Secure validator platforms.
A validator is the single most security-critical piece of hardware an operator deploys at scale. We design validator platforms that hold up to physical tamper, environmental stress, and the operational reality of fleets of thousands of unattended units.
What design principles apply?
SAM-protected by default
Issuer keys live in a SAM AV2 / AV3, never in firmware. Field-replaceable; one tampered validator does not compromise the fleet.
Tamper-evident enclosure
Housing fits anti-tamper switches, conformal-coated PCBs, sealed connectors. Detached → audit log entry.
Signed firmware
Boot ROM verifies signed firmware images. Anti-rollback counter prevents downgrade attacks.
Buffered, signed receipts
SAM-signed transaction receipts buffered on tamper-evident storage. Lost-power tolerant; lost-network tolerant.
Latency-bounded crypto
Tap-to-decision design budget < 300 ms even with mutual auth + TMAC + audit write. Stage-by-stage breakdown in the low-latency validators guide.
Field-serviceable
SAM, RF antenna, and data-storage modules are field-replaceable units, so a failed or tampered module is swapped in a service window instead of retiring the validator.
Form factors
Gate / turnstile, on-vehicle and handheld inspector validators share one trust chain. What differs is depot-sync cadence, power profile and the fail-safe / fail-secure default. The transit ticketing case study covers a closed-loop DESFire EV2 rollout across 700+ gates and onboard buses. Detail in the Card ↔ Reader ↔ SAM deep-dive.
What goes inside a gate validator?
| Block | Typical choice | Why it is separate |
|---|---|---|
| Application processor | ARM Cortex-A class, Linux | Fare-logic state machine, network stack, UI and depot sync. Fare tables, blacklist and transfer rules stay pinned in RAM; a disk read in the tap path is a bug. |
| I/O microcontroller | Cortex-M class, bare-metal or RTOS | Drives the gate actuator, buzzer and LEDs deterministically, so a busy display never delays the latch. |
| RF front-end | CLRC663 or comparable | ISO/IEC 14443 reader with the antenna tuned in the deployed housing and on the real mounting post, not on the bench. |
| SAM | MIFARE SAM AV2 / AV3, SIM-form FRU | Holds the issuer keys and derives per-card diversified keys. Sits in a tamper-evident socket on a dedicated serial channel; the host session opens once per boot, not once per tap. |
| Non-volatile storage | Industrial eMMC or SD, over-provisioned | Pre-allocated, append-only audit ring with a CMAC over each entry plus the previous entry’s hash. The tap path waits only for the in-RAM append. |
| Backhaul and power | Cellular primary, Wi-Fi or wired failover; battery backup | Backhaul down does not mean validator down. The battery covers a graceful shutdown during a mains or PoE drop. |
Which failures must the platform handle?
| Failure | Platform behaviour |
|---|---|
| SAM unresponsive | Fail-safe (open) or fail-secure (closed) is operator policy, not a firmware default. Either way, log it and alarm the depot; never degrade silently. |
| Blacklist out of date | Honour the cached list, flag the validator as stale, and let the back office reconcile after the next depot sync. |
| Power lost mid-tap | Card anti-tearing counters and the validator’s audit ring together expose the inconsistency on the next read; the issuer reconciles in batch. |
| Storage full | Refuse new taps rather than overwrite receipts that have not been uploaded. |
| Reader CPU panic | Watchdog reboot, reopen the SAM session, resume service. |
| Network gone | Nothing changes at the gate: card and SAM hold every key the tap needs. The network only carries blacklist and fare-table updates in, and receipt batches out. |
Where this page fits
This page covers the validator as a device: hardware, tamper response, firmware trust and serviceability. The rest of the transit stack is covered on its own pages:
- Closed-loop ticketing: the end-to-end system, covering card platforms, anti-fraud, stored value, settlement and offline operation.
- Transit ticketing: what we deliver in a fare-collection rollout and how a pilot starts.
- SAM architecture: why issuer keys live in the SAM and not in validator firmware.
- DESFire EV1 / EV2 / EV3: the card platform the validator authenticates.
- Smart-card personalisation: how the cards and SAMs are keyed before they reach the field.
Designing a validator platform?
From PCB to firmware to SAM personalisation, the Ambimat team works across each layer. Embedded electronics since 1982; identity and secure-element systems since 2017.