Messaging Protocols: Difference between revisions

Revision as of 23:59, 25 November 2011

Ideally, session is encrypted and authenticated at all levels
- User should know they are interacting with a legitimate terminal
- Token should know that it is talking to a legitimate reader
- Reader should not leak any secrets during transaction
- Secrets should not be subject to interception between reader and server/panel
  - Physically secure wiring/network
  - Secure/encrypted protocols
Messages should be not be able to vulnerable to session replay
- Time stamping/serializing of messages
Messages should not be subject to intentional or accidental alteration in transit
- Message CRC and cryptographic signing/MAC protocol

@@ Line 3: / Line 3: @@
 * [http://www.modbus.org MODBUS - Industrial Control protocol, works over serial or Ethernet]
 ** [http://www.modbus.org/docs/Modbus_over_serial_line_V1.pdf MODBUS over Serial]
+====End to end session protocol====
+=====Considerations=====
+*Ideally, session is encrypted and authenticated at all levels
+**User should know they are interacting with a legitimate terminal
+**Token should know that it is talking to a legitimate reader
+**Reader should not leak any secrets during transaction
+**Secrets should not be subject to interception between reader and server/panel
+***Physically secure wiring/network
+***Secure/encrypted protocols
+*Messages should be not be able to vulnerable to session replay
+**Time stamping/serializing of messages
+*Messages should not be subject to intentional or accidental alteration in transit
+**Message CRC and cryptographic signing/MAC protocol
 =====Protocols and Session Flow=====
 *[[Example Message Flow]]