The certification of digital locks tests both quality and security

Dormakaba’s dKey is a hybrid lock, which means that it can be opened both with a key and via a smartphone. All the technology is contained within the lock housing, which means that it is not noticeable from the outside that this is a lock with a digital function.

In 2020, Stöldskyddsföreningen (Sweden’s theft prevention association, SSF) launched a new norm – SSF 3523 Digital Locking Unit. This sets requirements for digital locks in accordance with the same principles as the norm SSF 3522 Approved Locking Unit, but with the difference that it also describes internet-connected products.

“We believe that it is important to have guidelines, norms and requirements, and when we realised that our Dormakaba dKey meets the requirements for SSF 3523, we chose to certify the product”, explains Anders Sandgren, who is a business developer at Dormakaba and whose areas of responsibility include certification and training.

The locking system has been developed in the Nordic region, and is manufactured by Dormakaba in Eskilstuna. The certification, which was conducted by RISE, is the first in Sweden that is in accordance with the new norm, and Anders Sandgren sees great value in being able to show that the product meets the strict security requirements.

“Cyber-threats are increasing all around the world, and it is important that the digital locking systems and access solutions that are being developed ensure that digital communications cannot be accessed by unauthorised parties”, he says.

New security requirements

For this reason, digitalisation places new demands on developers of locking solutions and security products. This is not just concerned with mastery of software and hardware, but also necessitates a whole new way of thinking about risk – all to ensure that products cannot be hacked.

Provided that security is not compromised, Anders Sandgren has a positive approach to the digital development.

“It raises the level of competence for the entire industry, and provides us with opportunities to build comprehensive solutions in a new way. We can also complement our mechanical products with new technology, which increases the value of our solutions. These digital solutions will take us into the future.”

Ensuring quality

Certification engineer Nima Azarmehr and Ted Strandberg, who is growth area leader for cybersecurity certification at RISE, are two of those who have worked with the certification of Dormakaba’s dKey. They state that, as with any other certification, the purpose of the certification of digital security products and locks is to verify their quality – which, in this case, also requires a high standard of security. The fact that it concerns a digital product presents the person performing the certification with new challenges.

“There is a challenge involved in familiarising yourself with a completely new product that requires advanced testing. These also concern entire systems, with many components, and this increases the complexity”, says Ted Strandberg.

“In addition, this also sets new demands on the trust between the manufacturers and those performing the certification. When a product is concerned with mechanical protection, there are geographical limits. Digital locks, however, can be opened from anywhere in the world. The manufacturer is therefore exposed in a different way, so it is important for them to be able to trust the person performing the certification”, explains Nima Azarmehr.

Tested by ethical hackers

In the same way that the development of digital lock solutions places new demands on the developers, the certification of digital security products and locks also places demands on new specialist competence on the part of the person performing the certification. After an initial verification of the manufacturer’s documentation (concerning, for example, logging in and encryption), the product is then subjected to what is known as penetration testing.

“This means that so-called ‘ethical hackers’ try to gain entry to the system”, explains Ted Strandberg, who also adds that RISE has approved and certified employees who act as ethical hackers.

This is followed by an inspection of the production of the system, in order to verify that the products that are being produced are the same as those that have been tested. The final step is the issuing of certification.

The certification of Dormakaba’s dKey is, as mentioned, the first of its kind in Sweden. It is not, however, the first product that RISE has certified on behalf of Dormakaba.

“We certify many products locally, including lock housings and cylinders, and testing is currently underway for new certifications”, says Anders Sandgren, who adds that the dialogue with RISE, in which he himself has a coordinating role, works well.

Training in both standards and cybersecurity

In addition to the certification of digital security products and locks, RISE also offers external training in cybersecurity – both in general and customised forms. RISE also provides training on the SSF standards 3523 Digital Locking Unit and 1120 IoT Connected Devices, performs various types of tests, and can provide assistance in the interpretation of standards.

“RISE can also participate as a consultant in product development, but we cannot then be classed as an independent third party, which means that we are not permitted to certify the product”, says Nima Azarmehr.