hardware and installation cost, and simplify video monitoring. Finally, since 4K analogue cameras are not connected to an IP network, they do not present the cybersecurity risks that are typically associated with IP cameras. With the ever-increasing amount of sensitive and personal information stored on networked drives at businesses of all types, the value of removing one more potential network entry point cannot be understated. Overall, with 4K analogue cameras, security professionals can take advantage of higher resolution video on an existing, cost-effective platform that’s safe from network intruders with isolated and limited installation downtime and exceptional cost-efficiencies.

How new video surveillance technology boosts airport security and operations
How new video surveillance technology boosts airport security and operations

The air travel industry has evolved from one commercial passenger on the first commercial flight in 1914 to an estimated 100,000 flights per day. According to The International Air Transport Association (IATA), the total number of passengers who flew in 2017 is expected to reach 3.7 billion.   But it’s not just people who fly. Each day, more than $18.6 billion of goods travel by air, which represents one-third of all world trade, by value. Meanwhile, the aviation industry supports more than 63 million jobs and generates $2.2 trillion in economic activity. According to the IATA, 3.5% of the global economy relies on aviation. Evolving airport security for today’s demands Airport security continues to evolve as well, as security personnel strive to keep ahead of increasing threats and the compliance issues enacted to help address them. It’s taken nearly 40 years to progress from the first widespread use of X-ray scans and metal detectors to today’s full-body imaging and video surveillance solutions to mitigate security breaches and other critical security challenges. Employing airport security solutions is a complex situation with myriad government, state and local rules and regulations that need to be addressed while ensuring the comfort needs of passengers. Airport security is further challenged with improving and increasing operational efficiencies, as budgets are always an issue. As an example, security and operational data must be easily shared with other airport departments and local agencies such as police, customs, emergency response and airport operations to drive a more proactive approach across the organisation. New surveillance technologies To manage these and other issues facing the aviation industry, airport security management is increasingly looking to leverage new surveillance technologies to help streamline operations and to build stronger security programs. New and enhanced surveillance technologies such as powerful open platform Video Management Systems (VMS), HD panoramic cameras, and highly specialised video analytics are at the heart of today’s advanced networked surveillance solutions for airports and aviation facilities. Airport perimeters are quite extensive in size, irregular in shape, and subject to compromised visibility due to poor lighting Protecting the perimeter As an example, many airport perimeters are quite extensive in size, irregular in shape, and subject to compromised visibility due to poor lighting. Compounding the security challenge, these perimeters are often protected only by simple fences that can be easily scaled or broken through, and areas outside the fences may include wild forests in rural areas or residential and commercial buildings in more populous regions. All of these factors make it all the more difficult – and all the more important – to keep watch on perimeter areas. Analytics boosts effectiveness Camera coverage is the first step for monitoring the perimeter, but to improve the monitoring of these areas, airports can automate much of the monitoring, threat identification and notification needed to keep the entire premises safe by implementing video analytics. Market-leading offerings now include cameras with built-in analytic functions to make it easier and more effective to implement improved detection. For example, some of the more commonly available functions now include perimeter crossing, intrusion detection, object left behind, object missing, and wrong direction.Surveillance technologies allow the creation of virtual fences which can send a security team proactive notices of suspicious activity With these functions already built in, today’s high-performance security cameras not only capture clear video but can also employ analytics to monitor the field of view. In the case of an airport perimeter, analytics can be set up to automatically monitor a fence line to detect breaches or potential breaches while filtering out false alarms from small animals or blowing debris and alert authorities quickly when action is needed. Surveillance cameras can also be easily deployed over a perimeter to quickly detect and identify causes of perimeter breaches, and provide instant alerts to notify personnel where the breach is occurring, reducing the need for security personnel to physically monitor miles of perimeter fencing. In fact, surveillance technologies allow the creation of virtual fences which can send a security team proactive notices of suspicious activity. VMS Systems control with confidence All perimeter surveillance solutions can be integrated with an airport’s VMS, providing users with an easy-to-manage centralised hub to monitor and manage airport security. Overall, a perimeter security solution can help keep unauthorised individuals away from runways, taxiways, aircraft and other airport infrastructure in all types of weather conditions and environments. Within other restricted areas of an airport, such as parking lots, garages and secured areas, surveillance solutions are available to reduce risk and improve security. In a parking garage, IP cameras and a VMS can integrate third-party analytics to quickly identify and alert personnel when unauthorised vehicles have entered a restricted area, including vehicles with license plates on watch lists. When an alert is detected, data from third-party vehicle tracking software can be accessed via the VMS to monitor and track the vehicles activity while security personnel get into position to investigate further. Preventing theft in airports On the tarmac and inside baggage handling areas, loss or theft of luggage and other high-ticket items not only cause brand damage to an airport or airline, but complaints from travellers. A CNN analysis of passenger property loss claims filed with the TSA from 2010 to 2014 shows 30,621 claims of missing valuables, mostly packed in checked luggage. The rest occurred at security checkpoints. Total property loss claimed is estimated at $2.5 million. Loss or theft of luggage and other high-ticket items not only cause brand damage to an airport or airline, but complaints from travellers Security technology can mitigate the issue with IP cameras and VMS integrated with a Baggage Handling Systems (BHS) to automatically validate system operation and abnormal behaviours. This allows security and operations management to see where and why alarms are triggered so they can quickly respond and mitigate the problem. Monitoring crowds and foot traffic Inside an airport, VMS solutions with analytics capabilities can monitor crowd movements and anticipate and proactively respond to choke points, crowd patterns and foot traffic flow to reduce risk and improve security. The solutions can quickly and efficiently locate a person of interest, such as a lost child, for example, and search for shirt colour, estimated height to facial features, and more. With the ability to track via recorded and live video, security personnel can start their search from the moment the child was last seen and track their movement throughout the entire airport. Murtala Muhammed Airport Terminal Two (MMA2), Nigeria’s preeminent air terminal, is one example of an airport that is benefitting from a security technology upgrade to mitigate security threats. The airport is using an open platform VideoXpert™ Video Management System (VMS) in addition to a combination of low-light cameras and high-resolution dome cameras to secure its parking structure, perimeter, baggage claim points, cargo area and other parts of the airport.With the ability to track via recorded and live video, security personnel can track a person’s movement throughout the entire airport The security cameras are providing airport security with high-quality images, motion detection, advanced tracking capabilities, and on-board analytics, while the VMS is unifying operational and security data via a single user interface and allowing airport security to be more proactive in its incident response. People counting and ANPR In the U.S., a large cargo airport has employed 1,100 IP video cameras with a new Video Management System (VMS) solution to address the entire airport’s needs, including security and surveillance. The solution not only features crystal clear images, but also can archive video for 30 days at 30 images per second. A VMS manages the system and provides valuable analytics, including people-counting and number plate capture. It will soon add an enterprise security solution to improve access control system management and integration with the VMS. Airports around the world are increasingly realising the benefits of advanced surveillance solutions to drive operational intelligence and provide comprehensive situational awareness. As the transportation industry continues to expand, so will their use of more advanced surveillance systems on the enterprise level that incorporate even higher levels of system control and management, wide area coverage imaging solutions, and intelligence to keep passengers safe and operations running smoothly.

The new alliance of humans and robotics in security solutions in 2018
The new alliance of humans and robotics in security solutions in 2018

  The past year has proved to be a year full of many changes both within our industry and for Robotic Assistance Devices (RAD). While we have experienced increased adoption of artificial intelligence-based solutions, the industry has been challenged with an ever-evolving technology landscape. Protecting enterprise organisations from both cyber and physical security threats will be an ongoing challenge the industry must grapple with. Greater adoption of robotic solutions To address the physical security challenges, we saw a greater adoption of robotic solutions across the board. Our massive industry started to make the change: Shifting from an uneducated view of this advanced technology to increased interest about artificial intelligence across multiple markets including guarding companies, integrators and, most importantly, end-users. In 2017 there was a greater adoption of robotic solutions across the board With security-guard robots, security directors now have access to additional tools to meet their performance and budget goals. Currently, we see a great adoption with progressive guarding companies, which are signing up to have RAD as their robotic guarding partner. RAD deployed its first robot this year, and we look forward to deploying many more as we work with our customers to customise our robotic solution to their needs. Human collaboration with robotics I believe our industry is at the beginning stages of what could be a serious paradigm shift in how we rely on a combination of humans and technology to do a job. We've seen that in video analytics and the wide variety of solutions available on the market today. The trend has progressed beyond video analytics and into robotics, and that will continue to evolve into 2018 and beyond. As we continue to build on the success of our security guard robot solution, we look forward to expanding our product offerings to meet the security needs of our customers.