Brivo Mobile Pass Opens Any Door by Smartphone

Author: Brian Rhodes, Published on Sep 25, 2015

One of the major trends in access control are 'mobile' credentials.  

NFC and BLE have been fighting for the title but neither has really has taken off.

Now, Brivo has announced a new way of doing this that sidesteps the hassle, and claims to work with any door, any reader, and the majority of all smartphones in seconds.  

In this note, we examine Brivo Mobile Pass, explaining how it works, what it costs and what potential security risks it has.

*** ** *** ***** ****** ** ****** ******* *** '******' ***********.  

*** *** ******* **** ******** *** *** ***** *** ******* *** ****** has ***** ***.

***, ***** *** ********* * *** *** ** ***** **** that ********* *** ******, *** ****** ** **** **** *** door, *** ******, *** *** ******** ** *** *********** ** seconds.  

** **** ****, ** ******* ***** ****** ****, ********** *** ** *****, **** ** ***** *** **** potential ******** ***** ** ***.

[***************]

No ****** ******

****** ***** ****** *********** **** ******* ******* ******* *** ******** smartphones, ***** **** ***** * ***** **** ******** ***** ********** app.

***** ****** ***** **** ***** ****** ** ******** *** ***, connecting ** *** **** ********** ******* *****'* ***** *******, *** essentially ******* *** '****** ******' ******* ** *** **** ******* the *** *********. **** **** ** ** **** ********* ** operator ******* *** *** *********** ** ******* / ***** ** any ********** ****.

** **** ***, *** **** ******** *** ****** *** ***** entirely *** **** ********** ******* *** ********** ******** *******. 

App ***** ********

*** ***** ***** ***** ***** *** ***** ********:

************

*** ******** **** ***** **** *****'****** ******* **.* ******* *** *** *** ***** *******.

***** ****** ******

************** *** ****** * ****** **** ** ** ********** **********. Passes are ******* **** ****** ** ***** ** *** ******, *** users *** ***** ***** ***** ** ******** ** ****** **** if **********. * ****** **** ** **** *** *** ****** of *****, *** *** ** ********* ** **** **** ** certain ***** ** ** ************* *****. *******, **** **** * mobile **** ** ****** (** *** ** ***** ****** **** Brivo's ********** ********), ** ******** * ****.

*********** ****

***** **** ****** ****** **** ** ********* ** *** *** ******* operating ******* *** *** ***** ****** ******* **** *******, ****, etc.

Mobile **** **** **********

***** ***** ****** ***** **** * '****' ****** ******. ********** passes *** ********* ** $** *** ***. ***** **** **** ** effectively ~** ***** *** ****, **** ** ****** *********** ********** compared ** ******* ****** ***** ***** *** *** ** **** **** the ****** ****.

******** *****

****** ****'* ******* **** ** *** **** **** *** **** to ** **** * **** ** ****** **, ****** *** and ***. *** *******, **** *****'* ****** ****, * **** could **** *** **** ** *** **** **** ******** **** they *** ********** ***, ********** ** *** *** **** **** are. ******* **** ******* ************* ** ** *******, *** ******* that ************ *********** *** **** ********** ****** ** * ********** risk. 

*** ****** *** ** ***** **** ** *** ****** *** to ******* ***** ** ****** ***** ** *** ****, *** is ******** ** *** ** *****-******* ******* **** ********.  ***** says **** *** ******* ** ****:

"** *** **** *******, ***** ****** **** **** *********** ********** ******** ***** *** ******* *** ****** user ** ** ****** * ********* ******** ** *** **** (***** GPS) ** ** *** ***** **** *******. "

*******, ***** **** ** *****, ***** ****** ** ********.

*** ***** **** ** *** ***** *** ** *** **** a ******** *** ***** *****. ** **** *****, ****** ******* ** ******** those ***** ***** **** *** ***** ****** *** *** ****** *** door **** ***** *** **** **********.

****

Comments (31)

If anything were to takeoff from a smartphone and CA (Card Access) credential perspective, I would vote for BLE as the technology is already built into the phone. Integrating BLE alongside a proximity reader would be low cost in my opinion. Essentially, you would install an app on the phone that would be authenticated during the enrollment process. The app would take the IMEI number and convert it to a CA Credential. Once in range of the BLE network, the phone would join the network; when presented a couple of inches to the reader in where the received signal strength were to be anywhere from 0dBm to -5dBm it would transmit the CA Credential encrypted via BLE.

Additional passes are available at $15 for 100. Given that this is effectively ~15 cents per user, this is fairly inexpensive especially compared to issuing iClass cards which can 10x or more than the mobile pass.

It seems you can look at this as "inexpensive", or "rather pricey for enabling an HTTPS call".

Harsh and funny.

Remind me, does your company give away software for free? :)

Remind me, does your company give away software for free? :)

Yes.

The VMS client software is free.

The virtual matrix software is free.

The mobile app is free.

The mobile gateway package is free.

The stand-alone player for exported video is free.

"is free"

Let me correct that. "Is included in the price of the software license."

In all seriousness, charging small amounts for software that replaces physical devices (in this a card) is reasonable.

There is also the HID Mobile Access which works with both BLE and NFC , but they sell a reader for that, albeit not that expensive one...we just started with that and it looks good so far.

Unless you have an Iphone

Now, Brivo has announced a new way of doing this that sidesteps the hassle, and claims to work with any door, any reader, and the majority of all smartphones in seconds.

Any reader, or just the ones that are already integrated into Brivo?

"The solution only works with Brivo's OnAir version 11.1 systems and not any third parties."

I didn't know Brivo made a reader.

Mobile Pass doesn't use a reader to work.

The reader choice is irrelevant here. That's the point.

Gotcha both.

In this way, the user bypasses the reader and cards entirely and does everything through the management software instead.

I am really surprised by the results of the poll, over half feel that mobile credential is a bad idea is interesting. I would be curious to know why most people feel it is a bad idea vs. good idea.

infinias has had this as a product for some time now and we have several sites that utilize it and love it...

Keefe, good feedback!

There's only 23 votes so far so too early to be statistically meaningful. It may very well end up being split but usually IPVM polls stop fluctuating when they get 50 - 75 votes.

Thanks Keefe. Correct me if this is wrong, but with the infinias solution, you need to be joined to a local wifi network that the controllers are part of, right?

The Brivo solution does not need wifi/ uses a cellular network since the management portal lies in 'the cloud', not on a local server.

Brian,

It can be either WAN or LAN. I personally have only setup customers on LAN access but other techs here have set up WAN access for sites.

from the infinias mobile credential page:

Mobile Credential works with infinias Intelli-M Access 4.0 (or higher) software to provide a smartphone based credential that can be used in one of two ways on a person by person basis. Either by requiring the smartphone be on the corporate network directly via WiFi, thus requiring proximity to the building, or via any internet connection allowing use of Mobile Credential from anywhere a data connection can be made with the smartphone. In one installation, some people can be required to be in proximity to the building (within WiFI range) while others can use their Mobile Credential from anywhere at the administrator’s discretion.

Interesting. Thanks for bringing it up!

For example, with Brivo's Mobile Pass, a user could open any door at any time from anywhere that they are authorized for.

I could see this being used from inside the building as well, to let people in, instead of going to meet them. Whether that is desirable is another matter.

Wondering what the latency/reliability issues are with the Internet and the cloud deal. Being locked outside a building for any length of time because the cloud/Internet connection is down I imagine is a memorably bad experience.

Of course they have this issue with their current systems, but now they are adding another seperate internet connection over 4G to the mix.

Wondering what the latency/reliability issues are with the Internet and the cloud deal. Being locked outside a building for any length of time because the cloud/Internet connection is down I imagine is a memorably bad experience.

Of course they have this issue with their current systems, but now they are adding another seperate internet connection over 4G to the mix.

What do you mean they have this issue with current systems? What issue?

I assumed there was at least some loss of functionality in their current cloud based offering due to Internet or cloud service unavailability.

But I see now that to be denied access at the door in such a case shouldn't happen because credentials are stored locally.

So you are correct, this possibility would be an entirely new issue for them.

infinias' Mobile Credential was launched in 2013 with the view that there was a better way to use a smartphone for access control than just reproducing the old card/reader interaction, we think it's great that Brivo has joined us.

The article stated you can do a 'manual unlock', and it's very easy to use that as shorthand for what the app does. But, that's not what we do, we've been very careful to make sure that our technology is secure from both an encryption perspective and what goes on the phone to be hacked or spoofed. With Mobile Credential the phone doesn't know how to do a manual unlock, it only knows how to present a credential to the system and let the system do all the decision making. I would imagine Brivo has done something similar as well.

The documentation quoted is accurate, in an internal installation, you can choose to give some users the internal IP and limit them to wifi proximity to the building (more secure), and others a public IP, allowing them to grant access from anywhere. On the cloud solution we're announcing at ASIS, this will of course only have the public IP option.

What doesn't come out very well with infinias, and we need to get better at publicizing this, is that you can implement all sorts of other functionality through the infinias mobile credential app - lock down, first in, arming, etc. via our rules engine, this is stuff we teach our certified guys in training.

"With Mobile Credential the phone doesn't know how to do a manual unlock, it only knows how to present a credential to the system and let the system do all the decision making."

Wayne, and what decision making does the system do? In other words, if I am an employee at a company who uses Infinias and has mobile credential enabled on my phone. I can't do an unlock?

John,

It's a bit about semantics but is important. 'momentary unlock' typically means a remote unlock, usually from the management software. But that also means who went through the door is effectively anonymous. We (and I'd guess everyone else) logs that someone executed the momentary unlock but have no way of knowing who actually went through the door. So momentary unlock in that context is not really that secure. There has been video posted of one of our competitors (not Brivo) on YouTube showing a smartphone hack that momentary unlocks every door in a system, so the notion of phones doing a mometary unlock certainly makes me uncomfortable.

When the phone acts as a credential, then a credential is presented, and access is granted based on the request. i.e. 'Does Bill have access to this door at this time?'. That request/grant is logged so you know who went through the door, or at least who presented their credential. There is nothing on the phone of value beyond the credential. Disabling or changing someone's permissions is immediate and what's on their smartphone becomes unusable and of no consequence without any need to push or wipe anything on the smartphone.

We find that people confuse an app like this in one key way: Most users of Mobile Credential have no rights to log into the software and therefore no rights to perform any actions in the system other than use their credential. Thus we don't build any management-like features into it.

Wayne, I still don't understand what you are claiming to do. How do you ensure that the person who 'momentary unlocks' a door using a mobile credential is at the door at that exact time?

How do you ensure that the person who 'momentary unlocks' a door using a mobile credential is at the door at that exact time?

IMHO, he's saying that Mobile Credential doesn't do a "momentary unlock".

Instead, the system does a credentialed open, like it would with a rfid card, the main difference being that the credenditial goes thru the cloud to get to the system instead of the reader.

A "momentary unlock" from the management software, on the other hand, only logs the operator who remotely performed the unlock, not who it was opened for. It also does not require that the system has determined whether access should be granted to the requester. It's a long distance "buzz-in".

Neither method though "ensures that the person who 'momentary unlocks' is at the door at that exact time.", since when using the Public version you could be anywhere around the world, but

That request/grant is logged so you know who went through the door, or at least who presented their credential.

tl;dr

'Momentary unlock' logs only the operator performing the unlock and does not require the system determine whether access should be granted to the actual requestor. So "no way of knowing who" in this case.

Mobile credential logs the person requesting the unlock and insures they have presented a valid credential. Here you know at least who requested and possibly entered, though you can't be sure they are actually at the door or passed thru the door on the unlock.

Disclosure - We are a Brivo Dealer. We tried Brivo Mobile Pass on Friday afternoon. I think the solution is very intriguing and pricing is not a barrier. The speed performance was nearly instantaneous - almost no lag. Also, the entry in the activity log captures each use in detail.

Will we offer it to customer - yes. Initially perhaps for multi-tenant situations - lots of churn - where not having to get the user a physical object could be beneficial. Or perhaps as guest passses. Later for other customers with "higher" security concerns, maybe when the geo-fencing feature is available.

One feature I like is not having to leave NFC and Bluetooth on my phone all the time - just one more battery killer.

I could image a small installation at some point in the future where we didn't even put card readers on all the doors!

Will we offer it to customer - yes. Initially perhaps for multi-tenant situations - lots of churn - where not having to get the user a physical object could be beneficial. Or perhaps as guest passes.

Sending someone an email good for one-entry between 1:00PM and 1:30PM is interesting.

Very powerful tool when combined with video/intercom solutions. Now if someone calls me and I'm not around my computer I can pull up the mobile app, verify on video they are actually at the door and let them in or not. (I would only give this to local admins to limit shenanigans and tom- foolery)

- Love that you can customize the door names/colors/icons so they make sense for the user.

- Geofencing should be an option not a requirement. If I am an Admin in NY I should be able to open a door in Dubai. The logs show who opened the door, so there is still an audit trail if people are just randomly popping doors all over the world.

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Most Recent Industry Reports

AI Startup Anyvision Raises $28 Million Led By Bosch on Jul 20, 2018
Anyvision is the most ambitious heavy-spending video surveillance startup in many years. And, now, the startup has raised $28 million led by...
Fail: Dahua "Didn't Check The Lux Levels but It Was Dark" on Jul 20, 2018
Dahua UK has been promoting their camera quality on LinkedIn: I, and others, asked what the lux level of the scene was. (background: Lux Rating...
Free 100+ Manufacturer-Customized Camera Calculator Released on Jul 19, 2018
Now, any manufacturer has a customized IPVM Camera Calculator, free. The goal is to make it easier for companies to help their customers better...
Improved Security And Surveillance Bidding - 2018 MasterFormat Divisions Examined) on Jul 19, 2018
Navigating the world of system specifications and bidding work can be complex and confusing, but a standard format exists, and understanding it...
Last Chance - Security Sales Course Summer 2018 on Jul 19, 2018
Today is the last day to register. Based on member's interest, IPVM is offering a security sales course this summer. Register Now - IPVM Security...
Directory of Video Surveillance Startups on Jul 18, 2018
This directory provides a list of video surveillance startups to help you see and research what companies are new or not yet broadly known entity...
Ladder Lockdown and Ladder Levelizer Tested on Jul 18, 2018
Ladders are a daily necessity for surveillance and security installers, but working on an unstable surface can be extremely dangerous. In addition...
FST Fails on Jul 17, 2018
FST was one of the hottest startups of the decade, selected as the best new product at ISC West 2011 and backed with tens of millions in...
Axis ~$100 Camera Tested on Jul 17, 2018
Axis has released their lowest cost camera ever, the Companion Eye Mini L, setting their sights on a market dominated by Hikvision and Dahua. Can...
Amazon Ring Alarm System Tested on Jul 16, 2018
Amazon Ring is going to hurt traditional dealers, and especially ADT, new IPVM test results of Ring's Alarm system underscore. IPVM found that...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact