PKI verification
- 1-Factor CAK challenge-response
- Signature verification
- PIV
- CAC
- TWIC
- FICAM
- PKOC
Zero Trust starts at the door.
Trust nothing. Verify everything.
TrustPoint Readers challenge the private key inside every card, a key that can't be copied. A cloned badge can't answer, so it never gets in. No new access control system required.
Trusted by government and industry for 20+ years
The legacy card risk
Your VP is overseas. Their badge opened the server room last night.
The badge was left on a table at the airport for a few minutes. That was enough for a $100 card skimmer to copy it. A legacy access control system can't tell the copy from the original.
- $100
- The cost of a skimmer that can copy a legacy badge.
- 1M+
- Flipper devices sold. They easily clone Prox and MIFARE Classic cards.
The solution: a PKI identity layer
TrustPoint Readers serve as trust verifiers.
A modern smart card carries a digital certificate and a key pair. The reader challenges the card, and only the genuine private key can answer. A copy can't, because the private key can't be copied.
A genuine TrustPoint Card
- Card presented.
- The reader sends a random challenge.
- The card signs it with its private key, which never leaves the chip.
- Verified. Genuine card.
A cloned Prox card
- A cloned Prox card is presented.
- A legacy card has no private key, so it can't sign the challenge.
- Rejected. A copy can't answer the challenge.
The most advanced authenticating smart card readers.
Engineered & Built in the USA by IDFactors. Indoor or outdoor, factory or field configured, and ready for the access control system you already run.
Factory or field configured
- 15+ Wiegand formats
- OSDP 2.2 + transparent mode
- OSDP
- Wiegand
System integration
PSG Global, Lenel, AMAG, Software House, Andover, Vindicator, Galaxy & more.
Physical & environmental
- Indoor or outdoor operation
- Strong polycarbonate housing
- 3 LED indicators & audio speaker
Features
- Optional PQC-ready Hardware Cryptographic Module (HCM)
- Supports RSA, ECC, ML-DSA and ML-KEM
- Operates at max contactless communication speed
- FIPS-140
Engineered & Built
in the USA
TrustPoint Readers
One family. Choose your factors.
TrustPoint 1-Factor Reader
- User presents
- Card
- Factors
- Verification
- PKI challenge-response (CAK)
TrustPoint Card Only Reader
- User presents
- Card
- Factors
- Verification
- PKI challenge-response (CAK)
TrustPoint Card + PIN Reader
- User presents
- Card and PIN
- Factors
- Verification
- PKI challenge-response (PAK)
TrustPoint Card + PIN + BIO Reader
- User presents
- Card, PIN and fingerprint
- Factors
- Verification
- PKI challenge-response (PAK)
Is TrustPoint the right credential?
TrustPoint Cards are compatible with the FIPS 201 credential. Issue them yourself with Authara and bring the benefits of PIV-C to your organization at a surprisingly low cost, or have IDFactors pre-personalize them for you.
- PIV-C
- FIPS 201
No vendor lock-in
Legacy cards with secret keys bind you to the issuer. Change vendors, lose everything. With TrustPoint, the keys are yours.
Improve security
Prox cards use no encryption, and MIFARE Classic relies on proprietary symmetric keys. Both are easily cloned. A TrustPoint Card's private key can't be.
Eliminate hidden costs
Proprietary ecosystems inflate hardware costs, restrict competition and force expensive migrations.
Stop replacing systems. Replace risk.
TrustPoint Cards and Readers form an identity layer at the edge of the access control system you already have.
New identity layer
Wiegand or OSDP
TrustPoint Card
TrustPoint Reader
Unchanged
Your controller
Your PACS software
- No software changes
- No controller replacements
- No re-enrollment
Issue and manage credentials. Own your key pair.
Authara is a credentialing engine and card management application. It delivers the critical capabilities of a card management system at a fraction of the cost of traditional systems. Just update your readers and cards to TrustPoint and keep your integrators and access system in place.
You hold the root keys, not us. Each TrustPoint Card creates its own key pair, and the private key never leaves the card. You can also use TrustPoint as a transitional card: the legacy card number goes into the certificate, so you don't need to update ID numbers in your access system.
What it is
Purpose-built credentialing software with a familiar Microsoft-style interface that needs minimal training. It works hand in hand with the TrustPoint Desktop Reader and its Hardware Verification Module (HVM).
How it saves money
- Removes the switching cost of replacing a legacy access system.
- You own the keys, so you aren't locked in to a vendor that holds them.
- Costs a fraction of a heavier card management system to own and run.
- Reuses the legacy ID to cut the cost of re-enrolling cardholders.
What it does
- Enrolls and verifies government cards.
- Creates and manages PIV-C cards, with the CA signing key held on a YubiKey.
- Optional Microsoft AD CS integration prepares Windows smart-card logon certificates.
- Keeps a complete log of credential status.
The credential lifecycle, from enrollment to the door
-
1
Enroll
Identity & enrollment
- Cardholder identity and attributes
- Microsoft Active Directory (optional)
- Legacy card ID carried forward (optional)
-
2
Issue
Authara
- Issuance policy, lifecycle status and audit
- The TrustPoint Card generates its key pair; the private key stays on the card
- Your certificate authority signs the certificate
- Certificate written to the card: ready to use
-
3
Verify
TrustPoint Readers
- The reader sends a PKI challenge; the card signs it
- Private key, signature and CA trust confirmed
- Your PACS applies permissions: access granted or denied
- Optional logical access: PIV sign-in to systems that use Microsoft Active Directory
The hardware Authara works with
The TrustPoint Desktop Reader enrolls and personalizes cards at the desk. The reader includes a Hardware Verification Module (HVM). A separate YubiKey holds the CA signing key and signs certificates. TrustPoint Readers are FIDO-aware and accept PIV-enabled YubiKeys for physical access.
- FIDO
- YubiKey CA
- Microsoft AD CS
Specialist products
Built for the gate, the dock and the flightline.
Stand-alone reader and controller
- Self-contained, with no network connection required
- Grants access by agency code for any CAC or PIV card
- Requires a PIN to verify the user owns the card
- Mechanical key lockdown protects against attack
Ideal for turnstiles on Navy docks and air base flightlines, and gyms, exercise areas and dining halls.
- CAC
- PIV
Outdoor terminal
- Supports TWIC, PIV and CAC cards
- Listed on the TSA APL
- Includes contact and contactless interfaces, plus an FBI- and PIV-approved SecuGen fingerprint scanner
- Scrolling OLED display guides users through the access process
- Durable steel construction, with quick-disconnect removal for storage during severe weather
Ideal for container ports requiring TWIC, oil and gas refineries using TWIC, and military gates using PIV and CAC.
- TWIC
- TSA APL
- TSA QTL
IDFactors has 4 fixed readers on the TSA Qualified Technology List, including TruckerGate. See the TSA QTL
Trusted by government and industry for over 20 years.
Let us earn your trust.
-
GSA FIPS 201Approved
- TSA QTL4 fixed readers listed
-
Engineered & Builtin the USA
Connect with a product expert
Contact sales.
Talk to a product expert about TrustPoint Readers, TrustPoint Cards and Authara for your existing access control system.
- customerservice@idfactors.com
- 510-545-4393
-
800 Bancroft Way, Suite 20
Berkeley, CA 94710