EntryPoint Security

Security-first architecture for mobile access control.

Last updated: February 24, 2026

EntryPoint Security

EntryPoint is built with a security-first approach. Security is a foundational design principle across the entire system.

From mobile applications to backend services, WebSocket communication and device firmware, multiple protection layers ensure authenticity, integrity and abuse resistance.

Cryptographically Signed Commands

All critical device commands are signed using ES256 (ECDSA P-256 + SHA-256).

Devices:

  • Reject unsigned commands
  • Verify digital signatures before execution
  • Ignore tampered or altered payloads

This prevents

  • Command injection
  • Payload manipulation
  • Unauthorized device control

Anti-Replay Protection

The system implements multi-layer replay protection:

  • Nonce mechanism
  • Unique operation identifiers
  • Short validity windows
  • TTL cache and idempotency enforcement
  • Duplicate commands are automatically rejected.

Secure Transport (TLS / WSS)

Communication between devices and server uses:

  • WSS (WebSocket over TLS)
  • Certificate validation
  • Plain ws:// transport blocking
  • All data in transit is encrypted.

Symfony Backend Authentication

EntryPoint backend runs on Symfony Security firewalls with HTTPS enforcement on protected routes.

Admin and owner login flows use Symfony authenticators with CSRF protection and one-time verification code checks.

  • Route-level access control via firewall and role policy
  • Session-bound login code validation with expiration checks
  • CSRF token validation on login verification endpoints

Mobile User API Authentication (JWT Bearer)

Mobile user API requests are authenticated with JWT Bearer tokens.

  • JWT issuance and verification are handled by Symfony (LexikJWT integration)
  • JWT tokens are cryptographically signed with backend key material (secret/public key pair)
  • Protected /api endpoints require authenticated JWT context

Mobile App Integrity

The mobile application implements:

  • Secure key storage (Android Keystore / iOS Secure Enclave)
  • ES256 request signing
  • SHA-256 body hashing
  • Replay protection

The backend verifies

  • Signature validity
  • Request integrity
  • Freshness window
  • Replay attempts

Audit and Monitoring

Security-relevant events are logged, including:

  • Signed command ingest
  • Signature failures
  • Replay detection
  • Integrity validation failures

Continuous Improvement

Security evolves through:

  • Version gating
  • Controlled migration
  • Key rotation support
  • Enhanced verification policies

Technical Documentation

For full technical security architecture:

/security-architecture