dormakaba Apexx IP Connected Safe Locks User Guide
- July 17, 2024
- dormakaba
Table of Contents
dormakaba Apexx IP Connected Safe Locks
Axessor Apexx
System Descriptions
The Apexx solution consists of one or two Entries, one or more locks, up to
one E-box, and one instance of Apexx SW solution (Local Software). This
document will focus on solutions containing E-box.
The general architecture of the solution is
There are two possible connections between the lock system and the local SW. One is direct connection over USB to the entry. This connection must be enabled by an authorized user in the menu selection of the lock. The second connection is from the E-box over Ethernet to the local SW.
Local SW notes
- All parts of the SW (MQTT, client and API) are designed as a Windows 10 applications. To be able to use them in a cloud environment, one must be able to manage the communication channels between them.
- The communication channels are established during installation – These rely on DNS (or static IP addresses). Once the installation is completed, certificates will be established for the purpose of security. These certificates need to be properly managed to prevent any attack paths.
- The client supports multiple users but doesn’t support multiple users simultaneously on a single client. Only one person can be logged into a single client instance at any given moment.
- The communication to and from the locking system is MQTT over SSL, so the standard ports need to be reachable.
- SW requires a Windows certificates subsystem and an SQL19 database to run.
Pairing of local SW with E-box
The local SW and E-box need to be paired before a connection can be established. When a brand-new e-box needs to be installed:
- The E-box is physically installed on the CAN bus.
- An authorized user needs to log in to the entry and enable the E-box on the CAN bus (no un-authorized devices can listen to the CAN bus)
- After authorization of the E-box, the E-box will be able to obtain the encryption keys to the CAN bus (AES-256 with system-specific keys).
- Once the E-box is on the CAN bus, the connection needs to be made to the local SW. E-box will see if the setting for the local SW was created (through the settings menu of the entry). If there is a setting, it will be used. Otherwise, the E-box will assume DHCP to obtain IP address.
- Once a valid Ethernet setting exists, the E-box will attempt to connect to the MQTT server in the local SW (either through direct IP communication based on the settings or broadcast on a local network in case of DHCP). This is done over TLS.
- If the local SW detects a new E-box, it must be authorized in the SW before successfully logging in using the claim code. Once the E-box is authorized on the SW, SW will produce a verification PIN that needs to be validated on the system entry (Verification of SW to the E-box, and E-box to SW).
- After the system is verified, a secure channel is established. This is done using pre-installed factory-signed certificates (PKI infrastructure). Any communication afterwards is encrypted using TLS.
Disaster recovery:
Local SW connects to the SQL19 database for data storage (SQL19 Express by
Microsoft – Reference: https://www.microsoft.com/en-ca/sql-server/sql-
server-2019-pricing). The configuration of the database needs to be input
into the local SW in the form of the config file. The encryption/protection
and data recovery will then follow the path of the SQL19 database. It is
expected that the database is managed by the local IT department. The recovery
path will then be to re-install the API, MQTT, and the client either with a
fresh copy from dormakaba, or local backup. All data is at rest in the SQL
database. API, MQTT, and client don’t store any data, only connection
settings.
Key takeaways
- Only servers with local SW need to be IP addressable – E-box doesn’t.
- Communication between E-box and local SW (traffic over intranet/Internet) is encrypted using TLS.
- Please include the SQL server in your disaster recovery plan. This database is crucial to the function of the system.
Our Sustainability Commitment
We are committed to fostering sustainable development along our entire value
chain in line with our economic, environmental, and social responsibilities
toward current and future generations. Sustainability at the product level is
an important, future-oriented approach in the field of construction. To give
quantified disclosures of a product’s environmental impact through its entire
life cycle, dormakaba provides Environmental Product Declarations (EPD), based
on holistic life cycle assessments.
Our offering
Access Automation Solutions
- Entrance Automation
- Entrance Security
Access Control Solutions
- Electronic Access & Data
- Escape and Rescue Systems
- Lodging Systems
Access Hardware Solutions
- Door Closers
- Architectural Hardware
- Mechanical Key Systems
Service
- Technical Support
- Installation and commissioning
- Maintenance and Repair
Key & Wall Solutions
- Key Systems
- Movable / Sliding Walls
Safe Locks
- Electronic Safe Locks
- Mechanical Safe Locks
- Boltworks and Accessories
Glass systems
- Manual door systems
- Glass fittings
- Horizontal Sliding Walls
Apexx IT Security Guide, EN, 02/2024 Subject to change without notice
dormakaba USA Inc.
1525 Bull Lea Road, Suite 100 Lexington, KY 40511
sales.safelocks.us@dormakaba.com T
+1 800 950 4744 +1 888 950 4715 (tech support)
dormakaba.com
AXESSOR APEXX IP INSTALLATION AND OPERATION GUIDES