Add PKI authentication and encryption
To control access to readers and protect host-reader communication, we recommend you set up authentication and encryption. This allows you to manage a host application's access permissions, require the host to authenticate with the readers, and establish an encrypted connection.
Non-Ethernet readers do not support PKI, but only AES.
Advantages of PKI over AES
BALTECH tool support
BALTECH tools currently only support PKI authentication and encryption. Thus, if you go for PKI implementation as well, so you can use our tools for convenient testing and maintenance.
Individual key pair per device
AES is based on 1 symmetric key shared by the host and all readers. PKI is an asymmetric method, i.e. both the host and each reader have their own key pairs. This means: If one of the readers is compromised, all other keys and thus the connections to all other readers remain unaffected.
Perfect forward secrecy
PKI provides perfect forward secrecy (PFS). This means: Even if the private keys of host and reader are compromised later on, the data exchanged cannot be reconstructed.
Start testing with BALTECH default certificates
ID-engine XE readers are shipped with preinstalled key pairs and certificates, so they're already set up for PKI authentication and encryption. While the key pairs are unique and thus safe to use in production, the certificates are BALTECH default certificates and thus only meant for testing with BALTECH tools.
Do not use in production
For security reasons, do not use BALTECH default certificates and keys when implementing PKI authentication and encryption in a productive environment. For a secure implementation workflow, see the steps below.
Implement PKI authentication and encryption
When you add an Ethernet host interface component, authentication is required by default.
To define which permissions the host gets when establishing an unauthenticated connection, set the option Grant Exceptions for Plain Communication accordingly:
|Full Permissions in Normal Mode and Maintenance Mode||All operations are allowed in maintenance mode and normal mode; authentication is not required.|
|Full Permissions in Maintenance Mode||All operations are allowed in maintenance mode without authentication; normal mode requires authentication.|
|Factory Reset in Maintenance Mode||Factory reset is allowed in maintenance mode without authentication; all other operations require authentication.|
Create your own PKI
For productive use, replace the BALTECH default certificates and host key with your own ones. To do so, create your own PKI.