Introduction

Pacific Business Services in Dumaguete City inquired with Project NightOwl, a technology incubator and hacker space at Foundation University, Dumaguete City, to develop an RFID-based authentication and authorization system to secure access to their office space. Since NightOwl had already started working on this to secure access to the lab space, extending the existing project to matching the requirements or commercial application is the logical next step.

This is an ideal project for NightOwl to take on as it involves Research & Development as well as prototyping based on knowledge and experience present within the team. It also provides the students of Foundation University with an ideal opportunity to get working experience in a product development project for a real client, including the whole project management, quality control and documentation process. Lastly, the client is very interested in the concept of the NightOwl incubator/hackerspace and is extending support by providing additional budget that can be used to buy tools/materials for the NightOwl space.

Since this project will be used as part of a commercial operation the quality standards are set much higher than for any prototyping done for internal use. Details are important and bugs are to be solved promptly. Code quality and security are important aspects.

Project requirements:

Use only Open Source Software (OSS/FOSS)

Any software created as part of the project is to be released publicly under an OSS license

To ensure that the system can easily be extended at the university the same RFID cards are to be used

Include safety measures in case of calamities

Backlog

Users want to use their FU-issued ID cards for access control

The users want a smaller and nicer looking housing on the doors with access control

Different doors/locations need to be controlled from the same application

Users need to be divided into groups with different permissions

The webapplication needs to use encryption to make it more secure

The communication between the doors and the server needs to be done through the network

Each door needs to have a backup power supply in case of power failure

Each door needs to contain a cache of recently allowed cards in case of communication failure with the server

The door lock mechanism needs to be more powerful in order to minimize technical difficulties with the servo

Project Scope and Requirements

The overall goal is to provide a secure, easy to use and extensible integrated system of hardware and software for a locking mechanism, RFID based authentication, database driven authorization and a web-based management application of these components, including an audit log. The system should be built securely to prevent unauthorized access and tampering, and be modular so additions to the software and hardware may be made at a later point. Last but not least safety measures have to be developed to ensure safe operation during emergency situations including, fires, flooding or earthquakes.

Software

Make use of existing open source software (do not reinvent the wheel)

Devise a plan for security updates of the used software

A secure and simple web-application is needed that provides:

Authentication management (register and remove ID's)

Authorization management (record which users are allowed to do authenticate at specific door locks)

Audit log (show who accessed which resources at what time)

Employ rigid testing and CI practices to ensure code quality

Ensure user's privacy by not providing any information about cards and users to unauthorized users

Backup & Restore functionality

Hardware

A secure lock that is tamper proof from the outside and inside

An RFID scanner that has the same frequency as the FU cards (13.56Mhz)

A network connected controller that is capable of handling authentication, authorization and serving the web application

Include a method to open the door quickly from the inside in case of power failure or other calamities

Possible future additions

Authentication and authorization from other sources (LDAP/AD, centralized databases, etc)

Centralized authentication and authorization database in case of multiple readers

Touch screen interface to the authentication/authorization/audit-log management application

Materials and Budget

Below are the actually required materials for the client. In agreement with Ryan we will later on add extra materials or some equipment to add to our own supply.

Item	Links	Comments	Price (USD)	Quantity	Total
Raspberry Pi 3 or alternative controller	http://ph.rs-online.com/web/p/processor-microcontroller-development-kits/8968660/	45.00	2	90.00
Role of 3D printing filament	https://www.olx.ph/item/3d-printer-filaments-3-0mm-ID6NmZy.html?p=7&h=866709ada5#866709ada5	30.00.00	1	30
5.1V, 1 Output, Micro USB Plug In Power Supply, 2.5A, 13W Official Raspberry Pi Power Supply	http://ph.rs-online.com/web/p/plug-in-power-supply/9098135/	12.50	2	25.00
RFID Reader	https://www.sparkfun.com/products/10126	13.56-MHz	35.00	2	70.00
Servo	https://www.sparkfun.com/products/9347	Use the same or stronger as we have at the lab	15.00	2	30.00
Lock	Dumaguete City,Citi Hardware Store	Lock for a good quality lock, not tampering from the outside, no key outside, possible to interface with servo	35.00	1	35.00
IFixit Pro Tech Toolkit	https://www.ifixit.com/Store/Parts/Pro-Tech-Toolkit/IF145-307-1	110.00	1	110.00
Contribution to NightOwl	205.00	1	205.00
Total USD	595.00
Total PHP	28940.00

Design

RFID reader

Controller

Authentication and Authorization protocols and software (See also the article on Privacy Preserving Authorized RFID Authentication Protocols)

Management web application

Security and privacy

Progress

Students have started on the code side of the management and authentication application.

We made a 3D design for the connection between the servo and the lock, and a design for the mounting of the servo to the door. The files can be found on https://github.com/Waterspace/servo-lock-mount. If you click on the stl files, github shows you an interactive 3D view of the model.

The model has been printed, and after some tweaking, a heat gun and superglue we got it to fit! So now we need to create a casing for the electronics and hook everything up!

The code for the current arduino version can be found on github.

Interesting links

http://www.instructables.com/id/A-Universal-RFID-Key/

http://www.instructables.com/id/RFID-Emulator-How-to-Clone-RFID-Card-Tag-/

http://www.secureidnews.com/news-item/understanding-rfid-part-9-rfid-privacy-and-security/

http://www.projectmanagementdocs.com/project-planning-templates/project-management-plan.html#axzz4HZDJlNV0

http://www.openbeacon.org/

http://www.openpcd.org/

http://llrp.org/

http://transcends.co/open-source-rifidi-products/