®

Application
Security
Description
DSX has a mul faceted approach to Applica on Security including Encrypted Communica on between the Comm Server
PC, Client PCs, and the System Controllers. In addi on, SQL Server may store the Database in larger more secure
applica ons. The visual below illustrates applica on security op ons.

SQL Server location Client PC

Comm Server PC
for Data Storage TLS1.2^ TLS1.2^
encrypted encrypted
Database
Data Program
([Link])
History Database Configurable
Program Comm Server to:
([Link]) Ports:
Workstation
Program
DSX encrypted
passwords on
([Link]) Controllers 4000-5000
data at rest. Database Path
Preferred Location Client PCs 22223-22224
Database Path Mobile App 60001-60002
Controll ers Option = Other PC
Of Locati on TCP
One Comm Server
UDP
Program SQL Server 1433
([Link]) Graphics
AES-256
encrypted
Images

AES-256 Workstation Maps

Controll ers
Of Locati on encrypted Program
Two ([Link])

AES-256 bit Communications Encryption

The cornerstone of secure communica on, AES-256=bit encryp on can be implemented between the Communica on
Server (Comm Server) and the field controllers as well as between the Comm Server and Worksta ons.
DSX recommends that all Encryp on Keys be unique.
One Encryp on Key per loca on for communica on to Controllers
One Encryp on Key for all Client Worksta on communica on.

Requirements
Firmware version 3181 or higher in all controllers
Feature be enabled in the USB Features Key.

Technical informa on about implementa ons that have been validated as conforming to the Advanced Encryp on
Standard (AES) Algorithm, as specified in the Federal Informa on Processing Standard Publica on 197, Advanced
Encryp on Standard is available below.
h p://[Link]/groups/STM/cavp/documents/aes/[Link]
Valida on Numbers, 1628, 1629

DSX Access Systems, Inc. 214-553-6140 [Link] (11/2024)

Active Directory Operator Authentication
WinDSX can u lize complex logins and passwords facilitated by Ac ve Directory in Windows™ .
Operator Logins can be authen cated by Ac ve Directory instead of WinDSX. This allows for complexity rules to be
enforced along with expira on and age of password.

To configure:
1. WinDSX SQL Operators use the same Login Name as they do in Windows™.
2. Login name is entered like always under Operator Passwords in WinDSX SQL.
3. The Operator is assigned a Password Profile but is not assigned a Password.
4. When WinDSX receives a login from an operator that does not have a password in its database it sends the login
request to Ac ve Directory (AD) for authen ca on.
5. If AD authen cates the operator, they are given access to WinDSX SQL according to the Password Profile
assigned to them.

DSX-LAN-D and DSX-IP-HUB

The DSX-LAN interface modules are an appliance and have no commercial opera ng system. They have no drive or
memory that can be wri en to except for the configura on it requires such as IP address and Port number. An virus
programs cannot be loaded on them or ran against them. They do not appear as a logical drive on the customer network.
This appliance simply replies to the UDP packets that are sent to it, if they are properly formed packets coming from the
expected source.

DSX Mobile Command App Security

DSX Mobile Command Server does not have an “open” port that can be perused for exploita on. The phone app Login
messages are forma ed according to a specific service contract and behavior/ It is transmi ed with username,
password, mestamp, and other phone app proprietary data. These parameters are encoded with a proprietary 256-bit
key to provide different encoded data with each mestamp.
Requirements:
• Password and proprietary app data must pass the server’s expecta ons and the mestamp must be within a
small window or the server will reject and terminate communica on on that IP port.
• If the login is successful, a randomly generated session key is returned, 256 bit encoded as well, to the phone
app. All subsequent messages from the phone app must contain this session key or the server will terminate
communica on. All parameters and response data are 256 bit encoded with the expected 256 bit key or the
server will terminate communica on immediately.

Permissions
All Users require Full Control over their Local WinDSX folder and the Shared WinDSX folder (typically the Comm Server).
The Shared Folder is Shared to Everyone with Full Control. Each User needs full control over their Temp on the PC they
are logged into Windows on. \User\AppData\Temp\DsxTmp

Mixed or SQL Server AuthenƟcaƟon: Select SQL Server Authen ca on and enter a Login and Password. When se ng up
the Client PCs the first me [Link] is started it will launch SQLSetup. Enter the Name of the SQL Server and the
Username and Password you entered in the SQL Server. This will be done on all PCs the first me the program is run.

Windows AuthenƟcaƟon or Named Pipes: Select Windows Authen ca on. When se ng up the Client PCs, the first me
[Link] is started, it will launch [Link]. Enter the Name of the SQL Server. Do not enter a Username or
Password. This will be done on all PCs the first me the program is run. Rights and permissions must be given to the user
in the SQL Management Studio and AD.

DSX Access Systems, Inc. 214-553-6140 [Link] (11/2024)

Systems on a Domain: Requires a Domain User Account with Local Administra ve Rights to the Local folder, the Comm
Server PC folder or Shared database folder if different and both SQL databases.

System in a WorkGroup: Comm Server is also the SQL Server, create the Users for each Client and Comm Server in
Computer Management\Local Users and Groups\Users. In the SQL Management Studio \Security\Logins add these same
accounts from the local Comm Server and set them to Windows Authen ca on and give them Data_Reader,
Data_Writer, and Public rights to AcsData and AcsLog.

SQL 2012 and up AddiƟonal ConfiguraƟon In SQL 2012 and up the TCP/IP protocol and Named Pipes must be enabled.
Start the SQL Server Configura on Manager, navigate to Protocols for MSSQL Server. Enable Named Pipes & TCP/IP.
Double click on the TCP/IP protocol name. On the TCP/IP Proper es window, Click the IP Addresses tab. Scroll all the
way down to the bo om. Make sure the TCP Port is set to 1433.

In SQL Server 2012 and up you must manually turn on the SQL Server Browser Service. Go to Services and find SQL
Server Browser. Double click the Service. Change the startup type from Disabled to AutomaƟc and Start the service.

Testing Services
Determine what works as an applica on and what works as a Service:
Worksta on should show Primary OnLine in the bo om right corner in Green before se ng Comm Server
to run as a Service. Before the DSXComm Service is started, the Worksta on program should show Comm
Loss in the Bo om right corner. When the DSXComm Service is started, it should change to Primary online.
If not, the Permissions assigned to the Service will not be sufficient.

Once Comm Server is a Service, DataBase must be a Service also for it to import API files on the same PC. When
both are running as a program, DataBase should process API files from the Root of the WinDSX folder C:\WinDSX
or the API subfolder C:\WinDSX\API\

Permissions tests for DSX and System Folders

In the DSX DataBase program add and delete a Company and a Comm Port.

Outside of the program open the WinDSX folder and delete the [Link]
Edit [Link] and see if you can change the 0 to a 1 and save and close.
Open the Errors folder and create a subfolder called OLD and grab all files in Errors and move them to it.
C:\WinDSX\Errors\OLD
In the C: drive Go to \User\AppData\Temp\DsxTmp and create a folder and a file and delete them both.

Note: These ac ons should be possible without the operator having to enter a password to complete them.

Moving Folders from old PCs to new such as coming from a Windows 2012 or older Server or Windows 7 and older to a
new PC or Server requires that you replace the owner and child permissions for the new server and user(s).

If these tests do not return the proper results, see the Permissions required on the previous pages.

DSX Access Systems, Inc. 214-553-6140 [Link] (11/2024)