AFC System Security — Layered Protection Against Cloning and Revenue Leakage

Why Layered Security?

In city card systems, money travels on a physical card and inside a device out in the field. In systems that lean on a single measure, once that measure is bypassed the entire chain collapses: a copied card produces unlimited rides, a cracked device writes fake revenue.

Sole Akbil instead uses seven separate layers, each meaningful on its own. Even if one layer is bypassed, the others remain in force.

Layer 1 — Operator-Specific Encrypted Card Key

Every customer has their own Mifare encryption key. A card obtained from another source, belonging to another municipality, or bought blank off the shelf cannot work cryptographically in your system; the validator rejects it as an "Unregistered Card".

This is not only a device-side check: the UID of a card that was not keyed in your system never appears in the management panel either. An unauthorised card finds no place in any layer of the system.

Layer 2 — The Fare Is Always Calculated on the Server

An Android application out in the field can be inspected (decompiled) by anyone sufficiently motivated. That is why in Sole Akbil the fare written to the ledger is always the amount the server calculated; the device's own claim is never accepted as revenue.

This holds even while the device runs offline: the transaction is charged at the base fare, and at sync the server recalculates the correct amount retroactively and writes it to the ledger. So even if the application is reverse-engineered, no fake transaction can be produced and no tariff can be manipulated.

An additional hardening step: the server address is fixed at APK build time; no IP or port can be entered from the panel. This is a deliberate design decision to narrow the attack surface.

Layer 3 — Immutable Transaction Ledger

No transaction updates the balance directly. Every movement — tap, top-up, refund, cancellation — is written to the ledger as a separate, non-deletable record; the balance is the result of those records.

• Deleting or editing a record afterwards is not possible.
• Behind every figure in a report there are individual, traceable transactions.
• A counter transaction made in the panel and a validator tap in the field land in the same ledger — one accounting record, not two separate systems.
• Balance operations run atomically and idempotently on the server: even if the same transaction is resent after a connection drop, it is processed once; no double deduction or lost top-up occurs.

Layer 4 — Clone and Anomaly Detection

In a world where copying cannot be prevented outright, the second line of defence is detection:

Layer 5 — Data Masking and Privacy-First Design

The best personal-data protection is not collecting the data at all. Sole Akbil turns that principle into concrete decisions:

• National ID numbers are deliberately not collected.
• The birth year is never stored anywhere — only the day-month is carried on the card for the birthday discount.
• Card UIDs are never shown in full on any screen — in reports, search results and tables only the first character is visible, the rest is masked.
• Driver PINs are never displayed in the panel; they can only be reset.

Layer 6 — Access Isolation and Corporate Internal Control

Public-sector internal control standards require a clear answer to "who can access what":

• Menu-level fine-grained permissions — separate View/Edit rights per menu, per user.
• PC and working-hour restrictions — login only from approved computers and/or within defined hours.
• Dealer/role isolation — each dealer and user sees only their own data; access is isolated at row level.
• Session security — automatic logout after 3 hours of inactivity; when the same user logs in from another computer, the previous session closes automatically.
• Branch-level filtering — data boundaries are preserved in multi-branch structures.

Layer 7 — Device and Terminal Security

• Device pairing — one-time pairing code; the device secret is stored in hardware-backed encrypted storage.
• PIN-protected driver login and shift-based accountability.
• Kiosk lock — sealed lockdown; the user cannot exit to the home screen or another application.
• Device health monitoring — a device sending no data for 5 minutes is automatically flagged "offline".

Audit Trail: Who Did What?

The final link in security is the system being accountable to its own users. The User Activity Report keeps a trail of every change made in the panel; which user changed what and when can be queried retrospectively. On the driver side, the Driver Activity Report records shift hours and failed PIN attempts.

Sole Akbil vs. Single-Layer Systems

Related pages: reporting and audit trail · offline operation · management panel · what is a validator?

Frequently Asked Questions