Hotel room electronic doorlocks

[miss_elizabeth]

My brother in law works for Hilton and writes the code for these things. I will ask him, and re-post.

[Jinx]

Along these lines: Most hotels rarely ask for cards back. So, does the next person in that room get the same coded key? Do they assume/trust I won’t try to come back, or is the code different each time? - Jinx

[Exapno_Mapcase]

How do the cards given to hotel staff differ? In the old days they would have a passkey that could open a set of rooms at a time. The card system appears to work the same way - at least I assume that housekeeping staff aren’t allowed to open every single room in the hotel - but the procedures described above don’t seem to allow for more than one room at a time.

[miss_elizabeth]

Okay, here is the email from my brother in law. To be frank, I’m a bit disappionted, but hey, he’s off today.

Ok, Here’s how it works best I can tell. I asked the doorlock guy, but I think he’s off work today because I didn’t get any reply. There are two ways to do it. The standard way is that each doorlock is battery powered and unwired. Each lock has a special encoded ‘key’ and a clock. The key encoder server tracks each doorlock’s key by room number, and when a key is made it encodes the key with the keycode and an expiration date. The doorlocks have memory, and can store each of the key punches so that the hotel can go to each door and download all of the key punch data (I doubt hotels do this very often) so they can audit access to rooms. The key can no longer unlock the door after it’s expiration date. There are special codes and keys to allow access for employees that need access to many rooms.
http://saflok.com/product_pdfs/MT_brochure_05_scrn.pdf
http://saflok.com/product_pdfs/PND6000_02_05scrn.pdf

A fancier system will have wireless radio communications devices in the hotels that communicate to all of the door locks wirelessly so that they can actually send information to the doorlocks and collect access data. Then they can assign particular keys to open more than one door, and they can see door lock unlock activity real-time and log it without visiting doors.

http://saflok.com/product_pdfs/messenger_RF_Tech_spec_scrn.pdf
http://saflok.com/product_pdfs/PND6000_messenger_0205scrn.pdf

As I said, he’s an engineer at Hilton, so I’m he knows. But I’d still like to hear from the doorlock guy.

[GargoyleWB]

I attended one hotel in Italy that had real-time active inquiries between the door locks, the elevators, and a central database. On one of our days there, they were having network problems at the computer running everything (a single workstation at the front desk) and were having to reboot every hour or two which left many guests (including us) randomly locked in and out of rooms.

Our routine was, if we were locked out, run up and down the stariwells looking for a cleaning person with a mechanical pass key to let us in.

Best hotel breakfast I’ve ever had in my life though So it was worth it.

[miss_elizabeth]

Success!!

This is direct from the doorlock guy.

There are several technologies used in the door lock industry. Some door locks communicate with the vendor’s server directly and some door locks are programmed when a “new” key is inserted into the door lock.

The system we have here at AW is an example of the first method. They give you a key and then it is activated by the main computer and you are given access to certain areas. The main computer talks directly to the door lock. Ours are hardwired, but they could use IR or RF. The main advantage to this system is that you can be given access to additional areas by entering commands on the main computer without having to have your key re-programmed. They can also remove your ability to access any or all areas without needing your key. The disadvantages are the cost of wiring each door lock to a central server for the hardwired systems, line of site for the IR systems, and stray electrical noise in the case of the RF systems.

All our hotels (that I am aware of) use the second technology. The key that the hotel gives you contains encrypted data, usually on track 3, but sometimes it is on track 2 of the key card. This encoded message programs the actual door lock when you insert the key into the door. The message contains a room number, starting date and time, expiration date and time, and other areas that you are allowed to access, like Honors Lounge, Parking, etc. Each vendor uses a proprietary algorithm to encode the information on the key card. That way if you find a key card and have a card reader you will not know what room the key is for, when it expires, or anything else. One of the disadvantages to this system is that if you extend your stay, you have to get a new key. Another disadvantage of this system is if you leave early, your key will still work until the expiration time programmed on your key, or until a new key is inserted into the lock which re-programs the lock and also tells the lock to not accept any previously issued keys for this room. This method also requires the concept of “new” and “duplicate” keys. The “new” key re-programs the door lock, while the “duplicate” key does not. If you have ever shared a room with someone else you may have experienced a problem if the other person loses their key and the hotel gives them a “new” key instead of a “duplicate”. If the hotel gives them a “new” key, your key will no longer work once they have inserted their “new” key into the lock. I assume that the key card also has a transaction number that is incremented each time a new key is issued so that it can lock out all “new” keys with a lower transaction number.

There is rumor that has been going around for a year or so which says that Hilton Hotels puts your credit card number and lots of other personal information on your room key. We have the ability to do that since most of the lock vendors allow us to encode anything we want on track 1 or track 2 of the key card, but we have never done that. It is very possible that some hotels have done that in the past, but the code that we have had out in the hotels for the last 4 or 5 years does not put any data on the unused tracks.

Also, the company that pioneered using RF to allow their main computer to program their door locks didn’t do too well when they first released their system. They tried to install it at a 3000 room casino and then realized that there was so much stray RF floating around in a casino that they were unable to send messages to their door locks. They eventually had to pull the whole system out because nobody could get into their rooms.

[stockton]

Damn, SuperNelson.

Throw us a bone or something. Help the thread along.

[rhettbutler]

SuperNelson, miss elizabeth, you guys rock. Thanks for the fascinating information – I’ve always wondered how those things work. miss elizabeth, I hope you decide to become a permanent member here!

[perfection161]

Its been some time since the last post in this thread but i would love to know one thing more in this regard…(of course so much must have evolved since the last post)

1. Do soft keys operate to turn back deadbolts too or are locks on hotel doors always sash bolt type?
   2)Is the emergency key also a key card that can turnback dead bolts? or is it always a mechanically used hard key?

[CC]

One other thing that can deactivate these cards is a magnet of any sort. So that if you happen to have sunglasses that attach to your glasses via a magnet, which I do, and you happen to keep said sunglasses in your shirt pocket most of the time, which I do, then when you put your room key in your shirt pocket, which I do, you will often discover that your card has been deactivated.

[ticker]

I just did a short course on cryptography which covered at least one system, and it’s surprising mode of failure. I hope I can make it understandable.

It uses what is known as a Cryptographic Hash Function. A hash function is something which takes a number and produces an integer number from it within some specified range. Given the same input you will always produce the same hash value. A cryptographic hash function has the added feature that it is quite easy (with a simple computer) to produce the hash of a number, yet it is very hard to figure out, given the hash value, what number you started with. It is essentially a one-way function. With me so far?

When you set up a door lock you start with a random number N and hash it to give h[sub]1[/sub], that is hash(N) = h[sub]1[/sub]. You then take h[sub]1[/sub] and pass that through your hash function to get h[sub]2[/sub], i.e. hash(hash(N)) = h[sub]2[/sub]. You can repeat this a large number of times, say 1000 to give h[sub]1000[/sub]. Remember that finding h[sub]1000[/sub] from h[sub]999[/sub] is easy, but finding h[sub]999[/sub] from h[sub]1000[/sub] takes a very very long time. You need to store the complete chain of hash values on your central computer, but only the last in the chain, h[sub]1000[/sub], needs to be stored on the lock itself.

Along comes your first guest. Program the key card with h[sub]1000[/sub]. The door lock recognizes this and lets the guest enter the room. When it comes to give the room to the next guest you program that key card with the next earlier value in the hash chain, h[sub]999[/sub] in this case. Remember that this is a very hard value to work out given just the value stored on the first key card. When this is inserted into the lock, the lock can determine that it is not the value it is programmed with, so how does it know to let in guest 2? It takes the value from the card, h[sub]999[/sub], and hashes it to see if it matches h[sub]1000[/sub] - does hash(h[sub]unknown[/sub]) = h[sub]1000[/sub]? If it does then it can only be the next earlier hash in the chain. It is now safe for the lock to admit the guest and update itself with the new hash value. An old key with h[sub]1000[/sub] will now no longer work.

One unexpected failure mode occurs when a guest checks in, gets issued the preceding hash value in the chain, but never uses the key card. (One can only speculate what room they did sleep in :eek: ). The door lock never sees the new key value. Along comes another guest for that room, gets issued yet another value from the hash chain. When the lock sees this new value it performs the hash check - does hash(h[sub]unknown[/sub]) = last-used-value? No it does not! The chain has been broken!

[Fish_Cheer]

@CC

One other thing that can deactivate these cards is a magnet of any sort. So that if you happen to have sunglasses that attach to your glasses via a magnet, which I do, and you happen to keep said sunglasses in your shirt pocket most of the time, which I do, then when you put your room key in your shirt pocket, which I do, you will often discover that your card has been deactivated.

Or if you happen to have bought a souvenir fridge magnet before checking in at the motel and still have it in your pocket, then put the keycard in there, you will have to go back to the front desk to have it rewritten. If you put the new card into the same pocket, you will have to go back a second time, which in turn will cause the cute front desk girl to treat you like some kind of moron. Don’t ask me how I know.