How to enable OSDP Secure Channel encryption on A1001

[dan-bishopfox]

Hey,

I'm trying to enable OSDP Secure Channel encryption on the connection between my Axis A1001 (firmware 1.65.4) and an HID Signo 20 badge reader. (Which definitely supports secure channel) Out of the box, it's easy to get the two to talk to each other over OSDP, but the connection is not encrypted. After talking to Axis support, it appears that this functionality DOES exist, but is not available in the web interface (there's no button for it).

The API documentation has this to say about it:
https://www.axis.com/vapix-library/subjects/t10067552/section/t10067528/display?section=t10067528-t10096768

So naturally, I tried that but to no avail.

Here's the current config I'm working with:
https://gist.github.com/dan-bishopfox/fc75cb7bbd84788780e478b17375f954

It's basically just a regular working config as created by the web interface, but with two fields changed. (Which is what the API call in the instructions has you do)

        {
          "Name": "IdPoint.SecureChannel.KeyToken",
          "Value": "my_key"
        },
        {
          "Name": "IdPoint.SecureChannel.KeyType",
          "Value": "KeyBase"
        },

FWIW: the "my_key" field definitely exists, too. I can check it in the API here:

{
  "EncryptionKey": 
    [
      {
        "token": "my_key",
        "Key": "*****",
        "Name": "My key name",
        "Description": "My key description",
        "ModificationTime": "2022-10-26T15:32:04.960676Z"
      }
    ]
}

The IDPoint says that it supports SecureChannel:

http://____/vapix/idpoint/GetIdPointCapabilities?Token=Axis-accc8e24387c:1666798271.634476000
{
  "IdPointCapabilities": {
    "Configurable": true,
    "SupportCard": true,
    "SupportPIN": true,
    "SupportREX": false,
    "SupportBiometric": false,
    "SupportedMessageTypes": [],
    "SupportedGraphicsTypes": [],
    "SupportedAudioTypes": [],
    "AdditionalCapabilities": ["SecureChannel"]
  }
}

But for some reason, encryption is not enabled:

http://____/vapix/idpoint/GetSecureChannelStatus?Token=Axis-accc8e24387c:1666798271.634476000
{
  "SecureChannelStatus": {
    "Active": false,
    "Reason": "Unknown"
  }
}

Does anyone have a clue about how to enable OSDP Secure Channel encryption?

[NaishiM]

First of all, are you using Axis Entry Manager or do you have your own access control management software? If you are using Axis Entry Manager (Embeded access control managment software on A1001), it will be more complicated as we dont encourage mix AEM and API calls, it has the potiential to mess up the whole system.
If you are using APIs only, the following steps are needed:

1. First, you will need to add a key to the keystore. Issue the following call to the axkey service:

{ "axkey:SetEncryptionKey":
{ "axkey:EncryptionKey":
[
{"Name":"My key name",
"Description":"My key description",
"token": "my_key",
"Key": "00010203040506070809101112131415"}
]
}
}

2. Configuring IdPoint:

{ "axtid:SetIdPoint":
{ "IdPoint":
[
{"Name":"My OSDP SC IdPoint",
"Action":"Access",
"token":"osdp_sc_idpoint",
"MaxPINSize": 4,
"MinPINSize": }
]
}
}

3. Once the IdPoint is set, add an IdPointConfiguration using the same token as in the call to tid:SetIdPoint. Note that there are more parameters to SetIdPointConfiguration - only the ones relevant to OSDP secure channel configuration are shown below.

{ "axtid:SetIdPointConfiguration":
{ "IdPointConfiguration":
[
{"token": "osdp_sc_idpoint", "Configuration":
[
{"Name":"IdPoint.Reader.Type",
"Value":"RS-485HD"},
{"Name":"IdPoint.RS-485HD.Protocol",
"Value":"OSDP"},
{"Name":"IdPoint.SecureChannel.KeyToken",
"Value":"my_key"},
{"Name":"IdPoint.SecureChannel.KeyType",
"Value":"KeyBase"}
]
}
]
}
}

4. The IdPoint is now configured to use the key with token my_key from the keystore (the value of this key is 00010203040506070809101112131415). The key has also been specified as a base key (no diversification using cUID). Valid values for KeyType is either KeyBase, KeyMaster or None. Entering None should tear down an existing secure channel if one exists.

5. Once the steps above have been completed, the rest of the setup could be done as usual to get a working system (IO assignments, doors, access points, credentials and users).

Hope that this helps.

[dan-bishopfox]

After talking with Axis tech support further, I think the answer is that the A1001 does not support OSDP Secure Channel encryption. Which is unfortunate since... that's kind of the whole point.

[NaishiM]

Not sure what tech support told you exactly, do you have the support ticket number? But A1001 supports secure channel and this feature has been implemented by several software. The key thing here is that you will have to use API implementation, not via the GUI access control management software, this also includes hardware configuration as configuring idponit is part of hardware configuration.

[dan-bishopfox]

Ah, I may have misunderstood tech support then? The ticket number is 02029604.

Perhaps I was trying to mix-and-match using the web interface and API too much then. I didn't know they were going to conflict. I'll give it a try just using the API and see how that goes and get back to you.

Thanks for the reply!

[NaishiM]

Hi, I had a look of the support ticket. The support engineer was talking about that A1001 can not be used together with Axis Camera Station. If Axis Camera Station is the access control management software that you are using, then you will not be able to use Secure Channel feature of course.
Here is the short summary:

1. If you are using Axis Entry Manager(access control managment software that web based built in for A1001), it will be very trick to use Secure Channel feature.
2. A1001 can not be used together with Axis Camera Station Secure Entry, therefore Secure Channel can not be supported.
3. If you have your access control software and integrated A1001 via APIs, it is possible to use Secure Channel feature. Please note, A1001 and A1601 share almost all the APIs. If you have integrated A1001 via APIs, A1601 can work out of the box.

[dan-bishopfox]

Thanks! Right now I'm just testing it out to make sure I can get the Secure Channel to work, so I'm sending requests to the controller API manually with python I wrote myself. So it's not exactly any "access control management software".

Doing the three requests to setup the idpoint seems simple and works. But getting the door and users and such working without the web interface is harder. Is there by chance any example code that can do some of this setup?

[dan-bishopfox]

Okay @NaishiM so here's what I'm observing when using the API. Perhaps there's something I'm doing wrong in here. Here is my Python script which calls the API. It is meant to be run after doing a factory reset, so it starts with a clean slate:

https://gist.github.com/dan-bishopfox/67d8a7ad5109b51a8c9f04cbf2294af0

It sets the device password, sets up a key, idpoint, configs the idpoint, door, etc... Notably, the OSDP KeyType is set to None. https://gist.github.com/dan-bishopfox/67d8a7ad5109b51a8c9f04cbf2294af0#file-setup-py-L67

When the KeyType is set to None, the controller successfully initializes the Signo 20 reader. I'm reading the raw bytes over serial and I can see the OSDP commands:
Capability Request
Capability Reply
ID Report Request
ID Report Reply
LED Control Request
Reader Buzzer Request (The reader audibly beeps)
(plus a constant hum of status requests and acks)

So it "works". Except the data is not encrypted. It's all in cleartext, no Secure Channel.

However when I run the exact same script with just line 67 changed to either KeyBase or KeyMaster, the controller no longer initializes the reader.
The controller cycles through each ID value 0 -> 126, and when it gets to 4 (my reader has an ID of 4) an ack is sent. But it seemingly gets ignored by the controller. It just keeps cycling through sending status requests to every ID value, never initializing the reader.

For what it's worth, this is the exact same behavior as when I was trying to use the web interface and just set the OSDP Secure Channel options via API.

[dan-bishopfox]

After playing with this for a few weeks, I can only conclude that the A1001 doesn't support secure channel encryption. It stops working as soon as you try to turn it on, and I can't see anything wrong with my setup. (Script above)