Chris Miller

What follows is some very basic information on the Saflok brand of keycard access door locks that are commonly found in most hotels and motels. Stories circulate now and then of some kind of simple way to defeat these locks, short of reprogramming the lock with your laptop and an LPI I have found no simple solution. But the experiments will continue and using this information perhaps you will have better luck.

Each Saflok lock contains a small battery powered circuit board which includes a magnetic read head and three indicator lights. When an encoded keycard is inserted into the lock and removed the read head reads the magnetic strip on the key and if correct, voltage is applied to the locking mechanism. Which depending on the model can be a motor (Saflok VI) or solenoid (all other models). The lights are activated after the keycard has been inserted and are used to provide lock status information.

Every lock is programmed for eight seperate levels of access. This approach is comprable to having eight independant locks in one.

Each keycard is encoded with three lock codes: the current code and two previously issued codes. When a new keycard is made the encoder updates the lock codes by dropping the oldest code and adding the most current.

The lock itself retains only the current lock code in its memory. When a new keycard is made and inserted into the lock the lock will first check to see if the code stored in its memory matches one of the three codes on the keycard. If so it automatically replaces the code stored in its memory with the newest code from the keycard and permits access to the room.

If a new keycard is made and not used the code in the lock will not be updated and when a second keycard is used the oldest code on the keycard will match the code stored in the lock.

A problem will occur if neither of the two new keycards are used as the third one issued will not contain the code stored in the lock. It is possible to erase a locks memory so that it has to be reprogrammed, locking out anyone who wants to use the room. Insert any keycard into the lock and remove, while the lights are blinking insert the positive wire from a six or 9 volt battery into the right hand side of the keycard slot.

SPECIAL CARDS

The EMERGENCY keycard opens all doors and will also double lock any door so that access is denied to other keycards.

The CUE keycard is a non-opening keycard that is used in conjunction with the emergency keycard for reprogramming locks. It is used mostly when lock codes are out os sequence.

Besides the host computer (usually a Toshiba t1000 with 786k RAM expansion board for hotels of 700 rooms or less) printer and keycard encoder the most interesting peice of equipment is the LPI, Lock Programmer and Interrogator interface probe, which acts as an interface between the lock and the host computer. It is used to enter lock code information directly from the computer into the lock. It is also used to obtain a printed history of the keycards that were used to enter a room. The battery powered LPI includes a built in probe and cable with a 25 pin connector to attach to the printer port. The interface probe is inserted directly into the lock like any keycard. If you get access to a host computer you can make your own master level keycard by choosing transaction #4- make duplicate current key. enter “n” (no) when the following message appears:

To replace a damaged key you should enter the keys id# Will you enter the id#[y,n]?

A new screen will appear showing a new id# and instructing you to insert a blank keycard into the encoder onto which it will copy your new master key.