ASAmbiSecureHardware-rooted security
Closed-loop transit ticketing, designed offline-first.
DESFire EV2/EV3 cards, SAM-backed validators, sub-300 ms taps, and a system that keeps collecting fares when the backend is down. The architecture that decides whether your morning rush moves.
Why offline trust
An online-only validator is a validator that fails during connectivity loss. In transit, connectivity loss happens daily — tunnels, backend deploys, NIC failures. The validator’s job is to keep collecting fares correctly anyway. That means the validator + the card must be able to decide every tap locally, without phoning home.
The architecture
| Component | Role |
|---|---|
| Card (DESFire EV2/EV3) | Per-card diversified AES-128 keys; encrypted, MAC’d value-file purse; EV2 anti-cloning detection. |
| Validator | Reader hardware running a thin app; speaks ISO/IEC 14443 to the card; speaks SAM commands to the SAM. |
| SAM | Holds master keys; derives per-card keys; runs the mutual-auth + spend protocol; signs the tap-journal entries. |
| Local tap journal | Append-only, SAM-MAC’d. Survives backend outages. Becomes the revenue audit trail. |
| Backend | Reconciliation, hot-list management, revenue ledger. |
Latency budget
- RF anticollision: 30-50 ms
- SAM-side key derivation: 40-80 ms (cold), <10 ms (warm)
- Mutual auth: 30-60 ms
- Read + spend: 30-50 ms
- Journal commit: 10-20 ms
- Gate motor: 30-100 ms
Typical total: 170-360 ms. Online round-trip on top would add 50-200 ms per tap with no resilience benefit.
Threat coverage
- Card cloning — SAM-derived per-card keys + EV2 anti-cloning detection.
- Validator compromise — master keys are in the SAM, not the validator’s flash.
- Replay / double-spend — monotonic sequence numbers per card.
- Insider key extraction — HSM-backed master-key generation; M-of-N personalisation.
- Backend outage misuse — tap-journal MACs verifiable independently of backend state.
Hot-list strategy
- SAM-derived mutual auth at the validator (catches clones, always works offline).
- Recent-revocations push from backend on connectivity (catches recent loss reports).
- Full reconciliation at tap-journal upload (catches everything; resolves financially in closed-loop).
Related on the AmbiSecure site
Designing or modernising a closed-loop system?
Bring your fleet size and your latency budget. We’ll bring an architecture sketch within a week.