{"id":7919,"date":"2019-11-07T17:17:06","date_gmt":"2019-11-07T16:17:06","guid":{"rendered":"http:\/\/blog.actn.fr\/?p=7919"},"modified":"2019-11-07T17:17:06","modified_gmt":"2019-11-07T16:17:06","slug":"guide-bien-choisir-son-architecture-pour-le-controle-dacces-physique","status":"publish","type":"post","link":"https:\/\/blog.actn.fr\/?p=7919","title":{"rendered":"GUIDE : Bien choisir son architecture pour le contr\u00f4le d&#039;acc\u00e8s physique"},"content":{"rendered":"<p>\t\t\t\t<![CDATA[\n\n<p style=\"text-align: justify;\"><span style=\"font-size: 20px;\"><strong>Dans son guide sur la \u00ab\u00a0S\u00e9curit\u00e9 des technologies sans contact pour le contr\u00f4le d&rsquo;acc\u00e8s\u00a0\u00bb, l&rsquo;ANSII (Agence Nationale de S\u00e9curit\u00e9 des Syst\u00e8mes d\u2019Information) pr\u00e9conise deux types d&rsquo;architecture.<\/strong><\/span><\/p>\n\n\n\n\n\n<h3 style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7922\" src=\"http:\/\/blog.actn.fr\/wp-content\/uploads\/2019\/11\/ANSSI.jpg\" alt=\"\" width=\"310\" height=\"280\" \/><\/h3>\n\n\n\n\n<h3 style=\"text-align: justify;\"><strong>ARCHITECTURES ANSSI 1 ET ANSSI 2<\/strong><\/h3>\n\n\n\n\n<p style=\"text-align: justify;\">Le choix d\u2019une architecture avec t\u00eates de lecture passives (qui se contentent simplement de transf\u00e9rer les messages) permet de s\u2019affranchir des probl\u00e9matiques de s\u00e9curit\u00e9 des liaisons filaires entre les t\u00eates de lecture et les UTL, dans la mesure o\u00f9 le badge est s\u00e9curis\u00e9. Dans le cas contraire, les informations circulant dans les liaisons filaires ext\u00e9rieures doivent \u00eatre prot\u00e9g\u00e9es en confidentialit\u00e9 et en int\u00e9grit\u00e9. Il existe diff\u00e9rents types d\u2019architectures, faisant intervenir les trois \u00e9l\u00e9ments supports principaux : le badge, la t\u00eate de lecture, et l\u2019unit\u00e9 de traitement local (UTL). Ces \u00e9l\u00e9ments interviennent \u00e0 diff\u00e9rents niveaux et avec des m\u00e9canismes de s\u00e9curit\u00e9 variables.<\/p>\n\n\n\n\n<p style=\"text-align: justify;\"><strong>Architecture n\u00b01, hautement recommand\u00e9e<\/strong>\nT\u00eate de lecture transparente, authentification de bout en bout ; Le badge, s\u00e9curis\u00e9, s\u2019identifie et s\u2019authentifie directement \u00e0 l\u2019UTL par l\u2019interm\u00e9diaire de la t\u00eate de lecture qui transmet les messages sans les modifier, et ne participe pas au protocole cryptographique (t\u00eate de lecture dite \u00ab transparente \u00bb). Avantages : le badge, s\u00e9curis\u00e9, ne peut pas \u00eatre clon\u00e9 ; aucune information ne circule en clair, que ce soit sur le canal sans fil ou sur la liaison filaire ; la t\u00eate de lecture ne contient aucun \u00e9l\u00e9ment secret : il n\u2019y donc aucun impact en cas d\u2019exploitation d\u2019une vuln\u00e9rabilit\u00e9 de cette derni\u00e8re. Inconv\u00e9nient : l\u2019UTL doit avoir la capacit\u00e9 d\u2019effectuer le protocole d\u2019authentification. Cette architecture est hautement recommand\u00e9e, bien qu\u2019elle reporte le risque d\u2019exploitation d\u2019une vuln\u00e9rabilit\u00e9 de la t\u00eate de lecture sur l\u2019UTL. Les mesures de protection concernant l\u2019UTL devront donc requ\u00e9rir une attention toute particuli\u00e8re, notamment pour la protection des clefs cryptographiques (voir Chapitre 4.1.3 : \u00ab Unit\u00e9s de traitement local \u00bb). Id\u00e9alement certifi\u00e9 Crit\u00e8res Communs au niveau EAL4+.<\/p>\n\n\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-7921 aligncenter\" src=\"http:\/\/blog.actn.fr\/wp-content\/uploads\/2019\/11\/anssi1.jpg\" alt=\"\" width=\"718\" height=\"233\" \/>\n\n\n<p style=\"text-align: justify;\"><strong>Architecture n\u00b02, acceptable<\/strong>\nT\u00eate de lecture intelligente, double authentification en coupure Le badge, s\u00e9curis\u00e9, s\u2019identifie et s\u2019authentifie \u00e0 la t\u00eate de lecture. Cette derni\u00e8re a \u00e9galement une liaison s\u00e9curis\u00e9e (avec authentification et garantie de l\u2019int\u00e9grit\u00e9) avec l\u2019UTL. Elle envoie l\u2019identit\u00e9 r\u00e9colt\u00e9e \u00e0 l\u2019UTL. Avantages : le badge, s\u00e9curis\u00e9, ne peut pas \u00eatre clon\u00e9 ; la liaison filaire est prot\u00e9g\u00e9e. Inconv\u00e9nients : la t\u00eate de lecture, situ\u00e9e hors de la zone de s\u00e9curit\u00e9, renferme \u00e0 la fois les secrets permettant l\u2019authentification de la carte et les secrets permettant de prot\u00e9ger la liaison filaire ; le badge est authentifi\u00e9 indirectement par l\u2019UTL. La t\u00eate de lecture est un interm\u00e9diaire dont le bon fonctionnement est crucial pour la s\u00e9curit\u00e9 du syst\u00e8me. Cette architecture est acceptable si la t\u00eate de lecture a fait l\u2019objet d\u2019une \u00e9tude de s\u00e9curit\u00e9 approfondie.<\/p>\n\n\n<img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-7920 aligncenter\" src=\"http:\/\/blog.actn.fr\/wp-content\/uploads\/2019\/11\/anssi2.jpg\" alt=\"\" width=\"734\" height=\"233\" \/>\n\n\n<h3><span id=\"result_box\" class=\"\" lang=\"fr\"><strong><span class=\"\">+ D\u2019INFO\n<\/span><\/strong><\/span><\/h3>\n\n\n<a href=\"https:\/\/www.ssi.gouv.fr\/uploads\/IMG\/pdf\/Securite_des_technologies_sans_contact_pour_le_controle_des_acces_physiques.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">T\u00e9l\u00e9chargez le guide ANSSI \u00bb<\/a>\n<strong><a href=\"https:\/\/www.actn.fr\/productlistgen14.php?tsearch=MARQSEARCH&amp;MRQ=VAUB\" target=\"_blank\" rel=\"noopener noreferrer\">Voir la gamme VAUBAN SYSTEMS pour le contr\u00f4le d&rsquo;acc\u00e8s \u00bb<\/a><\/strong>\nPour en savoir plus, contactez notre service commercial <strong>05 62 487 485.<\/strong>]]>\t\t<\/p>\n<!-- AddThis Advanced Settings generic via filter on the_content --><!-- AddThis Share Buttons generic via filter on the_content -->","protected":false},"excerpt":{"rendered":"<a href=\"https:\/\/blog.actn.fr\/?p=7919\"><\/a><p>\t\t\t\t<![CDATA[]]>\t\t<!-- AddThis Advanced Settings generic via filter on get_the_excerpt --><!-- AddThis Share Buttons generic via filter on get_the_excerpt --><\/p>\n","protected":false},"author":2,"featured_media":7922,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_price":"","_stock":"","_tribe_ticket_header":"","_tribe_default_ticket_provider":"","_tribe_ticket_capacity":"0","_ticket_start_date":"","_ticket_end_date":"","_tribe_ticket_show_description":"","_tribe_ticket_show_not_going":false,"_tribe_ticket_use_global_stock":"","_tribe_ticket_global_stock_level":"","_global_stock_mode":"","_global_stock_cap":"","_tribe_rsvp_for_event":"","_tribe_ticket_going_count":"","_tribe_ticket_not_going_count":"","_tribe_tickets_list":"[]","_tribe_ticket_has_attendee_info_fields":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[43],"tags":[145,310,1300],"class_list":["post-7919","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vauban-systems-marques","tag-anssi","tag-controle-dacces","tag-vauban-systems"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/posts\/7919","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7919"}],"version-history":[{"count":0,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/posts\/7919\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=\/wp\/v2\/menu-items\/7922"}],"wp:attachment":[{"href":"https:\/\/blog.actn.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7919"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7919"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.actn.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7919"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}