Ctrlk

Command 0xEEEE - Send Secured Command to Device

The host uses this command to transmit another command securely. This “secure wrapper” mechanism provides the device a means to ensure the wrapped command originated from an authentic, authorized host. In addition, its implementation includes an operation that starts a countdown timer, which ensures the command is current and is not an unauthorized replay of a previously intercepted / stored command. This command can use multiple authentication methods, including MAC or ECDSA Signature. The method and parameters to use are specific to the command being wrapped, and are specified in the documentation for that command.

The sequence of events is as follows:

1

Determine command and compose Message Payload

The host determines what command it wants to call from Section 6 Commands, determines the command must be secured, and uses the Request Data table for that command to compose Message Payload.

2

Retrieve Challenge Token

The host uses Command 0xE001 - Get Challenge to retrieve a Challenge Token and unlock the device for receiving the desired command for a limited period of time. When the time expires, the device will no longer accept the Challenge Token and the host will have to retrieve another one.

3

Build the 0xEEEE request

The host creates an instance of Command 0xEEEE - Send Secured Command to Device in the format below, and includes the Message Payload and Challenge Token inside it. In the Request Message, it fills in Command ID as the command number of the wrapped Message Payload, instead of 0xEEEE. Some parameters are command-specific; see the documentation for the command that is being wrapped to determine what values to use.

4

Send the composite command

The host sends the resulting composite command request to the device.

5

Device validates and authenticates

The device validates the serial number and challenge token, then examines the parameters to determine which authentication method is being used, and authenticates the command accordingly.

6

Device executes secure command

If the device determines the command request is authentic, it will start executing the secure command defined by the Message Payload.

7

Device responds

The device sends a response to the host reporting success or failure. In both cases, the response uses the format that corresponds to the command invoked by the Message Payload. See the documentation for that command to determine the format of the response.

Table - Request Data for Command 0xEEEE - Send Secured Command to Device

Tag
Len
Value / Description
Typ
Req
Default

Beginning of any wrappers, at minimum including Request Message

EEEE = Command 0xEEEE - Send Secured Command to Device

A1

var

Security Parameters — This parameter describes how the Signature parameter in this data object is calculated, and is a Security Parameters Type TLV data object. To determine which values to use in that TLV data object, see the documentation for the command being wrapped.

T

R

82

04

Serial Number

B

R

83

08

Challenge Token — The token the device returned when the host called Command 0xE001 - Get Challenge.

B

R

84

var

Message Payload

B

R

9E

var

MAC or Signature

B

R

End of any wrappers, at minimum including Request Message

Table - Request Example Using MAC

Example (Hex):

This example wraps [**Command 0xD811 - Start Send File to Device (Secured)
AA 00 81 04 01 04 D8 11 84 81 8F EE EE A1 19 81 05 03 03 06 02 08 84 00 85 00 A8 0A 81 02 11 02 82 00 86 00 88 00 A9 00 82 04 FF FF FF F0 83 08 C9 65 45 F2 97 69 85 B1 84 4E D8 11 81 04 00 00 03 00 A2 2B 81 04 00 00 02 99 82 01 04 83 20 87 A4 B3 54 61 C5 CB D3 1D DC BA 9D 65 25 5A D4 6A 22 FA 51 5E FD 65 87 AF AC A8 8C 4F AF 80 9B A3 14 38 31 30 38 33 30 33 30 33 30 33 30 33 33 33 30 33 30 87 01 01 9E 10 7D E4 27 C8 A0 70 72 08 19 0A 1E 0A 3F 48 BB F1

Table - Request Example Using ECDSA

Note: For additional support, please contact MagTek Support.

Last updated