Digital Lock On

Appearance

Decision: QR Code Security and Trust Model ​

Quick Summary ​

How should we secure QR codes and establish trust boundaries for verification in safety-critical lock-on processes?

Context ​

The digital lock-on system uses QR codes to enable rapid worker identification. However, QR codes present fundamental privacy and authentication challenges.

Current State:

  • QR codes are generated for workers in the admin system
  • QR codes contain worker names and contact information (privacy sensitive data)
  • No current cryptographic protection of QR code content
  • QR codes can be easily read by anyone with a QR scanner
  • Workers requiring Direct Supervision (DS) may technically possess QR codes
  • No technical mechanism to ensure QR codes originated from our system

Business Context:

  • QR codes contain personal information (names, contact details) for offline operation that should be protected
  • Workers requiring DS should use manual lock-on for supervision purposes
  • Field operations may have limited network connectivity
  • QR codes enable efficient lock-on for workers who don't require supervision
  • Balance needed between privacy protection and operational efficiency
  • Admin system controls who receives QR codes, but no technical enforcement

Technical Context:

  • QR codes can be easily duplicated, read, or modified without cryptographic protection
  • Personal information in QR codes creates privacy exposure
  • Need offline validation capability for field operations
  • External parties could potentially create fake QR codes with valid-looking data
  • Key management infrastructure required for cryptographic solutions

Privacy Requirement: The core driver for encryption is protecting PII in QR codes whilst maintaining offline capability. Unlike a UUID-only approach (which would require online database lookup), encrypted PII enables:

  • Full offline worker lock-on functionality
  • Reduced data synchronisation requirements (don't need to sync entire worker database)
  • Privacy protection (random QR scanners can't read worker details)
  • Lower bandwidth usage in remote worksites

Decision Required ​

How should we secure QR codes to protect worker privacy and establish authentication boundaries while maintaining operational efficiency?

Success Criteria ​

What does a good decision look like?

  • [ ] Protects worker personal information from unauthorised access
  • [ ] Prevents creation of fake QR codes by external parties
  • [ ] Supports offline operation in field conditions
  • [ ] Maintains rapid lock-on efficiency for workers who don't require DS
  • [ ] Enables technical enforcement that DS workers use manual lock-on
  • [ ] Balances privacy protection with implementation complexity
  • [ ] Provides authentication that QR codes originated from our admin system

Options ​

Option 1: Encrypted and Digitally Signed QR Codes ​

Description: Implement cryptographic signing and encryption for all QR codes to protect personal information and ensure QR codes originated from our admin system.

Analysis

Pros:

  • Protects worker personal information from unauthorised scanning/reading
  • Prevents external parties from creating fake QR codes with valid-looking data
  • Supports offline validation through embedded cryptographic verification
  • Provides strong authentication that QR codes originated from our admin system
  • Enables technical enforcement that only admin-generated QR codes work
  • Supports rapid lock-on for workers with legitimate QR codes

Cons:

  • Requires cryptographic key management infrastructure
  • Adds computational overhead for QR generation and validation
  • Increases QR code size due to encryption/signature data
  • Complex key rotation and revocation processes needed
  • Higher implementation complexity and ongoing maintenance

Risks:

  • Key compromise could invalidate all QR codes - Mitigation: Key rotation procedures and hierarchical key structure
  • Performance impact on QR scanning - Mitigation: Optimised cryptographic algorithms and caching
  • Complexity may introduce implementation bugs - Mitigation: Comprehensive testing and security review

Implementation Effort: TBC (cryptographic infrastructure, key management, QR generation/validation updates) Maintenance Overhead: Medium-High (ongoing key management, security monitoring)

Option 2: Server-Side Validation Only ​

Description: Store QR identifiers server-side and validate against central database. QR codes contain only non-sensitive identifiers.

Analysis

Pros:

  • Centralized control over QR validity and revocation
  • Simple QR code structure with minimal data
  • Real-time validation against current competency status
  • Easy to implement and maintain
  • Strong security through centralized validation

Cons:

  • Requires network connectivity for all QR validation
  • Single point of failure for QR validation system
  • Cannot support offline field operations
  • Network latency impacts QR scanning performance
  • Vulnerable to network outages blocking operations

Risks:

  • Network outage prevents all QR-based lock-on - Mitigation: Fallback to manual processes, but eliminates QR efficiency
  • Database performance issues affect field operations - Mitigation: Redundant systems, but adds complexity
  • Connectivity issues in remote worksites - Mitigation: Network improvements, but may not be feasible everywhere

Implementation Effort: TBC (database design, API endpoints, validation logic) Maintenance Overhead: Medium (database maintenance, API monitoring)

Option 3: Plaintext QR Codes with Business Process Controls ​

Description: Rely on business processes and procedural controls to ensure QR codes represent valid competencies. No technical security measures.

Analysis

Pros:

  • Simple technical implementation with no cryptographic complexity
  • Fast QR generation and scanning with minimal overhead
  • No key management or infrastructure requirements
  • Easy to troubleshoot and maintain
  • Supports offline operations fully

Cons:

  • Vulnerable to QR code forgery and tampering
  • No technical enforcement of business rules
  • Relies entirely on procedural controls for security
  • Difficult to detect or prevent misuse
  • Weak audit trail for compliance purposes

Risks:

  • Forged QR codes allowing unauthorized access - Mitigation: Procedural controls, but limited effectiveness
  • Safety incidents due to unverified competency claims - Mitigation: Additional manual verification, but eliminates QR efficiency
  • Compliance issues with weak audit trail - Mitigation: Enhanced documentation, but doesn't address root cause

Implementation Effort: Minimal (current implementation) Maintenance Overhead: Low (no additional technical processes)

Option 4: AES-256 symmetric encryption ​

Description: Implement symmetric encryption for QR codes containing PII, enabling offline scanning whilst protecting worker privacy. Single shared key distributed to all authorised devices. ✅ Recommended approach

Analysis

Pros:

  • Protects worker personal information from unauthorised scanning/reading
  • Prevents external parties from creating fake QR codes with valid-looking data
  • Supports offline validation through embedded cryptographic verification
  • Provides authentication that QR codes originated from our admin system
  • Fast performance (AES-GCM -100ms on iPad devices)
  • Industry-standard encryption with proven security
  • Enables technical enforcement that only admin-generated QR codes work
  • Supports rapid lock-on for workers with legitimate QR codes
  • No need to sync entire worker database to devices
  • Lower bandwidth usage in remote worksites

Cons:

  • Requires cryptographic key management infrastructure
  • Adds computational overhead for QR generation and validation
  • Increases QR code size
  • Key rotation requires app updates
  • Higher implementation complexity than plaintext
  • Single shared key means compromise affects all QR codes

Risks:

  • Key compromise could invalidate all QR codes - Mitigation: 12-month key rotation schedule, multi-version key support during transitions. Future could include a worker app that generates updated QRs
  • Performance impact on QR scanning - Mitigation: AES-GCM optimised for mobile, -100ms measured on target devices
  • QR code size impacts readability - Mitigation: Abbreviated field names, high error correction level, field testing
  • Complexity may introduce implementation bugs - Mitigation: Comprehensive testing and security review

Implementation Effort: Medium-High (encryption service, key management setup, iPad integration) Maintenance Overhead: Medium (key rotation procedures, monitoring decryption failures)

Constraints & Requirements ​

Must Have ​

  • Support for offline field operations (limited network connectivity)
  • Rapid QR scanning performance for operational efficiency
  • Clear trust boundary for QR-based competency verification
  • Tamper detection for QR codes
  • Adequate security for safety-critical system
  • Audit trail for compliance and safety investigation

Should Have ​

  • Resistance to common attack vectors (duplication, modification)
  • Reasonable implementation and maintenance complexity
  • Key rotation capability without breaking existing QR codes
  • Integration with existing QR generation and scanning systems
  • Support for emergency scenarios and fallback processes

Must Not ​

  • Require permanent network connectivity for basic QR scanning
  • Create significant performance bottlenecks in field operations
  • Introduce security vulnerabilities that compromise worker safety
  • Block operations due to technical infrastructure failures
  • Store keys in source control or unsecured locations

Research & Evidence ​

Completed Research ​

  • [x] Current QR implementation analysis - Result: No cryptographic protection, simple data encoding
  • [x] Field connectivity assessment - Result: Limited/unreliable network in many worksites
  • [x] Performance requirements - Result: QR scanning must be sub-second for operational acceptance
  • [x] Security threat model - Result: QR forgery and worker impersonation are primary concerns

Outstanding Research ​

  • [ ] Cryptographic performance testing on target mobile devices
  • [ ] Key management infrastructure options and costs
  • [ ] Industry best practices for mobile QR security
  • [ ] Compliance requirements for audit trail strength

Evidence & Data ​

  • Field operations report network connectivity issues in 40% of worksites
  • Current QR scanning averages 0.3 seconds per scan
  • Safety incidents require strong audit trail for investigation
  • Business requires balance between security and operational efficiency

Stakeholders & RACI ​

RolePerson/TeamResponsibleAccountableConsultedInformed
Decision MakerProduct Owner✅
Security LeadSecurity Team✅
Technical LeadDevelopment Team✅
Safety ManagerSafety Team✅
Field OperationsRPOs & Site Protectors✅
Compliance TeamLegal/Compliance✅
Implementation TeamDevelopment Team✅

Impact Assessment ​

Blocked Items ​

  • Worker competency verification decisions depend on QR trust model
  • QR-based lock-on process design awaits security approach
  • Audit and compliance framework requires QR security definition

Affected Components ​

  • QR Generation Service - Impact: Major changes for cryptographic implementation (Option 1)
  • Mobile App QR Scanner - Impact: Validation logic updates for chosen security model
  • API Layer - Impact: QR validation endpoints and security verification
  • Database Schema - Impact: Key storage and QR metadata (Option 1), QR validation tables (Option 2)
  • Key Management System - Impact: New component required for Option 1

Timeline Impact ​

  • If decided by deadline: Can proceed with implementation planning
  • If delayed by 1 week: Minor impact, other worker role decisions can proceed with assumptions
  • If delayed by 1 month: May need to implement temporary solution, blocks QR security enhancements

Decision Log ​

DateUpdateAuthor
2025-09-09Decision created based on worker role competency questions requiring QR trust model clarificationSimon + Claude

Next Actions ​

Immediate (Next 3 Days) ​

  • [ ] Review security requirements with Security Team
  • [x] Validate offline operation requirements with Field Operations
  • [ ] Assess cryptographic performance on target mobile devices

Short Term (Next 2 Weeks) ​

  • [ ] Consult with Safety Team on audit trail requirements
  • [x] Research industry best practices for mobile QR security
  • [ ] Evaluate key management infrastructure options
  • [ ] Make final decision

Decision Meeting ​

  • Scheduled: [To be scheduled]
  • Attendees: Product Owner, Security Lead, Technical Lead, Safety Manager, Field Operations Representative
  • Agenda: Review security options, assess field operation requirements, make decision

Requirements ​

Specifications ​

  • [To be linked]: QR code generation specification
  • [To be linked]: Authentication service specification
  • ADR-011: Worker Competency Requirements for Lock-On (affects QR payload content)

Decision Outcome ​

To be filled when decision is made

Final Decision: Option 4 - AES-256 symmetric encryption Rationale: [Why this decision was made]
Decision Date: [Date]

Internal use only