kh
= - - _ l - ;- '' . .: ffk $'
.; , , x ! ^ ' j
, - _ __ --- .; _. ''O . % 7 ${ _ _ _ _" ,-" - L, ~"7- d j 4" , Wg' * * . K g | | ' '
* . J1 , 1 || I A()| ' ^ ' : , + \bh $ ' ?,v . , . ; y, t w;w .a- v ys , . 1,
- - .- . . teg pay x
"
'
. Y _. _ }Y
, i . .m \ "' ' t $ .! ?% @$ N ;;;hi [ ' ' ' h * kf:ff
. :" . 5. .-- i .a; .' . |" . y(f
' ''
; - .. % 09 4 [ N s g.p
c.h i , ,.
g - ? ]- 3 . . - =q .' , ,
y . j _. -.
' ' '- - 1. I, | . ., - I j j ; , ,
, i ii
, en n I y "4 , _ _ _ MH! :'- ji il - af . .t'
* | .
' ^ * '" ' 6 L. 1 . | , - , i > |$ [ , . 9
' '
-
;- , . | . -1
[ . . ' .- " i J- g . ,
- g10 g 921130' J w : '
CR-5929 R ( - - ' ' PDR . =' .'
. . , b := :=. _ _. .\ Q my afQ p%WWW%$WQMQWWm&:)MWhwv r% ng%w%w%wAw&mWpg: o pr ~ %wmy' n# ~wAguynw aga u . m, wr mu m%m www 4- e-ma vp , y;a%ee wempy&m~ehn p ga,,w sm s p y w@m g: wpqy>;m%www;m n % y p i Ngeu * gmw7: r v%n;a ,W m- F p D % fy q m % aw yb h @ w/ y M M h d M [ %y hw.:c,+[[ dkk h[n s^ u'QQ:na~ 7M , M~, , w[M ; %hd[n w $N' ~ h & M C|$ U N k # ( , nag n ,, , v me w w a f3m m&e MW , M4' b < ,. J <+ . w g M$b M h [ h h %w;% p:e&gh- n w n%w m ~n g &w e %z u n : n #'' w& p& lif Maym h n W W M- v 'An= +, +~ %~ + f'+w m&Wna ''*st y4 W W~ % m|M * M& ,~ o , W|% p k N+( &w # .- , % W W ny- m ,. - M v. , C - - * * ------*.- cd r h d$h w W a o. m 49 , 8wwmn w >g
pgy%ggMy - . , j; g 4 g,j, A (;j@- .~pg;[g/tgm [v 3:.%ssy w pqigMAp: g$:ju n.!4 @ S.!W,g ] f , 4 tyy |, [_ . p g:;gb g g y.R %, *g g4 n w n mw . M v95 %~ W +W m E ,w,n m ,w m tmonceW h+ W e M~ v~L ' wDW hn d M- n , W Q@H%g%gygW:TSF~N, @ W G, 491 G ,%,W Mf |wMat MwW2K(stMam *ticWe'*nce C,W)n N@thten Mg
s o. m . c m,,y m. m %~ ~N"va m ~.A:- -: = .;-----: a ~m e w.,un n ywem . ppay m- c s. .. x- ~ .n v- -wn- %nA| - M h bh0 Ebb [NI UON b- e I hbAbbN MiMNNWOOkO hkWO $ , M - %[% t dQMit Mrwekeht$naistwannr4hi.INIYMMrksahWratsndstamird DO)hMID stKhton Bsabway&Ne*NotKK
. NQntMWM956 ' $ $&QQW *' " N$ NNM om l N [M = I t ky h$bhkhbbbkNNbbkb- - NNNN|%%M 7---- W D A *mm @Y '4@>}kWk > W / MQW w - a s n ^ 5 m % m% e- > 4 ^ " s a MG 'Qh M b % N,u s%+ * < 4% + WL2 + M9 > Gbr C $g# St ,' g e h-QUV ..M n AL m 1- kin b|%ge W .. wp f pwt .. & Wwg-
- bkb Sh 4 k i e pmwwwmmwenem s w e M E M m m M a n m W[hba4 Jad ?w w$w$j pMN t W MWWW@am@-~cMWWasymyW@vfmotWoWamy$w=n m#yi.Q $w x mw m v w% un e, o, w ws-wwmmnosoen~em- ~~ ~w - -~- %<~~ - -w m S iwe t M dl %w %hU$4,aBuc u w. % procrgs @rekned in M r@h yfp4Mnts ft@M V59 + . M NMI8!M]Of anyi #matbrh 6 ppa (ag pmdum or. * " - ONEWNYo*@0MN$M- E Dh , . h NNkh . m %4 mh amu =. -m
- ,; . ,ph Y k ff y[ . , if f Af g hff& ff ,ff ww,ww.n +s:MG_wcm,mM~e~ad%_ W__;A_-i ww _ ____ . ~ _ _. - . _ _ . . _ . . . . _ _ . _. _.
. .
NUREG/CR-5929 . SAND 92-1682-- h
, ... , ,s ..
. . : Loc .xmg Sys~: ems :,or P.aysica. 7 Pro':ection anc Control
__ .
I
l'repared by - - K T, Gee, S. I L Scou. M. G. Wilde. S ii. Htghland _
Sandia National Laboratories Operated by " Sandia Corporation .
. Prepared for ,U.S. Nuclear Regulatory Commission
9301060154 9 p i 'i , c PDR ' ' ' N< jn gc 1 CR-5929 y p9g
H --_
%
i
AVAILABILITY NOTICE
Avadabmty of Reference Materws Cited in NRC Pubhca90ns
Most cocuments etted in NRC putweations will be available from one of the following sources;
1. The NRC Public Document Room. 2120 L Street, NW., Lower Level, Washington, DC 20$55
2. The Superintencent of Documents U.S. Government Printing Office, P,0, Box 37082, Washington, DC 200t3-7082
3. The National Technicalinformation Service, Sprincheid, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive. Referenced documents available for inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and Internal NRC memoranda: NRC bulletins, circulars, information notices, inspection and lnvestigation notices; licensee event reports: vendor reports and correspondence; Commis- slon papers; and applicant and incensee documents and correspondence.
The fo!!owing documents in the NUREG series are avaEable for purchase from the GPO Sales Program: formal NRC staff and contractor reports, NRC sponsored conference proceedings, International agreement Also ava!!able are regulatory guides NRC reports, grant pubhcations, and NRC booklets and brochures. regulations in the Code of Feaeral Regu|ations, and Nuclear Regulatory Commission issuances, Documents ava!!able from the National Technical information Service include NUREG-series reports and technical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commis- ston. forerunrier agency to the Nuclear Regulatory Commission,
Documents avaHable from public and special technical l|braries include aH open literature Remt such as books, journal articles, and transactions. Federal Register notices, Federal and State leg!slation, and con- grossior,al reports can usustty be obtained from these l!braries. Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference pro * coed:ngs are availabie for purchase from the organization sponsoring the pubhcation etted. r- Singte copies of NRC draft reports are ava:lable free, to the extent of supply, upon written request to the Office of Administration, Distribution and Mail Services Section, U.S. , Nuclear Regulatory Commission, Washington, DC 20555
Copies of industry codes and standards used in a substantive rnanner in the NRC regulatory process are mahtained at the NRC Library,7920 Norfolk Avenue, Bethesda, f/aryland, for use by the public. Codes and standarcs are usually copyrignted and may be purchased from the originating organ!zation or, if they are American National Standards, from the American National Standards Institute,1430 Broadway, New York, NY 100tB.
. .
%;LAIMER NOTICE
This report was prepared as an account of work sponsored by an agency of the United States Govemment Noitner the United States Government nor any agency thereof, or any of the!r employees, makes any warranty, expressed or implied, or assumes any legal liability of responsibHity for any third party's use, or the results of such use, of any information, apparatus. preduct or process disclosed in tnis report, or represents that its use by such third party wou!d not infringe privately owned rights.
. . ., ------_ _ - .
NUREG/CR-5929 SAND 92-1682
Locking Systems for Physical Protection and Control
Manuscript Completed: October 1992 Date Pubbshed: November 1992
Prepaied by K. T. Gee, S.11. Scott. M. G. Wilde. S. I', liighland *
Sandia National laboratories Albuquerque NM 87185-5800
Prepared for I)ivision of Safeguards and Transportation Omce of Nuclear Material Safety and Safeguards U.S. Nuclear Regulatory Conunission Washington, I)C 20555 NRC FIN 1.1387
* Albuquerque Safe Company, Albuquerque, NM .. . . ______. . _ _ . . _ , _ _ _ _ . . _ _ . . _ _ . _ _ _ . . ______. . . . _ . _ . ______. . _ _ _ _ . . . .. ___
Abstract =:
1he purpose of this NUREO is to present technical information that should be useful for underst'anding and applying locking - systems for physical protection and control. There are major sections on hardware for locks, vaults, safes, and security - containers. Other topics include management of lock systems and safety considerations. This document also contains notes on standards and specificatkos and a ghusary,
iii NUREG/CR 5929
. - - _ _ , -- - . . . . -. , - - . _ _ . _ _ _ _ . _ _ . . - _ - _. . _ . . . _ _ _ . . _ .
Contents
Page
Abstract...... 4 .....-...... ill
1 Introduction ...... - ...... , ...... , ...... - ...... ~ ...... I
1.1 Discussion of N RC Req uirements ., ...... , ...... I
1.2 Purpose of Document ...... I
2 The Role of Locking Systems in Physical Protection and Control ...... 3
3 Ink Technologies ...... 5
3.1 K e y 1.oc ks ...... ,, , ...... , , ...... 5
3.1.1 Uses ...... - . . . . 4 ...... 5
3.1.2 1lardware Description ...... 5
3.1.2.1 D asic Designs ...... -...... , . . . - ...... 5
3.1.2.2 Master. Keying ...... - ...... 7
3.1.2.3 Proprietary Systems ...... ,- ...... 8-
3.1.2.4 Other Key Lock Options and Variations...... 9
3.1.3 Application Considerations...... -.,...... 10
3.1.3.1 Pros and Cons . , ...... -...... -...... 10
3.1.3.2 Design Features Which Affect Security ...... - ...... I 1 .,...... 12 3.1.3.3 Other Factors Which Affect Security ......
3.1.4 Standards and Specifications ...... - ...... -...... 12
3.1.4.1 Permanently installed Key locks ...... z... 12
3.1.4.2 Key. Operated Padlocks...... ,, ...... = 14
3.2 Traditional Combination Locks-.... . ,...... ,...... 15
3.2.1 Uses ...... 15 3.2.2 Hardware Description ...... , ...... , , ...... 16
3.2.2.1 Combination leck Options and Variations . ..-...... , ...... 20
...... ,...... 23 3.2.3 Application Considerations ...... - -.
.,...... -...... 23 3.2.3.1 Pros and Cons ...... m
3.2.3.2- General Design Features Which increase Security...... ,, ...... 24 3.2.3.3 Other Factors Which Affect Security ...... - . - . . . . . , , ...... 24~
3.2.4 Standards and Specifications ...... 25
3.2.4.1 Permanently Installed Combination Locks ...... 25
3.2.4.2 Combination Padlocks ...... - ...... 26
v NUREG/CR.5929
. . . _- , _ , - - - - _ _ _ _ _ - - _ _ _ _ .
3.3 Bolts, Strikes, and latehes ...... _ ...... 2 6
...... , ...... 3.3.1 Uses ...... 27 3.3.2 liardware Description: Mechanical Bolts Strikes, and Latches ...... 27
3.3.3 liardware Description: Electrical Bolts, Strikes, and Latches ...... 28
3.3.4 Application Considerations...... - ...... 29
3.3.4.1 Pros and Cons ...... 29
3.3.4.2 Design Features Which increase Security ...... 30
3.3.5 Standards and Specifications ...... 30
3.3.6 Directory of Certi6ed Locks and Latches...... 31
3.4 Mechanical Coded Locks ...... 32
3.4.1 Uses . . . . _...... 3 2
3.4.2 Hardware Description ...... , , 32
__
3.4.3 Application Considerations...... 32
...... 3.5 Electromagnetic Locks ...... , 32
3.5.1 Uses ...... 32 e 3.5.2 liardware Description ...... 33
3.5.3 Application Considerations...... 33
3.5.3.1 Pros and Cons ...... 33
3.5.3.2 Design Features Which Increase Security ...... 34
3.5.4 Standards and Specifications ...... ,. .. 34
3.6 Self-Contained Electronic Combination locks...... 34
3.6.1 Uses ...... 34
3.6.2 Hardware Description . , ...... 34
3.6.3 Application Considerations...... 36
3.6.3.1 Pros and Cons ...... 36
3.6.3.2 General Design Features Which Increase Security .._...... 36
3.6.3.3 Specific Design Features Which increase Security ...... 37
3.6.4 Standards and Specifications ...... 37
t
. . . . 3.7 Additional Hardware issues . . . 37
3.7.1 Commensurate levels of Security ...... 37
3.7.2 Hinges ...... 38
3.7.3 Screws ...... 38
3.7.4 H asps ...... 38
3.7.5 Hardened Barriers .. . , . . . . . 38
3.7.6 Doors and Door Jambs ...... 39
4 Vaults ...... 41
4.1 Vault Construetion ...... 41
4.1.1 Uses ...... 41
4.1.2 Hardware Description ...... - - - 41
NUREG/CR-5929 vi
.
., _ . ______. . _ ...... - . _. -- - _ .- - .- - . . - . - . - - - .
i
- 4.2 Wall Construc tion ...... _...... , ...... ~....._.. -.m ...... 41..
4.2.1 Uses...... , . . _ ...... 41
4.2.2 Ilardware Description ...... 4...... - ...... 41
4.2.3 Appliea tion Conside ations ...... - ...... 44- 1 ,
4.2.3.1 Factors Which Affect Security...... _ . - m.. 44
4.2.3.2 Design Featurcs Which increase Security .. 4 ...... ~ .. .. -.. . 4 4
4.2.4 Standards and Speci0 cations . . _ . .. -...... ~ ...... 44
4.3 Veuit Doors ...... , .. , , . . . , ...... , 44-
4.3.1 IIardware Description ...... 44
4.3.2 Standards and Specifications .. -,...... 4...... 44
5 Safes and Security Containers ...... ~ ...... 47
' 5.1 Uses ...... ,47
5.2 11ardware Description...... , ...... m...... 47
5.3 Application Considerations . , , ,, ...... , ...... , 49
5.4 Standards and Specifications ...... 52
5.4.1 Specifications of GSA Security Containers ...... -. . ..., ...... 52
5.4.2 UL Standards and Specifications ...... 4...... _ ...... - ...... 53-
5.5 Management of Security Containers and Safes.. -. .. . . - ...... , ...... _ . . . , . . 54
6 Management of Lock Systems ...... , ...... , . - ...... , 55
6.1 Management issues Common to All Types of lock Systems m...... m...... m.. 55
6.1.1 Management Policy ...... ~...... 4...... -.. . .. 55
6.1.2 Implementation.. Turning Policy into Action ...... -...... ,. 56
6.1.3 Maintenance und inventory...... m...m .....m...... ,.....~...... 56
6.2 issues Specific to Key Lock Systems ...... , ...... -, ...... 5 7 6.3 luues Specific to Combination lack Systems , , ...... ~ ...... _ . . . 57
6.4 Lock Monitoring ...... - ...... - , ...... ~ ...... _ ...... 58
6.5 Compensatory Action-What to Do in Case of Lock Failure or Suspected Attack...... , ...... 58
' 6.6 Auditing .. .., ... . _...... ,...... , ...... 5 8
7 Safety Considerations of Locks...... ~....m...... _ ...... ,...... m....m...... m... 59
7.1 - Conflicting Needs...... , ...... , ...... , ...... -59
7.2 Emergency Exit Devices ...... mm...... _...... m 59 ,
-7.2.1 1lardware Description . .._...... 4 . 4 ...... , - . . ... 59-
7.2.2 Appiication Considcrations... ._ ...... 60 -
7.2.2.I Pros and Cons ...... - ...... - . _ . . . . . , . . - ...... _ ...... 60.
7.2.2.2 Design Features Which increase Security .. .. 4 ...... m...... _...... 60
7.2.3 Standards and Specineations .. . . _ ...... , ...... 61 c 7.2.4 Directory of Certified Exit Devices ...... - . . . . _ ...... ~ ...... _....63 <
|
vil NUREG/CR-5929
,
Ii
, - - , , , . - . , , . - . . ~ , . -- .- ,. , - , . . . 3 - --- . _ ------, - - .__.- . . - . . . . .- . . . . _ . . . . - . - . . _ . . . ~ . ~ ~ . - .- ..- - . g. Y fl - i i
-
._
. A ppcadix A ...... , ...... ,, , ,,,,, _ ...... 65- ; 4
. - i , Appendix B .. . -...... ;. ... ., ...... , , , , , , , , , , , , , , , , ....-...... 67:-. .
...... , ...... '01ossary ; ...... 69 _
>
>
s - e
a >
,
0
.
. .
f
' NUREG/CR 5929 viii
: . W
e
-. - . w ,--_- -. -~. - _ - _ . ~ _ - _ - _ _ - _
Figures
.. . . . _ . . . . 5 3.I Warded lock ...... , ...... - ...... - 32 Wafer lock ...... -...... 4...... , ., ...... 6 33 Standard pin. tumbler lock...... - .. 6 3-4 Lever lock operations ,. . . .,-...... 7 : 35 Example of pin splitting for master. keying .., ...... , ., ...... 7 ...... 8 '36 Master keying system ...... , ...... - . . .. 8 37 Bicentric cylinder......
...... 8 38 Master ring ...... 39 Self. contained master. keying key ...... _.....m...... '8
.. . 9 3 10 Keyway cross sections ...... - ...... - ..- 3 11 Pin and lever variations ...... , , , ...... - , ...... , ...... - ...... 9 312 Tubular locks ...... - . - . . , , ...... , . . . 9 3 13 Standard and dual pin-tumbler keys and cylinders ...... ~ ...... - .. 10
3 14 Standard and multirow radial keys and cylinders . ...a...... 4 ...... - 10
...... , . . .._ ...... 3-15 Rotating tumbler disk lock.. . . .- ...... 10 .. , ...... I 1 316 Removable core key mechanisms...... 3-17 Typical arrangement of lock bolt and locking bars on a safe ...... 15 318 Combination lock mechanisms ...... 16 ...... 3 19 Case design, door lock ...... 16 3 20 Case design, padlock . .- ...... , , ...... , ...... 17
. ,, . . . , ...... , ...... 3 21 Wheel pack assembly, ...... 17
3-22 Various code wheel gate designs ...... , , , ...... , .. 17
3-23 Tooth. meshed hand. change wheel...... , ...... - . .-17 , 18 3 24 Hole and screw hand. change wheels .. .. , . , ...... , ., ......
. .. 18 3 25 Key-change wheels . . . . . , , , . . . _ . .
3 26 Fly operation .. ., ...... , ...... 18
3 27 Dial ...... , . . . , ...... 19
. 3 28 Drive cam location ...... , .., , .- ...... -. 19 -
. -...... , .. . , ...... 19 3-29 Drive cam action (door lock) . .. . , ......
3 30 Drive cam action (padlock).. ,, ...... - ...... 20 '
...... 20 3 31 Group 2 lock...... , ...... -. .. . .
3 32 Noisemaker . ,, . . , _ . . . - ...... , ...... - ...... , 20
3-33 Eccentric roller ... ., ... .,. , ...... _ ...... 21 3-34 Concealed drive cam gates., ...... , ...... , ...... _ . . , . _ ...... 21
., _...... 21 3 35 Rotary. fence gear. driven lock ......
~ 3 36 Spring momentum...... , ...... 22 3 37 X. ray resistant code wheel. , ...... , , ...... 22 3 38 Relocking devices ...... , ...... - . . .. . , , ...... , ...... 22 3 39 Factors affecting vibration resistance ...... , .. .. ., . ,, ...... '23-
3 40 Padlock key. change hole ...... -...... - .. - 23 3-41 - Typical mounting configuration of a bolt, strike, and latch...... -26 , ' 3-42 A spring-loaded latch...... 27
3-43 Example of dead-locking latch, k>oking down from top of door ...... - . . .. - . , , , , ...... , . . . 28 '
3-44 Key. operated deadbolt ... . .- . ... . ,- . . . . - ...... 28 3 45 - Intermittently coupled bolt (combination kick) ...... , .. .. 28 3 46 Example of electric bolt with motor driven lead screw ...... ,, ...... 29
3-47 Example of a fail secure electric solenoid operated strike...... , , ...... 29 3-48 Example of a fait safe electric solenoid operated strike ...... ~ 29 - , .. 32 3 49 Mechanical coded push-button locks .. ... 4 ......
- 3 50 Typicalelectromagnetic lock...... - . . 33 .. 3-51 Cross section of shear. resistant electromagnetic lock ...... = ...... 33
...... 3-52 Fall secure electromagnetic lock...... 34
. . . . - .. . . . 35 3-53 X 07 Rear cover / electronics package ......
...... ,. . . - . - . . . . 35- 3 54 Back view of X 07. -...... -- .
.. ,...... -...... 38 3-55 Cutaway view of key padlock and hasp.. .- . . . . .
ix NUREG/CR-5929.
,
, - - 3-56 Ilardened shields...... 38
. 6 3-57 Shackle exposure . . . . 39
3 58 liardened box padlock concealment...... 39
3-59 liardened guard plates and rings...... 39
3-60 liardened combination lcck ...... ' 40
4-1 Typical vault construction ...... 42
4-2 Expanded metal-concrete w all construction ...... 43
5-1 Carbide-included barrier plate . . . , . . 47 5-2 Plate under attack . 47
5-3 Defeated drill bit . . .. . 48
5-4 Glass plate for keylock ...... 49
5-5 Glass plate with cable . . 49 5-6 Standard 4-drawer single lock cabinet . 50
5-7 A dual-lock cabinet . . . 50
5-8 A dual-multiple lock cabinet.- . . . 51
5-9 A multiple lock cabinet . . 51
. 5-10 Class 5 safe . 51 _
5-11 Class 5 map and plan . . . _ . . 52
5-12 Class 5 weapons safe . . . 52
5-13 New style removable drawer head.. . 53 7-1 Rim-trounted panic bar.. . 59 7-2 Push pad with alarm.. 60
Tables
4-1 Vault penetration mean times (minutes) . 42 4-2 Protection classes and delay times . 45
_
NUREG/CR-5929 x
______- _ _ - __ _
Acknowledgement
The authors wish to acknowledge Pat Romero and George Perry of Bill's Lock and Key, Albuquerque, and Kenneth G. Adams, Kenneth R. Ludwick, and other Sandia technical experts for their excellent assistance in preparing this document.
_
_
xi NUREG/CR 5929
- _ _ - _ - - ______-__
1 Introduction
1.1 Discussion of NRC Requirements (1) the locking pad protecting of all unoccupied vital areas with an activated intrusion alarm system U.S. Nuclear Regulatory Commission (NRC) regulations [73.55(d)(7)(i)(D)] under Part 73 " Physical Protection of Plants and M aterials" of Title 10, Code of Federal Regulations, specify performance (2) the use of locks of substantial construction on doors or requirements for the physical protection of special nuclear hatches to reactor containment |73.55(d)(8)] materials and associated facilitMs. (3) the control of keys, locks, combinations and related accen control devices to regulate access to protected and For fuel cycle facilities using or pmsessing a formula quantity' of strategic special nuclear mater,. , paragraph 73.45(b)(1)(i) vital areas (73.55(d)(9)) requires the prevention of unauthorized access of persons, - vehicles, and materials into material access areas and vital areas. 1.2 Purpose of Document
For fuel cycle facilities, an example reference system is %e porpose of this NUREG is to present technical infuma- outlined in section 73.46. Specifically, this section calls for tion that will be of use in developing key and locking systems for physical protection and control, By virtue of the nature of (1) the storage of strategic special nuclear material (other a NUREG document, the discussion ofequipment or systems than alloys, fuel elements, or fuel assemblies) in vaults herein does not constitute acceptance or endorsement by the when the material is not undergoing processing, and NRC. requires the material to be kept in locked compartments or locked process equipment while undergoing process- This NUREG provides information which will allow security ing, except w hen personally attended 173.46(c)(5)(i)) personnel to make more informed decisions on lock selection and management. The primary emphasis is on lock technolo- (2) the storage of enriched e aniu m sc rap w ithin loc ked areas gies including uses, hardware descriptions, application con- {73.46(c)(6)) siderations, and standards and specifications, in addition, some related security issues are discussed. These issues in- (3) key and lock control [73.46(d)(14)] clude vaults, safes and security containers, management of lock systems, and safety considerations of locks. ~ (4) the locking of emergency exits to prevent entry from the outside [73.46(e)(2)] Due to the need to make this a publicly available document, inspection techniques are not addressed because of the sensi- Power reactor licensees are subjec t to the provisions of section tivity of the information. 73.55. Specifically, this section calls for
x
1 NUREG/CR-5929 ,
! ! .- - -. - - - . - - - . - - .. - . . -~
2 The Role of Locking Systems in Physical Protection and Control
Four elements form the foundation for an effective physical element since any delay scheme can be penetrated eventually, protection system. These elements are Without detection, the response force would not be alerted. Communication systems are necessary to make sure that the (1) detection and assessmant systems that detect and verify right people have accurate and timely information. Delay any unauthorized intrusion atten.pt by outsiders or any elements should provide sufficient time after detection for serious malevolent acts by insiders or outsiders communication and arrival of die respome force. Finally, the - response force should be adequately prepared to neutralize (2) communication systems which ensure that all pertinent adversary actions, information is transferred to the point (s) where appropri- ate action can be taken Inks are important elements in the delay system of a facility since they secure the moveable portiom of barriers. However, (3) dday systems that impede continued adversary penetra- no lock should be depended upon as a stand alone means of tion into, or exit from, the area being protected physical protection. Given sufficient skill and time, all locks can be defeated. (4) resmnse systems, or forces, that counteract adversary activity and neutralize the threat !n all applications, the design goal is to have the lock delay capability match the penetration resistance of the rest of the These elements are equally important and none of them can be secured barrier. It does not make sense for either security or eliminated or compromised if an effective physical protection economic reasons to select a lock w hich is either significantly system is to be achieved. Detection, w.tich encompasses not stronger or weaker than the rest of the barrier, only intrusion detection but also entry control, is an important
,
3 NUREG/CR-5929
. _ . . . . - . - ... ---
3 Lock Technologies
ne purpose of this section is to provide detailed mformation shrouded. shackle padksks. Iligh security models are used to - on commercial kick technologies. This includes the basic secure safes and security containers. design and its variations, uses, pros and cons, design features - which affect security, and standards and specifications. This 3.1.2 liardware Description information is supplied for key krks; combination locks; mechanical and etectncal bolts, strikes, and latches; mechani- Key locks are locks which operate through the use of a cal coded k)cks; electromagnetic locks; and self contained mechanical or magnetic key. Use of the correct key allows , electamic locks. retraction of the bolt or latching mechanism granting access. Most key locks fall into four general classes: warded locks, = De time and skill required to defeat a k>ck are significantly wafer (or disk) locks, pin-tumbler lacks, and lever locks, in afTected by the type of kick. For instance, key locks are addition, key locks also include some urique options and typically less secure than combination locks because the variations of these general classes of locks. Each of these lock keyway leaves the lock mechanism more exposed. Conve- classes and their options and variations are discussed in the nience options, such as master-keying and removable cores, following subsections, further decrease security. Padkicks are in general more vul. nerable to forcible attack thaa locks which are protected by a 3.1.2.1 liasic Designs security barrier. While some generalizations apply, the rela- tive vulnerabilities will depend on the specific designs being Warded Locks considered. Warded locks incorporate fixed wards or obstacles (extemal Surreptitious defeat of a kick usually requires a thorough ar.d'or internal wards)in the lock structure which a key has to knowledge oflock construction as well as some level of attack clear in order to rotate and operate the bolt or latching mecha- skill, in addition, special tools (which are available commer- nism. De key for a warded lock has ward cuts placed at cially) are frequently required. Defeat metints which are designated locations to allow key mtation. Figure 3 1 illustrates more forcible require less knowledge of kicks, while purely a typical warded lock with the correct kry inserted and with an - forcible defeat requires no lock knowledge, incorrect key inserted. Warded locks were once popular as door krks and may still be found in some older hotes and residences. Defeat times vary greatly depending on the type of attack. Currently, most warded ktks manufactured in the United States Often, longer surreptitious and forcible defeat times result when unique features are designed into the locking device. These features are described in detail in this section. 6 d shackie /
-- - 3.1 Key Locks wma , , | g,i,,,, Want * ( [3,im,spnog J[ (spnaa t This section covers all types of key-operated k)cks, including werd. 6 ward ] ' door locks, cabinet kicks, ,adkxks, and locks for security Cut ' L. R n roat containers. , ' Thrmi cut or - ' cut ,O Txternal Ward -OO # 3.1.1 Uses kev O "#" ***" Permanently mounted key-operated locks are found in all applications requiring levels of security from minimal to high. Figure 3-1. Warded h>ck - They are found in container kicks, door and cabinet locks, and switch locks Key k)cks typically are pie primary devices are padkicks, Both the padkick and the warded door kick are safeguarding the secured item or volume. They are not typi- easily picked. In addition, warded skeleton keys (passkeys) are cally used to actuate another securing mechanism' casy to fabricate and are readily available through commercial 5"""" Key. operated padk)cks are found in quality levels and grades ranging from low security warded key kicks to high security
5 - NUREG/CR 5929
-_ _- ___ -. ~ . . - _ - - _ _ ._ - --~ ~ -- -.- - ~-- ---.. --.-.-----
Lock Technologies
Since the warded lock cannot be keyed with a master key, it their standard form, pin tumbler locks are also vulnerable to has limited usefulness and versatility, if a warded lock is picking and impressioning. compromised, it should be removed from servi.e since it cannot be secoded for a different key. De standard pin-tumbler lock, shown in Figure 3-3, consists of a cylinder case which contains a cylinder plug or core.The Wafer Locks lock case houses several small, spring loaded pins placed in line and extending into the keyway. De top (or driver) pins Wafer locks were invented in the United States in the late are forced down by the springs into the plug to prohibit plug 1800s. Their low manufacturing cost and mass production rotation. The cone-shaped end of each bottom (or key) pin capability have led to the widespread use of wafer locks for rests against the inserted key;if the key is properly cut, it raises many different applications: locks for luggage, showcases, the break between the top and bottom pins so that each break
desks, cabinets, and some types of padlocks and switch locks. is even with the outer surface of the cylinder plug (shear line). 1 Wafer locks offer better resistanee to pic king and impressioning When the pins are thus aligned, the cylinder plug can be than do present-day warded locks. Master-keying of wafer rotated. lxks is possible; however, only 200 to 500 usable combina- tions are available. These locks can be rekeyed, but, due to their low cost, replacement of the lock is more practical.The M"d"C" g ynp no wafer lock, shown in Figure 3-2, consists of a cylinder plug or o 3 / twuorn core which is held in place by a stack of spring-loaded, flat } !I ha ~ ' / metal wafers. Each wafer has a rectangular cutout in the center ' s "- through which the key needs to pass; the ends of the wafers O protrude from the cylinder plug into the cylinder housing. sur une When the proper key is inserted into the lock, the wafers are ege,r nu, cmect Kev aligned so that none protrude from the cylinder plug, allowing 4 Top ha the plug to rotate within the cylinder housing. y qqga; / Bagn" J u 3 | b y g -- - a pn /
, (~ 9 = Wafer Wafer = \ Shear Lm.e cpuuter case incmect Kev . o 4 -1' e ) Figure 3 3, Standard pin tumblerlock Cylinders ' Plug \ K'I llole Shear Line -*I # [[ydy fi$,"ing Pin tumbler locks are usually manufaceired to high tolerance Conect Key specifications and offer a number of different possible key codes.They can easily be master-keyed for tens of thousands Shear Line of possible combinations. Very complex master-keying sys-
, tems can be developed using pin-tumbler locks, The pin-
' Ql tumbler lock is widely usea in the United States in padlocks \( ,g and door locks, and for special applications. / Lever Locks shear Line
" * ' ' "" Lever locks originated in Europe in the late 1700s and are still widely used. In the United States, their principal application Figure 3-2. Wafer lock s in locks for post office letter boxes, pay telephone coin - boxes,' safe deposit boxes, and several types of padlocks. # "* E " "E' Pin-Tumoler Locks E
#"" ## * " '#"" Y Pin-tumbler locks, patented by Linus Yale in the late 1800s, ."' " '## * 1 C ndng ps n en N y ac ng h offer more security than warded or wafer locks. However, in
NUREG!CR-5929 6 ,
------. -- - .- - . - . - - . - - - . - . - . - . - _ _ . - - - . . -. .-
. ;
lock Technologies
levers. De lever lock is usually limited to a simple master- 3.1.2.2 Master Keying keying system unless it is master-keyed within the key, Master-keying is an option in the keying of a set of similarly 'the operation of a typical lever lock is illustrated in Figure keyed kicks to open with a common key, While other types of 3+4. Several flat metal levers (or tumblers) are attached by a locks can be master-keyed, only the pin-tumbler plug mecha- pin to a common point at one end of the lock in such a way that nism is designed for comples master keying. For this reasuri the levers are free to swing slightly and are positioned so that the pin tu mbler kick is very popular.The pin-tumbler lock nm rotation of the key exerts a force that retracts the bolt. Each of be master. keyed by splitting the bottom pin or pins inb two the levers has a rectangular gate cut in the free end. The bolt or more segments (tr ster wafers), thereby allowif d more has a protrudmg fence w hich rests against the free ends of the than one shear sine to become available. This ranciple is levers to prevent retraction of the bolt w hen it is kicked. When i'.!ustrated in Fig:re 3 5. the correct key is inserted and rotated, the bitting or key cuts i on the key elevate the free ends of the levers so that the gates are aligned, thus permitting the fence on the bolt to enter the
gates. After the fence enters the gates, bolt retraction is , completed by further key rotation. f Shear ljne ~ . "y< ge', 1 H O - Spnng C Indmdual llouung s',-}% gg Clunge Key MN4 i i V . } j | j - Bolt - - 1.eur - ' # >: $ heaf line . - a ,1 % N , - p Master wdr , Wat,er j
t e n ,, h a ter Key - t.evene fine n j G418 K'I 08| Gate ** Figure 3-5. Example of pin splitting for master keying j _--- i, 4- . _ . n - t Kev inenryn gcy As the number of master key levels increases, i.e., master, Figure 3-4 Leser hick operations grand master, etc. (see Figi.re 3-6), so does the number of splits required. This affects security in several ways:
Large lever locks are commonly used in prison security (1) The probability that a lock can be compromised by ' applications. These larger kicks are resistant to picking, pri- picking or impressioning increases sharply with increas- marily due to their massiuness and the strength of the springs ing levels of master-keying, on the levers. A further refinernent incorporated into some lever hxLs requires that the key be tumed several times in (2) The number of usable key codes sharply decreases with order for the bolt to be completely retracted. In this case, a lock increasing levels of nwter keying.%is occurs because would have to be picked once for each required key rotation- key codes have to be set aside for each level of master-
' Another feature incorporated into some Ic ver kicks to merease resistance to picking is the use of serrations (teeth). lf the fence (3) If key codes are not assigned systematically, a key w hich prematurely contacts the end of the lever tumblers, as it needs is not intended to work in a given kick could accidentally to do if an atterspt is made to pick the krk, the serrations o" work. The more levels of master-keying, the more likely the levers engage similar serrations on the fence and prevent this is to happen. the movement necessary to align the gate.
7 NUREGICR-5929
.. -. . _ - - . ,_ - . - - . _ _ - -__-__-______-__-_---_ _ - __ _ -- i
1.ock Technologies
(4) Imss or compromise of a master key affects many locks. valid impressions necessary for entry as well as false impres- sions. An example of such a master key is shown in (!) Increasing levels of master keying make the lock more Figure 3-9. This key cannot be duplicated on standard dupli- complex. It is likely that it will be more difficult to cating machines, maintain, and is therefore more vulnerable.
Surergreat e pr y s Grand Muer Key J n 5 Shear Line ._. 0 ._ .. d i i 1 0 /
, t __ _ __ C 'a*Ie$ef Ring and .] Grand Master Key ; ( ------_ g ;, n 4. c.,.,ss ] Master Key hbter Key
Indmdual Change Keys
Figure 3 6, Master-keying system h j Shear Line , ,- ia , / The picking vulnerabilities inherent in conventional master- , f Plug keying have created 3 widespread need for more sophisticated ( Rotates key cylinders. Several cylinders are available which provide l
, __ . __ j -. ' greater security than those previously discussed. An example of such a sophisticated cylinder is the bicentric cylinder (see N e Kev Figure 3-7), which is constructed of two separate rotating plugs. One form of this lock requires two keys for entry. A Figure 3 8. Master ring second option allows entry through the use of either an individual change key or a master key, No degradation occurs within the first level of master-keying.
[ Change Key / Cylinder Plug Cylinder j Case g aStcr,, K( Figure 3-9. Self-contained master-keying key
Figure 3-7. llicentric c31i nder Keying Alike
Another method of first-level master-keying is accomplished An altern tive to master-keying is keying alike Keying alike through the use of a master ring formed around the regular is the identical keying of several different locks to one key by plug. The addition of this ring results in the creation of two the use of identical pins for each lock Although this method shear lines (see Figure 3 8). gf keying does not generate the multiple shear line vulnerabil. ity of master-keymg, it does allow each key-holder to htye A fourth method of master keying provides for keying within "'#"ss t m re than one lock. the key, rather than within the cylinder Since master-keying 3.1.2.3 Proprietary Systeru is not f.ccomplished in the cylinder, the total system cannot be defeated by simply disassembling the cylinder in order to determine the key combination. In the multirow radial pin- The only readi.ly available proprietary system is one in which tumbler design desenbed later, the master key contains all hive keyway is used. An agreement may be made with
NUREG!CR-5929 8
__-_ . - - _ _ - . - - - . . -- - . . ~ . -
lock Technok>gies
the' manufacturer to provide the exclusive keyway only to standard straight cylindrical pins of the pin tumblerlock can specified customers. increase its resistance to picking; lever locks which employ false gates are also less susceptible to picking (Figure 3 11). Keyways are keyholes designed using wards or obstacles Such variations are used to confuse individuals attempting which increase the master keying capability of a locking surreptitious entry and increase the amount of time required system. bamples of different keyway cross sections are to defeat the lock. shown in Figure 3 10.The term" restricted keyway" refers to the option offered by some manufacturers in which a particu- Tubular locks lar keyway eross section is exclu sively assigned w i customer, and blank keys with that cross section are sold, as authorized, 'the tubular kick, shown in Figure 3-12, uses a round key to to that customer alone. Restricted keyways are often used to - depress the concentric pattern of pin tumblers projecting restrict entry in a given keyed section of a total master 4cyed toward the face of the kick, %e tubular hxk has been used facility. extensively in the past, although acceptance of this kick for , sensitive applications has decreased recently, This is prima. rily d se to the appearance on the market of pick tools taikM especially to this type of kick.
----Key UNC3 I[
, M Shear 1.ine mas.1
. b - Figure 310. Keyway cross sections
Figure 312. Tubular kicks
3.1,2,4 Other Key Imel. Options and Variations Dual Pin Action
Pin and 1,eser Variations Some pin-tumbler kxk cylinders require th at the pins, in
. addition to being elevated to the shear !!rs, also be rotated to A nu mber of features or principles have been used to improve a proper orientation to increase pick and impressioning resis- the standard key kxk d::,ign. For example, variations in the tance.This dual pin action is accomphshed by the use of key cuts that have varied angles and depths. A comparison be. SPma ** tween a standard, one. motion pin tumbler kick and key, and Dme Pm a dual, or two-motion, system is shown in Figure 3-13. MauerP.a 0 0 8 0 Ke> tw 0000 " "' ' ' <"" " " d ' ' "i " -'" - 6 'e r '"< '" Stand- Mush-. Spool Spol ed room Master Key Another unic,ue method of k eying the pin-tu mbler ksk entails Pm - Dm' Pm ha the use of pins arranged radially in the cylinder so that the pins " rest on more than one surface of the key, as shown in Figure g, 3-14.This type of k eying produces a smooth profile key rsier d em , than the traditional sawtooth key. The key contains .limples t uer krated on the sides of the key to position the pins to their , ! proper depth. Elecause more key surface contact is available, + the number of pms contained within the cylinder can be %% increased and therefore can increase pick resistance. J- Figure 3-11. Pin and lever var'a. ions
9 NUREG/CR-5929 lock Technologies
Top Pi" "^. .. the key is inserted and rotated, the disk notches align, allowing . a locking bar to drop into position. This action frees the g 4 y otherwise constrained plug containing the disks and allows g'[ CylinderPlug the plug to rotate. An example of the tumbler disk lock is ' Bottom _ shown in Figure 3 15. Pin
.< Standard ne ;f Ty p ey One-Motion Kev / Key Cross Sectiv) / g
Top and Douom / - ' Ipterlocking Pins D hk teckingBar / 3h 'y %@ }-. s / ;[ O Plug sleeve .% i s A q 6 ,. - ' Cylinder ' 7 One Disk + 1 Plug q si m ing Jii _..(Caw Two-Motion Kev (lock Face Removed for Claruy) Key Cross Section
Figure 313. Standard and dual pin tumbler keys and Figure 3-15. Rotating tumbler disk hn:k cylinders
Removable Core Locks
7 a The cost of lock hardware becomes a predominant factor in lock selection when several hundreds or thousands of pad.
_ , locks and door locks need to be quickly replaced or rekeyed. . . ; Removable core locks are often used by large facilities be- ( | cause they can be exchanged expediently. During the ex- - | change procedure, the entire key mechanism is removed and smoothNey Pmfile Conventional replaced with a differently keyed core. Ris operation requires saw-Tooth Pmtile only seconds to perform. Removable cores can be retained within the lock in several different ways, as shown in Figure V [ Key# Cmss sectiontr my 3-16. " p :q p? -
-- 3.1.3 Application Considerations wF. . -*-
_ fg s i 3.1.3.1 Pros and Cons Radially Keyed straight Line Cylinder Keyed Cylinder The major feature of key locks, especially pin tumbler locks, is their adaptability to many levels of master-keying. The advantage of this adaptability is increased convenience; the Figure 314. Standard and multirow radial keys and disadvantage is reduced security. For each level master key cylinders incorporated into the design, an additional shear line has to be designed into the lock. For each additional shear line the mechanical structure of the lock is weakened and the suscep- Rotating Tumbler Disk Locks tibility of the lock to picking is increased.
Rotating tumbler disk locks are highly pick-resistant locks which operate using a specially cut cylindrical key that rotates individual disks in the cylinder to different turn angles. When
NUREG/CR-5929 10
. ~|
lock Technologies
Rernoval Spdng-tended Set Scatw Pin tumbler locks are more secure than warded or wafer locks threction Detent tkient because there are thousands of possible combinations. Sev. cral design variations covered in section 3.1.2 increase resis- O A A [- tance to picking and impressioning. a m 9 g | ( T:'- ( For several reasons, the most secure key operated loc'k is the L.)'- ij } * g e y- , lever lock. First, lever locks are less frequently used in the '' 7 ~i S . i United States than pin tumbler locks. Therefore, attack meth- ods are less well known. Second, pin tumbler locks allow , ..Q,R emovd Q * * " " more levels of master-Leying. As discussed in section 3.1.2.2, I k master keying increases vulnerability to attack. Third, lever locks can be designed so that multiple tums of the key are
, , required ta fully retract the bolt.This increases pick resistance
' ID ' because the lock must be picked once for each rotation of the ~ key, While this feature could be designed into a pin-tumbler T q loc k, it is not a typical design. Fourth, the pin tumbler lock can * * 1 1 be attacked by forcibly pulling the cylinder (con -pulling). Removal Key- Once the cylinder is removed, the bolt can be easily retracted. claMe Dirceuon The lever lock does not share this vulnerability.
Locks can be made more resistant to picking and forcible Figure 316. Removable core key mechanisms attack by increasing the site and strength of materials-
Master-keying seriously compromises the security of a sys- Another advantage of key locks is the wide range of designs tem (see section 3.1.2.2). An awareness of the trade-off available. From this pool, an appropriate loc k may be selected between convenience and security is necessary in making to fit almost any set of design cons traints and security require- decisions about where master-keying would be appropriate. ments. Other advantages are the short time interval required to operate a key lock, and the elimination of the need to memo- The security of the pin tumbler, wafer, and lever designs may rize a multi-digit combination. be augmented by increasing the number of pins, wafers, or levers ULStandard437 specifies thatdoorlocks andlocking Additional disadvantages of key-operated locks include the cylinders have a minimum of 1000 key changes possible, necessity to. maintain replacement parts for changing the while key locks intended for security containers must have a keying of the lock; the need to track and control possession possible 1,000.000 key changes. For dual-key security locks, and duplication of keys; and the vulnerability of key-operated M guard key and 15,000 user key changes are required by this lecks to surreptitious attacks. specification.
Some methods for defeating key locks are picking, decoding, Cabinet door and drawer locks covered under MIL-L 289BD, impressioning, x rays, impact vibration, bolt manipulation. and padlocks covered under GS A Commercial item Descrip- core removal, environ mental and chemical attacks, and force. tion A-A-1930A, are required to have at least 1200 key These methods are described in the Glossary, changes available. Medium security padlocks specified_in MIL F-4395 l A, and high security padlocks specified in MIL- 3.1.3.2 Design Feutures Which Affect Security p.436070, are requ ired to allow 100,000 differers key changes.
When assessing security of key-operated locks, the single Another factor affecting the 3curity of key-operated locks is most important aspect is the design of the lock. Typically, the the distance the bolt extends from the lock body (the" throw") warded lock is icas t sec ure for threc reasons: it is easily picked, . when it is lobked. These requirements are specified in the it can be opened by a skeleton key, and the lock cannot be applicable specifications (section 3.1.4). recoded.- Wafer locks offer better resistance to picking and - impressioning than warded locks. Ilowever, the typical num- - Still another security feature for key locks is that the key not ' ber of possible combinations,200-500, is low compared with be removable when the lock is not secure.This makes it more the more secure designs. difficult for a lock to be left unsecured,
1I NUREG/CR 5929 - .- . ~ _ ~ ~ - - - . - - . - . - . - . - - . - - - _~ ~ - - . . . - -
lack Technologies -
. Specific design features which affect security are included in This spncification defines two series of key.in-knob design section 3.1.2. locks: the series 2000 and the series 4000. The series 2000 L preassembled locks and latches mount in a slot cut into the i One security feature offered on some padlock designs pre- door edge. The series 4000 bored kicks and latches mount in i y vents the shackle from being fixed in position unless both ends holes bored through the door. Bree grades of lock are i of the shackle are inside the lock case. Padlocks are usually defined: Grades 1,2, and 3, with Grade 1 being the highest monitored by pulling on the lock case to ensure the shackle security. Series 2000 locks are available in Grade 1 only, does not come out. If the shackle can be 11xed in position w hile seties 4000 locks are available in all three grades. " outside the lock case,it could feel as if the lock is secured when it is actually open. This feature is particularly important in Wirteen types of preassembled locks and latches are de. applications where the lock is difficult to visually inspect. scribed, with appropriate functions and function numbers for each type oflock. Nineteen types of bored latches are similarly The shackle should also be designed so that a positive pull is described. Testing methods and required results are specified required to remove the shackle from the lock body. A spring- for operational, strength, cycle, material evaluation, and fin. loaded s hackle makes it easier for someone using surreptitious ish testing. , techniques to attempt to gain unauthorized access. If the I shackle springs open, it takes less time for each successive This specification may be obtained from the Builders Hard. | opening attempt. ware Manufacturers Association,Inc.
3.1.3.3 Other Factors Which Affect Security ANSI /IlllMA A156.51984 American NationalStan. dard for ausiliary h>cks & associated products - Factors such as wear and tear, corrosion, and lxk of preven- tive maintenance can affect the security of a lock. Part I of this standard covers auxiliary bored and mortise locks, rim locks, and cylinders. Security tests, operational For example, a failure can be made credible, if a lock is tests, finish tests, and dimensional criteria are included, broken, it could be attributed to the condition of the lock, Part il of this standard establishes requirements for exit alarms rather than an attack. Furthermore, an adversary could forc- and locks, electric strikes, and indexed key control systems. It ibly open the lock, then s ubstitute a non-working replacement also includes operational and finish tests. lock. The following is a summary of Part 1. Other parts of this An adversary may also be able to open the lock more easily if standard are reviewed in the appropriate section of this the !ock is worn Wear can cause parts to fit more loosely, NUREG. allowing picking tools to be more easily inserted. Part I contains pictures and descriptions of many types of: Finally, a poorly maintained lock can be difficult to open by locks,- describes various lock parts, and provides a good an authorized user. When a lock is difficult to open, it is also overview. Other specifications are referenced for details, difficult to verify that it is locked, introducing still another I vulnerability. Three operational and security grades are described, with . Grade 1 being the highest. Test equipment and methods are i- 3.1 A Standards and Specifications specified. Operational tests include torque, force, minimum ' prdection of latch or bolt, warped door, bolt strength, axial: See Appendix A for addresses and telephone numbers of the load, vertical load, cycle tests, and finish tests. Security tt.sts organizations from which these standards and specifications include impact, tension, torque, bolt sawing, and bolt pres. may be obtained. sure.
3.1,4.1 Permanently Installed Key Locks Cylinders are required to be of the pin tumbler type, with at least five pin tumblers. There are specific performance, - ANSI /IlllMA A156.21989 American NationalStan, strength, operational, picking, and cycle tests on cylinders, dard for bored and preassembled locks & latches The part numbering scheme describes how to specify what ; His standard establishes requirements for bored and preassembled you want to purchase. The numbering scheme describes laks end latches. %e standard includes performance tests, stamgth material, type of product, product function, and grade. tests. operational tests, finish tests, and dimensional criteria.
NUREGICR 5929 12
- - - ______- _ _ _ . - -_- - .- .. .- | lock Technologies
This specification may be obtained from the Buildera 11 aid- The standard describes series 1000 mortise locks and latches ware Manufacturers Association,Inc. in three security grades. Grade 1 is the highest operational and security grade De grade in operational classincation must be ANNI /IlliM A A156,1l-1991 American National expressed separately from the grade in security classification. Standard for cabinet locks his appears to be different from the other ANSI /BIIMA specincations. Twenty four different types of mortise locks nis standard describes the requirements for cabinet locks are desciibed, with appropriate functions and function num- used on doors, drawers, and furniture. Included are descrip- bers for each type, tions of use for eight different types of cabinet kicks which may be supplied in three security grades. Grade 1 is the highest his specification may be obtained from the Builders Hard- security and operational grade. Testing methods for opera- ware Manufactuters Association,Inc. tional, strength, cycle, and finish tests are provided, as w ell as required test results for the three grades. Mll L-2898D 1,ocks, Flush, Metal and Wood Door and Drawer, Naval Shipboard pictures and descriptions of many cabinet lock designs are included.The part numbering scheme describes how to specify This specification covers metal and wood cabinet door and w hat you want to purchase.The numbering scheme describes drawer locks for Naval shipboard use. Materials and construc- material, type of pmduct, product function, and grade, tion are specified, as well as required dimensions and toler- ances. Each lock is required to have 1200 possible key This standard may be obtained from the Builders liardware changes. Type "A" locks, for use on doors, must have a Manufacturers Association, Inc. deadbolt and must have three or more levers or pin tumblers. De bolt must extend 1/4 to 5/16 inch when engaged. Type ANSI /HilM A A156.121986 American National " B" kicks, for use on drawers, have similar requirements, with Standard for interconnected hrks & latches a bo't throw of 1/4 inch. Other specifications are concerned with workmanship, quality, and packaging. This standard establishes the requirements for interconnected locks. Aa interconnected lock is one which has a separate, This specification may be obtained from the Defense Printing mechanically connected latch, deadlatch, or deadbolt. The Service. latch or bolt is designed for installation in the edge and face of a door stile. The standard includes operational tests, security UL 437 - Key locks tests, cycle tests, finish tests and dimensional criteria. This specification covers door locks, kicking cylinders, secu- The standard also defines series 5000 interconnected locks rity container key kicks, and two-key locks. Specifications - and latches in three security grades Grade 1 is the highest include construction, materials, number of key changes, and operational and security grade. Twelve types of locks are testing. Test requirements include salt spray corrosion, endur- described, with appropriate functions and function numbers ance, and attack resistance. for each type of kick, For endurance testing,10,0m complete kick / unlock cycles at This standard may be obtained from the Builders liardware a 50 cycle-per minute rate must not degrade the performance. Manufacturers Association,Inc. For those designs incorporating changeable cores,50 changes of core or key must not degrade performance. ANS!!HilM A A156,13-1987 American National Standard for mortise h>cks & latches Door locks and kicking cylinders must have a minimum of 1000 key changes possible, while key kicks intended for This standard establishes requirements for mortise lacks and security containers must have a possible 1,000,000 key changes. latches. Mortise locks or latches are those which are installed For two-key kxks, M guard key and 15,000 user key changes in cavities prepared in the edge of a door, with access to the are required by this specification. lock for key cylinders and knobs provided by holes bored through the door. The attack resistance testing method describes tools permit- ted, and specifies time requirernents during which the kick The standard includes operational tests, security tests, cycle must successfully resist eight different types of attacks. tests, finish tests, material evaluation tests, and dimensional criteria.
13 NUREG!CR 5929 Lock Technologies
his specification may be obtained from Underwriters Labo- References to other applicable standards and documents are ratories, Inc. included,
A-A 1932A Commercialitem Description, Lock Set, This specification may be obtained from the American Soci- Rim ety for Testing and Materials.
This commercial item description covers rim type lock sets for MIL-P-43607G . Padlock, Key Operated,Illgh Secu- residential and industrial applications. Wey must confor m to rity, Shrouded Shackle ANSl/BilM A A156.5.They will use a key on the outside and a thumb turn on the inside, ne locking mechanism can be a This specification defines a key-operated, high security, latch, bolt, deadiatch, or deadbolt. Each lock must be indi- shrouded shackle padlock that employs a changeable cylinder vidually keyed. Key blanks are, in general, commercially and a dead bolt locking mechanism. ne padlock must use a available. proprietary military keyway which has a control key for cylinder removal. Padlocks must be keyed individually. ~ Other requirements include finish, workmanship, quality as- surance, packaging, and mark ing. Ordering data, which should included in this specification are requirements that define be included w he n purchasing to this specification, is included. materials, design, quality control, and testing. %c padlock must be capable of 100.000 different key changes, and keys his specification may be obtained from the Defense Printing must be marked "US MILITARY PROPERTY - DO NOT Service. DUP."
3.1.4.2 Key-Operated Padh>cks Requirements for shackle pull out resistance, heat resistance, low temperature operation, salt spray resistance, drop resis. ASTM F 883-90 Standard Performance Specification tance, wear resistance (10,000 cycles of operation), shock for Padlocks resistance, and corrosion resistance are included.
His standard contains environmental, functional, operational, ne lock must withstand surreptitious entry attack for not less and security requirements for both key and combination than 15 minutes before and after the wear resistance cycling padlocks, included are function descriptions, cycle tests, test. For forcible entry testing, a list of permissible tools is operational tests, environmental tests, forcing tests, surrepti- included. He lock must withstand five minutes of attempted tious entry tests, and a glossary of terms related to padlocks. forced entry. ' Six levels of padlock performance criteria are defined, with - level 1 the lowest grade and level 6 the highest Keys are also specified. Operating keys are used to lock and unlock the padlock and must not be capable of rotating the This standard does not include criteria for specially made cylinder. The control key, however, must be capable of padlocks used by the Department of Defense or others in rotating the cylinder so it can be removed. Specifications highly sensitive locations, include hardness, deformation resistance, shapes, bit cut, and marking. Tests for key operation and key integrity are in- Forcing tests include specific instructions to conduct a tensile cluded. test, a drop test, a shock test, a cylinder plug pulling test, a cylinder plug torque test, and a shackle cutting test. Also incluoed are defect inspection lists and requirements for marking and packaging. Surreptitious entry tests require the padlock to resist entry for a period of time contingent upon the grade. Areas covered This specification may be obtained from the Defense Printing include picking (key padloc ks) or manipulation (combination Service. padkx ks); cylinder impres sioning and decoding; shac kle shirn- ming; cylinder drilling and shimming; and rapping. MIL P 43951 A - Padlock, Key Operated, Medium Security, Regular Shackle Environmental tests include salt spray for corrosion resis- tance, dry contaminants, ultraviolet radiation, and wet freez- This specification is very similar to MIL-P-43607G. The ing environment. subjects covered are the same, but some major differences between the two specifications follow.
NUREGICR 5929 14
- - _ _ _ - _ - _ _ - - .. - . _ _ _ . _ . . .. __. .- ______. _ _ _ _
lock Technologies ,
. His specification covers a medium security, regular shackle 3,2,1 Uses padlock. Mll P-43607G covers a high security, shrouded shackle padlock. This specification has some additional tests Permanently mounted, dial type combination locks are typi- for cylinder plug pulling resistance, cylinder plug torque, and cally foured in applications requiring medium to Qh security shackle cutting resistance. The lock must withstand four such as safes, security files, vault doors, and other security minutes of attempted forced entry. MIL-P-43f070 requires containers. In high security applications, they are usually not five minutes. the primary securing device for the container. Instead, the bolt on this type oflock will typically t.e used to prevent operation This specification may be obtained from the Defense Printing of a series of bolts or pins which do the actual securing of the Service. container (see Figure 3-17). His arrangement serves two parposes. First, the container is secured at multiple points A A 1927C Commercialitem Description, Padlock (Pin around the perimeter of the closure, providing much higher Tumbler Mechanism) resistance to forcible entry. Second, the bolt of the combina- tion lock is protected by the secure container, providing an This specification covers key-operated, pin tumbler, deadbolt extra level of protection against an uttack directed at the lock padlocks intended for low security use. Padlocks supplied itself. under this specification must conform with applicable re- quirements of ASTM P 883, Grade 2. outsido of safe
==m The s}ecification includes requirements on case and shackle p - M.u.s - ..a u.v.m m Rotation hardnes s, shac kle design, dimensions, nu mber of pin tu mblers Locking '- (ranging from four to five, depending on padlock size), Bar* materials, number of possible key changes (ranging from O I T ' 3000 to 10,000, depending on padlmk site), corrosion, part | Ce_ ow ] numbering, and quality assurance provisions. !! %f O _ O. i J % O \ Padlocks may be keyed alike, keyed individually, master. , Lock B 'I keyed, or grand master keyed. Ke, s are generally made from gocm M y key blanks which are commercially available. Ordering infor. Reces inside Edge g mation is included. ]d +-Edge of Drawer __, ,_7-~ of Safe $j *-- Edoo otDrawer Fn b This specification may be obtained from the Defense Printing ix- - q Service. , m7
A A-1930A Commercialitem Description, Padlock - Figure 3-17, Typical arrangement of lock holt and (Disk or litade Tumbler) locking hars on a safe This specification covers key-operated. disk or blade tumbler i padlocks intended for low security use. Padlocks supplied Combination padlocks are used as stand-alone devices in low under this specification must conform with applicable re' to medium security applications. They are also used in high quirements of ASTM F 883, Grade 2. security applications in conjunction with other security mea- sures.This type of lock is usually the primary securing device The specification includes requirements on shackle design, of the container.Because of the vulnerability to direct physi- dimensions, number of disk or blade tumblers (10), materials- cal attack, combination padlocks should not be used in high nu mber of possible key changes (1200), corrosion, and quality security applications unless other security measures are used. assurance provisions. In situations where it is important to know if the lock has been This specification may be obtained from the Defense Printing defeated, it is appropriate to use a lock which has a high level Service- of tell tale to unauthorized entry. This is covered in section 3.2.3 and in the Federal Specification on Changeable Combi- 3.2 Traditional Combination Locks nation Padlocks, FF-P-1100.
This section covers mechanical dial combination locks.
15 NUREG/CR-5929
- -- .- .- . = - - . -- -, . - lock Technologies
3.2.2 liardware Ikseription i,,er son % /7
Combination locks are incorporated into padkrks and door e locks. They :ange from simple locker-room variety pad!ocks *\ / rence to highly developed security vault door locks, liowever, the f \ basic principle of operation is the same for a!! combination N'' Cam SP indle I"d'* M*'k krks. onve pin [ Dial Ring cate j The dialis usu ally divided into sections marked with numbers. ny / I An inde s mark (s)is located on the door lock dial ring or, in the * * "I *W P"'' case of a padlock, on the padlock body, in the door lock, the pg dial and dial ring are usually the only visible portions of the p, tyi lock, Whe n the dial is rotated, its motion is transmitted to code w heels krated within the lock case Correct positioning of the wheels aliows the bolt to be retracted. ,p Shackle ne combination dial is attached to a spindle (shaft) which, in
turn, is attached to a drive cam. (See Figure 3 18). When the / dial is rotated, the drive cam rotates. A drive pin projects from tever the flat surface of the drive cam and from each driving wheel. N (N Dok mye cam g As the dial rotates the drive cam, its drive pin contacts a fly , (limited-motion pin) on the wheel closest to it, causing the *' wheel to rotate around the wheel post. The drive pin on the "" J n ' P "" opposite side of the wheel contacts the fly on the next wheel, of rotating this wheel abo. This continues until all wheels are in ' inacquart C , , q/" motion. De wheel farthest from the drive cam aligns on the ww po,, first combination number and is teferred to as wheel number spindi. 1. The direction of dial rotation is then reversed to align the second wheel on the second combination number, etc. rwnri DW
The drive cam and each wheel have a gate cut in their Figure 3-18, Combination lock mechanisms circumference. When the correct combination is dialed, the gates of each wheel and the drive cam gate are aligned. The fence moves into the aligned wheel pack gates,. and a lever Lever Stop Mounung Ilotes attached to the bolt is allowed to nest its nose in the drive cam \ gate, in door lock configurations, continued dial rotation ow - retracts the bolt into the lock case. Padlocks require a pulling Dee - action on the shackle for lever nesting and bolt retraction, of = nese features of the combination lock are shown in Figure 3 Fat 4ncation - 18. O m [,| CaDn Botr Track All combination kxks contain the following common subas- semblies: case, wheel pack, dial, and bolt. Key-change 11 te Breakaway , / Lines Lock Case O Thermal 12rk cases are usually zine-alloy die castings.ne combination sensor door lock case, which is sometimes factory dated, consists of a / N box structure and a rear cover plate. The case is typically cast C** * PS ' C""# with a lever stop, bolt track, and mounting holes.The cov er often contains a key-change hole, breakaway lines to hinder forcible punch attacks, cam stops, and thermal sensors. Numerous cas Figure 3-19. Case design, door lock designs exist. Figure 3-19 illustrates these door krk case features.
NUREG/CR-5929 _ 16 a
lock Technologies
'llecombinationptlktkisafxtory seakstunitnurkixiwidmoul Combination locks typleally have three or four cale whccis, i&ntifying serial nurnhen and its fatriciaion date (see Figure 3-20). 'lhere are as many w heels as there are individual numbers in the combination. For example, the combination i 1 34-46 has three distinct number sets and, correspondingly, the cornhina- tion krk which used this combination would have three A wheels.
Code wheels are usually balanced and constructed of metal or j ) metal and plastic, The rnetal is usu ally machined brass or a die cast alloy, Flastic wheels cre fabricated from Delrin or Lexan | Serial Number l| and are used primarily to provide x ray resistance, Gate ~ designs on the code wheels have varied over the years and m.g from company to company, Three common gate configura- ,,,,,,,, N Serial Number tions are shown in Figure 3 22. ..w .a e,.... 'A +- Date of Fabrication [
Figure 3 22, ''arious code whael gale designs .F_ad_ lock _
Figure 3-20 Case design, padk>ck . lock combinations are either fixed or changeable Most combination kicks have hand or key change combinations. Wheel Pack In order to change the combination in a combination hxk the angular position of each gate, relative to its drive pin, has to be 'He w twrl pick is assembkx! on a pwt, cast citler on tir rear cover changed in each wheel, m .i nside the tox case. *lle wteels am separatal by fim! speer washers and are usually leid under tension, as slown in Figure 3-21, if the combination is hand-changeable, changing the combi, Wheel pick tenskn v;uies fmm kick to kek arx!is a critical variable nation is a diffieuit and time-consuming task, and requires afketing wlrel vibration and case (or dimculty) of dial rotation, complete wheel pack disassembly, A tooth meshed whee 1 (Figure 3 23)ls the most common design usedin hand change combination ktks The w heel consists of a n inner and an outer ring .The drive pin is located on the inner ring, w hile the wheel Case IWt Retainer / , Spacer gate is cut into the circumferene,: of the outer ring.These rings have to be disengaged, rotated until the desired combination Code d Wheels is selected, and then re-engage <1 e s. -
Spring Washer Outer Rmg 04to I* C'* Rear Cover / ' ' 4 , R n7 ' Spacer Retainer
' da Mok
<1 1 s m .,,
' Code Wheels Figure 3 23. Tooth. meshed hand-change wheel 3 Washer Case post
led Case llole or screw hand change wheels (shown in Figure 3 24)are . found on less expensive hxks. In both types, the number of ""' b' 8"" Y '" '* ' "'' Figure 3 21. Wheel pack awembly P"S # " " N" ing the number of possible combinations.
17 NUREGeCR 5929. I | \
Lock Technologies
I . <
Rin; c.i. Cate r drive another wheel, a fixed drive pin. De My also helps f o / g, o o compensats for inertia loading, which causes torque failure AC o o o (slippage) between the inner and outer rings of the code wheel. o o o e y,, , Lockouts of ten result from wheel slippage. Figure 3 26 illus- o o , , p\ , ,A = trates the operation of the Dy. lYrfursted Wheel
1[ule annee Wheel &rtw (bnce Wher!
O O = fly Travel l'igure 3 24, llote and screw hand O , '.# if the lock combination is key-changeable, changing the o I combination is a simple task, requiring only a few minutes. " \ ne key c' nge code wheelis similar in construction to the ' " ,\h g hand-change, mesh toothed w heel. To change the combina. witsnut n, ny tion of a key change kick, the correct combination has to be C'*1' Wh"*' *ith I'' dialed, aligning each w heel keyhole. A change key is inserted f- into the rear case cover and outer ring of each w heel.The key (. - Nn c.rn is rotated, disengaging the inner and outer rings and allowing J Q the irmer rings to rotate w hile the change key secures the outer **3 dQ ~ Wh"I N" ha rings in position. The new combination is dialed, and each "# k._ h drive pin is moved to a new location with respect to its Dnn Cam Nn ha corresponding wheel pate. The change key is returned to its N " h " '"4 "' original position, engaging the wheel ring!:, and is then re- Nw ha ny moved. A new combination has been set. Y e Key-change locks are operationally convenient but are often A DY 8'"P' f more vulnerable to compromise than hand Nye hn Outer RMg QUM .I.M. My operation Outer Rity g se / Drin * #W sprins Dial Assembly Nor lock dial currently in use are divided into 100 equal . inner parts spread over 360* of the dial. Earlier dial models, some inner ning }%['----i Mah Ana of which are still in use, contain 100 equal parts but are spaced j , Rias Kepoie Keyhoiec m 4,e, in less than 360*, leaving a blank area on the dial face. This latter design was used to climinate Jamming within the lock Figure 3 25. to y change wheels during dialing of the last number in the combination. Today, ~ manufacturerf operating instructions request the user to re- frain from using a specified area (approximately 20 numbers) Another important part of the code wheel is the Oy, or limited, when setting the last number of a door lock combination. This motion, pin. lts presence allows 360* rotational use of the code problem does not e xist in padlocks, which typically contain 50 w heel by eliminating any voids or dead spots due to drive-pin equally spaced numbers on their dials, thickness. De fly is allowed to travel independently of the w heel, the width ofits own " head," and half the distance of the De door lock ring or padlock case usually has one or two drive pin before it begins to move the code wheel. This keeps index marks for dialing reference (see Figure 3-27).ne index the drive pin centered whether the wheelis turningleft or right, located at the top center of the dialis referred to as the'open Each code wheel has a Oy by which it is driven and, if it is to index"_ and is used for unlocking. NUREG/CR-5929 18 . -- . - -. . . __. __ - _ _ - _ _ _ - _ _ _ - _ _ _ , Lock Technologies [ # $P I!** K'Y Drive Cam \ ChangeIndet k [p Open Index ' I /- ' Dialkira A %mZ.s, . " i 3p,,,, % Dial + p Wthat g Durttiv reeneded , Open index Dial Ring ' 1 " f Sphne _ _ Drive Cam X Y ]Tg %J . . . I 7 I 0 car a j. - ""* - Ditt Ocar Ocat , espindle !?igure 3 27. Dial ~ > In&rrcity Connected To change the combination, key-change locks often have a second inde x, called a " change inde x," w hich is set to the right Figure 3 28. Dris e cam kication or lett of the open index. New combinations are entered by dialing the current combination on the change index, which aligns the key-change hole of each wheel u ith the rear cover lack Case tsver stop DfvP IEvet key-change hole for change key insertion,If no change index g rence /. is present on a key change lock, the open index is used by m,/ dialing a " change combination." These methods of keyhole " / alignment prevent unauthorized access while the lock is in the /', open position. / Spidies are usually fabrica ted from brass, zine alloy, or steel. Dnve cam /O . Padlock spindles are part of the dial casting, A door lock (,) _ spindle is usually a solid bar attached to the dial. De dial is connected to the drive cam either directly or -_ ~ indirectly (see Figure 3 28) l'adlock dials are directly con- , nected. Directly connected door lock drive cams are usually , / threaded onto a dial spindle and secured with a spline keyl ( Q - Indirectly connected drive cams are attached by a gear ar- * rangement.The drive cam is either placed between the dial and (b) j _ the wheel pack or behind the wheel pack. In addition to - Nested Wheel Pack providing power for wheel motion, the drive cam serves y """ another important function: it restricts the period of time that /- the fence can contact the code whccls during totation. Figure - 3 29a shows the nose of the door loc k drop lever as it normally / rests under spring tension on the circumference of the drive g cam. It is allowed to drop below the drive cam diameter once Q during 360* rotation. When the lever nose drops, the fenci: % %, touches the wheels (Figure 3-29b). If the correct combination < > is dialed, the fence drops into the code wheel gates as the lever ge) nose nests into the drive cam gate (Figure 3-29c). His allows , Figure 3 29. Drise cam action (door lock)- |' the lever to drop below the lock caselever stop.The boltis then - l' NUREO/CR 5929 L 19 - - - - - > ...... - - - . - . _ . .- - _ . -______- _ - ______-_- ______- __ _ _ _ . _ - ______- _____ . ______- _ _ - - lock Technokgles : retrxted by turning de dial in de poper directim.11e levtr in a an easy rnatter for an individual to rotate die dial and fecht hear exh ccanbinationpulktk(stowninfigure3 30)contxtsdearivecam wtal gate as it passed under de fence.1lowsver, many pesent< lay w len the shrkle is pulkd Wien de padktk lem enters tic drive krks irr(rprate tytkms which greatly lessen or completely elimi. cam gate, ile fence cmtxts the wieel pack. nate fenedwtrel contxt until an opening h atteripted. In a Group 2 krk, tie ferre is alkmul to touch tie c(de wiects caly wlm de - lever nose drops into tie drive cam gate (ance every 3(O* rotation). tem or;ve cam lie fence h raised wim the lever ncse slides out of tie drive cam , gate area. figure 3 31 illustrates this type ofdesign.1lowever,even i \ .--- h ! ' ~. tlough fenedwheel contxt occurs infmtuendy, rnanipulatkm is r | still pssible. '| (*# * v Wtwet tuk Fence f'ence '' | ' * lever M| Wheel . Ilgure 3 30. Dri e cam actkm (palkrk) / O Ilott Av,embly ' The bolt h usually attxhed to tie lever. Wien tic correct combina- "" tkm h dialed, t}c ckxr krk lever couples the chive cam to the tolt, converting dial rotatkm into tolt sliding notion. Ilgure 3 31. Group 2 krk 1he fence is usually an integral part of tic lever and is cast, staked, a soklerud into pixe. The entire assembly is nmmily fabricated De nshtaree to rnanipulation of combinatkm krks has been from brau, although in older style locks de bolt material is often , steel. greatly increased by tie addition of such devices as noisemakers, eteentric rollers, and other features whkh limit the tine of fened - The bolt of the combinatkm door lock is used to directly secute wheelcmact. the door or to $ccure a larger mechanism consisting of multi- ' krking toits which secure the door to its frame. Most combina- Noisemakers cover or camouflage authentic fence / wheel con- tion door bolts are extended, preventing ckor rnovement or txt by means of a spring-loaded detent that rides against the - multi-kicking bolt movement. Bank vault locks are usually of drive cam. It is used in cordunction with a rnodified spdng. loaded drive cam designed to click automatically, thereby heavy ccmstruction and are designed to puslVpull a larger . mechanism which secures the door. eliminating any discernible fence / wheel contact. Figure 3 32 illustrates one type of drive cam noisemaker, 3.2.2.1 Combinatko Lock Optiom and Variatkms - '"'* Manipulathm Rtshtance Wh**I { Lever I%r to the early 1950s, combination locks wem susceptible to / unauttarind opening by neans of manipulation. Various mediods spring. - ' : of manipulation can still be used to defeat many pesent< lay locks. -toaded fir this reason, combination door krks are evaluated and labeled Drive Cam xcoiding to drir resistance to manipulation. A Group 2 krk is . considered" reasonably resistant to unauthorized entry." A Group 1 # krk is considered " resistant to manipulation for 20 man-hours." ' k ' - Detent -- (See ANSI /UL768.) g g. One qurating feature which makes manipulatim possible is the \ contxt made by the ferre as it touches the code wtals. If the ferre leck Case spring of a combinatkm ktk always teued on thecode wheels,it would be Figure 3 32. Noisemaker i . I: NUREG/CR-5929 20 I - _ .. . u . . n _. _._ _ __.__ __.__ _,__.______. . _ _. lack Technologies Fence /whml contact normally occurs at repeatable goints in < - O g rwe com every 3(& revolution and can be used as reference points for """'N . mam manipulating a lock. Placing a freely rotating eccentric roller 3 D "' , * 8""d* (v' the nose of the lever changes the lever position as it enters 1 and enits the drive cam gate. This causes the fence / wheel . [[*,yd 7 h.Nyk' contact area to change cach revolution. A lever with an / r ' j eccentric roller is shown in Figure 3 33. T s tann ssneu t'W ~ ' *' i" wheel O *-tever $'yf,d, u.teway, ,. ' N , qo = <. v. f' ' 'J $lidet I'"" ' seesun Nowesun .O ' Told Su M I.'igure 3 34. Concealed drlse cum gates Dnve cam # I*' C8m l'igure 3 33, l'ccentric roller % \ Another method ofimpeding rnanipulation is to eliminate the ' fence / wheel contact completely until an actual opening at- tempt is made. One manufacturer accomplishes this by using g[ g a sliding drive cam which has no gate opening during normal p- rotation, During dialing, the lever nose slides along the cir- f non cumference of the " gate less cam," keeping the fence from tw - resting on the code wheels. When an attempt is made to open the lock after the combination has been dialed, the dial is 171gure 3 35. Hotary. fence gear drhen kuk turned to the lever / cam engagement position, in this case zero ("0"). The modified cam is then adjusted at the dial, using a knob or" butterfly" attached to an inner spindle assembly.The Another antLmanipulation design uses spring momentum to cam slides apart revealing a gate area. lf the correct combina- force the lever nose into the drive cam gate when an opening tion has been dialed, the spring-loaded lever drops into the is attempted. After a combination has been dialed and the dial cam gate, allowing bolt withdrawal. lf the combination dialed returned to 7.ero ("0"), the entire dial is depressed. Depressing is incorrect, the wheel gates will not be aligned; consequently * the dial, which can only occur with the dial on zero, releases the fence rests on the wheel pack with the lever restricted from a large, cocked accelerator spring, the moving mass of w hich withdrawing the bolt. If another opening is atterupted, the momentarily attempts to force the lever nose into the drive drive cam gate slides back into concealment w hile the combi' c am gate. If the combination dialed is correct, the w heel pack nation is dialed. The series of illustrations in Figure 3-34 gates will be aligned, allowing the fence to nest into the wheel : shows two types of concealed drive cam gates, pack, and lever / cam engagement to occur. If the combination is net correct, only momentary fenec/ wheel contact occurs, An older variation of a manipulation-resistant twk is the with a second spring pulling the lever back into its original - rotary. fence, gear-driven lock (see Figure 3-35). Dialing in position, If nesting and engagement do not occur, the combi- one direction forces the fence away from the wheel pack; nation has to be redialed. Recocking the accelerator spring dialing in the opposite direction forces the fence against the requires no more than one rotation of the drive carn. Figure wheel pack. Some locks of this type are still in use today. 3 36 illustrates how this spring loadallever action works. 21 . NUREG/CR.5929 : . . - - ._ . -_ _ - - - - , - - . -- _ - - . . . - . - - _ _ __ _ lock Technologies m.i C== A u c t. g , y,, g,,on, I Sprits Caw spnog 'lrue Gate 5i3 / |/ 8"" # C - s- r e '4 d-_ spne, O #, .I aise Change spnng Reud er Anti spnng Kc) hole c1atsPuonon True Change tiver Return spnng Angle View (* * l N 3 Wheew 4I fL o 4WAua spring caen anoce g Need t 'nmte d Daaedtwom 1:ront view I'igure 3 36. Spring momentum Iigure 3 37. X ray resistant code wheel Itadiographic Resistance Another option to be considered in selecting a combination Case % lock is its ability to resist r::diographic attacks. Combination ) hick s are evaluated and labeled according to their resistance to ' radiographic decniing. A lock labeled Group 1R is consid- Drive Cam ered resistant to manipulation with the added capability of \ withstanding 20 man hours of radiographic attack (see ANSI / 'Um_1. ~\- U L 768). Wheel design and fabrication material greatly at lect Spring loaded #"I O II"It the quality of the radiographic pictures an attacker can pro' Relosker Arm duce, Spring & Pin Dehin and lexan are common plastics used to counter an x. ray radiography attack. Simple to highly complex false gates y Case and key-change hole designs are also used in an effort to ' increase x ray resistance. Two views of a code wheel which incorporate x ray resistant designs are shown in Figure 3-37. I + Ilolt Rchwhing Desices 3 ._.. "I L Relocking devices (or rekwkers) are incorporated into lock / > Cover cases and multi bolt locking systems. These devices are Spring loaded Rehwker Arm f typically designed to react against forcible attacks. Combina- == p'' , tion door kicks are normally equipped with a case cover 'i#* r'*EIt**#'i"t Case relock er. l f the c ase cover is forcibly t emoved, a spring-loaded tekicker is deployed, restricting bolt movement, An added feature to counter a thermal attack consists of a low-melt Figure 3 38. Rekwking desices material (such as a S arrie alloy) which, w hen melted, releases , ' the relocker. Figure 3 38 illustrates some relocking devices. NUREO/CR-5929 22 . . , ~ - ~ . , . ------_.- - __ - - - - - . ! | tack Technologies , ; i Dial Assembly Dolgn to pres ent teopening the lock without redialing This device is standard in high-quality key-change combination padlocks. | Several ddferent designs are commonly used to attath the When the shackle is inserted into the padkick tuly to reciose combination dial to the spindle. Usually, the dial and spindle the hek, a spring loaded metal pawl grabs two grooved are f abticated as one piece, pressed together, or pinned. Some w heck and freely spins them, usually from five to l $ numbers, lock 5 are designed to operate in various pnitions, making dial Door locks lack this feature and have to rel) upon the indi- paitioning adjustable. The drive cam is of ten splined to vidual to secure the lock by spinning the dial in order to prov kte fout hand snitiono right. left. up, and(k)wn. Spindles scramble the wheels. To scramble the combination corn- i are often covered to protect them from fire. insulating materi- pletely, the dial needs to be rotated one more revolution than als. Dials and dial ring come in a multitude of designs, and the number of code wheeb within the lock. many options are available, including key locks w hich secure eitherorbothdialandring various spy proofdialanddialting Ke3 Change lloie Coserage sets which restrict visual observation of dial settinp; and punch pmor spindles. An obvious drawback to key change versus fixed or hand. c hange combination locks is the presence of a hole in the lock Vibration Reshtance case. Padlock key-change holes are of ten covered by spring doors or back cm crs (boots), as shown in Figure 3-40.%ese Some factors affecting kick vibration resiuance include bab can be removed, exposing the keyhole, only w hen the correct anced, lightweight whcch, wheel-pack torque loading, combination is dialed. Key-change holes in door hich are wheelpost tolerance, and lever spring loading (see figure not mally e sposed w hen unht ked unless concealed within the 3 39). These features are normally contiolled by the manufac- container door, to:er at the fw. Iory but vary peatly from one design to another. At present, only one tr'anulacturer is installing an adjustable watcopring w heel-p k torque washer that is adjustable from the outside of the hick case. The manufacturer recommends [g\*- maintaining a 14 inch' ounce torque loading thmughout the , hfe of the lock. g .\ \ ContrW hg s rwing Ibor Covered ' Cosgrol h" i dg gey g,,g, thre tion ori ever Spnng tmhng Covered Keyhole # Leser Spnng . I Figure 3-40. Padlock key change hole fO ., Padlock Shackle Features , ,% (3 I $r q Features of padlock shackles are discussed in section 3.1.3 whcci paianang wh and are pertinent to combination padlocks as well as key. Rekuner * i Min Weght1.ow tnertia operaged padhy($, I Adjumnent he 3g, Lg , ' ' ' ' /ISrheIdadmgI 3.2 3 APillicalloit Cotisider atioris N t. re- Adjustinent near 3.2.3.1 Pros and Cons Mechanical combination kicks have some advantages over Figure 3-39 Factors affecting sibration reshtance key locks. For example, they are less vulnerable to unsophis- ticated surreptitious attack because the lock mechanism is less e xpased. Another advantage is that there is na need for a key, Scrambling Dnice (other than, in some cases, a combination change key). The use of a combination lock also climinates the need for dupli- The function of a scrambhng device is to disrupt the alignment cate keys w here multiple access is required. Finally, changing of the code wheels of an open kek when it is closed in order the combination can be far simpler than re keying a key kck. 23 NUREG/CR 5929 _- _. - __ - ,_ - - _ - - - - . - - - - . - _ . . _ - . - . -. ------. ------. . - - . - lock Technologies lf the cornbination kwk is a key change lock, no disassembly ne rotational tolerance of the krk also af fects the number of the kwk is required, of usable combinations. UL Standard 768 defines three claneri of manipulation resistant kick: Group 1, Group 1R, Dere are also disadvantages of combination lockw ,rnpared and Group 2. Groups 1/1 R have more usable combinatiom with k ey locks. Dialing a combination takes a longer time than than Group 2. For Groups 1/lR, a number entered may be inserting and turning a Ley. Also, traditional combinaJon accepted only if it is within 4/ one dial graduation of the krks have no " master key" system available. Master keys true number for a three wheel kick or 4/ 1 1/4 graduations allow k(kn to be sepegated into groups with mutually eaclu. for a four whcci kick. Group 2 kx ks allow the tolerance to sive access, but with master access allowed. be 4/ 1 1/4 graduations for a three wheel lock or +/ 1 1/2 graduations for a four wheel k(k. ; ' Some rnettuxis for defeating combination kcks are decoding; systematic trial and error; environmental attacks, including Requirements for combination padkx ks differ Imm those heating and cooling; chernical attacks; x ray radiography; forpermanentlyinstalledcombina ionktks.FederalSpeci- Sense manipulation; impact vibrathm; signature analysis; fication FF P 1100 requires a minimurn of 30,000 combi- mechanical probing; and force.%cse metinxts are described nations. Rotational tolerance for acceptance of an entered in the Glossary, number is 4/ 1/4 dial graduations. 3.2 3.2 Gemiral Design Features Which IrxTraw Security * Permanently installed combination kwks should be of high strength, high quality materials which exhibit resistance to Some specific design features which increase $ccurity are wear and corrosion UI, Standard 76H arxi Pederal Specifi- included in section 3.2.2. In this section, we discur,s features cation FF-1 2740 list general materials guidelines for kok to reduce vulnerability which apply regardless of the specific construction, while Military Specification MIL L 15596G design, lists specific materials and acceptanec eriteria. Properties of . materials used for the construction of combination padhwk: * Knowledre of the conect, current combination should be a are r,pecified in I ederal Specification FF P 1100. Specifi- . prerequisite for changing the combination. This prevents cations for testing padhrks may be obtained from FF P- unauthorir.ed individuals from installing a combination of 1100 and ASTM F 883-90. their choosing, which would allow access at a later time. * The following features will provide a high level of tell tale There should be no openings in the case of the lock through to unauthorized entry; which a probe or other similar device rnay be introduced into the lock txxly. His includes change key openings as The kick finish should be casily marred. If a lock has a finish well as other openings, if a probe can be inserted into the which is easily damaged, it will pmvide an excellent indi; kck body, the positions of the gates in the w heels may be cator of attempted forcible entry. lt may also indicate some decoded, providing the adversary with the combination, forms of surreptitious entry. * De combination should not be able to be determined when The lock construction and materials should be such that any the lock is open without knowledge of the existing combi. attempt at unauthorized disassembly rhould permanently - nation. distort and mark the ec,mponents, * He resistance to systematic trial and error attacks is di- Forcible entry should irreparubly damage the ktk.nis will rectly dependent an the number of usable combinations prevent surreptitious forcible entry except in the case in which may be encoded in the lock and the rotational which a cornplete replacement kick is available, and can be ' tolerance allowed in dialing a number._ encoded with the correct combination from the damaged one. A permanently mounted, dial type combination kick should have a hirge nu mber of combinations. UL Standard 768 and 3.2.3.3 Other Factors Which Affect Security - Federal Specification FF L 2740 necify at least I million possible combinations. Additionally, Military Specificat Vulterabilities can be intnxtuced due to wear and tear, comisicm, tion MIL-Lil 55960 specifies a minimum of 800,000 theo- andlack of gevenths maintmarre. , r etical combinations.This may be those that are usable after discounting 20 numbers on the last digit according to First, a failure can be made credible. If a kick is broken,it manufacturer's directions. could be attributed to the condition of the kick, rather than to . - NUREG/CR-5929 24 , c . , . . . ,, , es,.. wy . . . , -w-~- ... ---e .- - ~ . - -, - - - - . < -w-.-e mv+-m,- ,w- . w w w .- - , - w,t-= "--r Tw'-*v y - e t -e ______. . - _ _ _ _ . . _ . _ . . . . _ _ _ _ _ . - . _ _ . teck Technologies adversary attack. Furthennore, an adversary could forcibly nis specification may be obtained from Underwriters Labo- , open the lock, then substitute a non working n placement tatories, lock. FF.1-2740. Federal Specification, lagks, Combination Second, an adversary may be able to open the lock if he/she dials a combination close to, but not exactly, the correct his specification covers changeable combination locks in- combination. tended for permanent installation on safes, vault doors, secu. tity files, and other security containers. Incks which meet the , I inally, a poorly maintained lock can be difficult to open by requirements set forth in this document are approved by the an authorired user. When a lock is difficult to open, it is also General Services Administration for use by all Federal agen. dif ficult to verify thalit is loc ked introducing another vulner- cies, ability. tecks covered by this specification must meet the require- ! ' 3.2,4 Standanis and Speellications ments for resistance to unauthorired opening of Group 1R in . ANSI /UL 768, The Federal specification adds to and elabo- See Appendix A for addresses and telephone numbers of the rates on the requirements of ANSI /UL 768. For example, t organizations from which these standards and specifications specific design features, such as mechanical and thermal may be obtained. relock, are required. As another example, the test procedure allows a greater weight of tools to be used than is allowed by 3.2.4.1 permanently Installed Combination Locks ANSl/UL 768. The Federal specincation also includes a covert entry requirement not included in ANSI /UL 768. ASThi F 47176 Standard Definitions of Terms llelating in Combination Locks Other requirernents included are the number of possible combination s. comple x ity ofcombination ch ange procedures, ' His document provides a glossary of standard terminology, design, construction, operation, quality assurance responsi- bilities, testing proced u res, environmental specincations, stan. This specification may be obtained from the American Soci. dard marking and packing requirements, and a brief discus. - ety for Testing and hlaterials. Sion of materials. Other applicable standards and specifica- tions are referenced, ANSI /UI,768 Underwriters Laboratory Standard for Combination L 25 NUREG/CR-5929 1 u _ . , __ _ _ _. _ . _ .. _ _._. _ ._ , - ______,_ _ _,___,,_ ___,. , _ , _ . ______- _ _ _ - _ . . - _ - - _ _ _ . - - _ - - _ ------.- Inck Tec hnoh>gies Other requirements include physical sire and layout; number Detailed test procedures include the following: manipulation of possible combinations; comple xity of cornbination change teehniques, surreptitious attack, radiogtaphic, direct tension, procedure; mechanical design, construction, and operation jarring, shackle breaking, and dropping. Other requirements (including endurance and tolerance); quality assurance re- include phy sical size and layout; number of possible combi- sponsibihties; testing procedures; environmental specihca. nations; mec hanical design, construction and operation; ma- tions; protection time mecifications for manipulation and terials; qu ality assurance responsibilities; en vironmental speci- forcible entry; and standard m.uking and packing require- fications; wear and corrosion; and standard marking and ments.Other applicable standards and specifications are ref. packing. Other applicable standards and specifications are crenced. referenced. This specification may be obtained from the Defense Printing 1his specification may be obtained from the Defense Printing Ser ice. Service. _ Mll, IllillK 1013/M Military llandbook, Combination 3.3 Bulls, StrikCS, aml halCh0S Imks This section covers descriptions, illustrations, and discus- This handbook provides hasic instructions for the installation, sions of the role of both mechanical and electrical bolts, eperation, and maintenance of variot.s permanently in talled i str Les, and latches in security systems. combination locks and combination padhicks Also included are instructions for changing and setting combinations for hand-change and key-change kicks. Specific matels oflocks in a permanently instalksl access control system, die nnt comnx in n1eduxi of joining die rivivable battier (dcxir) to the fisn! banier are coscred in detail. (wall) is to use a bolt a latch coupled into a strike. 'llus is true lhi specification may be obtained from the Defense Printing whether the system is mechanical or ekttrical, key or keyless, Scruce. s mple or sophisticatni Figure 341 shows a typical nounting configuration of a bolt, strike, arv.! latch. 3.2.4.2 Combination Padlocks _ \ , w % ASTM F M3 90 Standard Performance Specification for PadhKks - - /y This is summarized in section 3.1 A. - Det40 Vrw " b' 1 IWe or ike IT P 110G Federal Specification, Padhxk, Change. t y nne uhle Combination (Resistance To Opening Ily Manipu. ].v lation And Surreptitious Attack) f V' " "s u e Q ' Anob 7 * l Ah ~!his specification covers changeable combination padkicks w hich provide low level resistance to forced entry, and mod- crate resistance to manipulation and surreptitious entry. In addition, a high level of tell tale to unauthorired entry is mm iw, nn, specified. Locks w hich meet the requirements set forth in this I* document are approved by the General Services Administra- tion for use by all Federal agencies. Figure 3-41. T3 pical mounting configuration of a bolt, strike, and latch There are tw o classes of combination padkicks. Class I has 30 man minutes resistance to manipulation,30 minutes resis- tance to radiographic techniques, and 10 man-minutes resis- Typically, bolts and latches are mounted on the door. Locking tance to su rreptitious entry. (Note that the definition of surrep- occurs w hen the door is closed and the bolt or latch projects titious entry diffeis between this specification and FF-1, into a recess in the doorjamb. The difference between a bolt 2740.) Class 2 is the same as Class 1 except that it has no and a latch is that a latch will automatically retract a3 the doo - requirement for resistance to radiographic techniques. Nei- is closed, whereas a belt stays in the same position unless it is ther class has any requirement for resistance to forced entry. intentionally moved. Bolts are typically uniformly thick, i | NUREG/CR-5929 26 ______- _ _ - _ _ . _-- .. ______- - ______ 1a L Tet knologies snovabic devices intended to block motion perpendicular to llow ever,if multiple putats have to be continuously guarded, their diantion of travel.1 atches are beveled and spring- one guard with the ability to renmtely nnnitor and control loaded so they will automatically retract. 'Ihey are more may be more cost cifectis e,ln this case, an clecuicallocking cornenient, and nuve vulnerable, than bolts, 5) stem may be the right choice. A strike is used to strengthen the necess into w hich a bolt or 3,3,2 llardware 1)escriplinit: Mecliattical latch projects. Stnles may be active or passive. The 'nyly [gg|g g,.ih mW IMcIn function of a passive strite is to suengthen the recess. Pasuve striles are strictly inechanical in nature, but may be umi w;ith Mechnical bolts or latches are generally designed to be both mechanical and electrical tults and latches. An active integrated with the lock snechanism, with a Ley or combina- strike allows the door to be opened w hen pressure is exerted on the door. Actis e suites are generally electncal, and contam tion hd imiaMo me k bolm M WM inlm Jihysical proximity Sometimes the bolt or latch is contained moving parts which consuain or release the bok. within the same enclosure as the kd, as in a permanently . mounted combination hick (see I:igure 3 19). Sometimes the llohs, latches, and sinkes may be either mortise-mounted or 1rd is mounted separately with mechanical coupling to the rim mounted. liepending on the design of the hardware, the bok or lack bolt or latt h mechanism may be mounted to either the door or jamb, with its associated strike mounted to the remainder of A mechanical bolt is constrained in its projected gnition by the two. inter ference with a solid obstacle, w hereas a latc h is pmjected , . , by a spring. Iloth types of consuaining inechanisms are used Some kding desices are designed to Iun6 tmn enhet me- in padhds and door hds, and are activated either by a Ley chanically or elecuically. An example is a mechanical kick or Leyless mechanism. The bolt or latch is usually a spring- mounted on the door combined with an electrical st ike on the hiaded latch, a dead i ding latch (deadlatch), or a deadholt. door jamb. A spring loaded latch is shown in Figure 342,'Ihe conve- 3'3*! b nience of this device is ofIset by its vulnerahikty;e serting end pr essure on the beveled surf ace will cause the latch to retract. Ilotts, striles, and latches are the actual securing mechanisms in a hd, w hether mechanical or electrical. Mechanical bolts, IAh stnles and latches are primarily used in securing portals that "8 do not require remote conuoi operation. \ b . . ""L.,, Electne bolts, strikes, and latc hes are used in security systems where centralited control is required, One application of k< g electric bolts is in prisons to secure cell doors (ontrolled from a central guard station. Electric strikes are of ten used in Nect Spring Key Mechanism security area access conuol systems, and are actuated re- Anion for jq Rehding motely by a security' officer after identity is verified, for example, by ckwed t;huit television. '!his allows a centrab ) ited location to control access through many portals, Electric bolts, strikes, and latches are also used in electronic access Figure 3-42, A spring loaded latch control systems which use desices such as key pads, card readers, and eye scanners for electronic recognition. Deadlatc hes and au xiliary deadbolts are ollen used to increase . 'the selection of electocal sersus mechanical bolts, strikes, security. A deadlatch has a plunger which is depressed as the and latches is a decision which should be driven by the degiee de is shut, placing an obstacle in the path of the spring latch of security needed and by cost-eflectiveness. If there is only w hich restricts its movement. This is shown in 1:igure 343. one entrance to a facility and a guar d is needed for continuous monitoriny, a met hanical system is probably the right choice. A &adbolt has no sping action, Deabits are either insitively or Mechanical k ding syste ms are probably also the right c hoice intermittently couplal (Figure 344). When a psitively coupled if a Imrtal does not need to be continyously monitored, and if hhlt is fully pmjectal, it cannot he unkded by exerting end unkding by authorized personnel is relauvely convenient. p essure. Key k ds which an: p sitively coupled require correct ! 27 NUREG/CR 5929 __ _ . __ __ - , __ . _ - _ _ _ _ _ - - - ______- - 1stk Technologies key operation for unlocking. Intermittently coupled key locks pujects into the hole. Sorre passive strikes have n full enclosure into can often be defeated by bolt manipulation withoot operation w hich the bolt or latch projects. Strikes intended fcr use with latches of the key mechanism. typica'ly are beveled to assist the spring latch in retraction. DW chel bath;sa Case twir+ omt / h.. '' ff Fence # -- m. - n he - n. m/n i@ Wheel e j g Q NEa Locked Figure 3 43. Esample of dead.h>cking latch, kmking down from top of door f : Key Mecharusm g @ - r . Unloct ed " l 7_ami Figure 3 45. Intermittently coupled holt Iwtiveiv coueira hiotion (combination k,ck) t t u kea .na . N xey 3.3.3 liardware Description: Electrical [$$d s Key Mea nam Iloits, Strikes, and Latches *T Electrical bolts, strikes, and latches are often physically re. 4 _ .,_ C** g f -- # moved from the locking circuitry. He locking circuitry usu- _ ally consists of an electric control system which may be a few L Dolt feet or a few miles away from the bolt, latch, or strike. Mauon h""" #"' * d . ne operation of electric bolts and latches is controlled by application of power to either a solenoid or an electric motor. Figure 3-44. Key operated deadbolt A solenoid becomes an electromagnet when power is applied. De solenoid then exerts a magnetic force on the appropriate mechanism, which removes a barrier allowing the user to ne bolt and code w heel mechanisms in quality combination retract the bolt or latch. An electric motor can be used to locks are intermittently coupled, but bolt movement is usu ally perform the same function as the solenoid, and while it is more p restricted to when the gate is aligned. In Figure 3-45, the case secute,it is also more expensive, prevents the belt from moving to the left until the fence drops into the gate. .. Figure 3-46 shows a simplified drawing of a motor-driven electric bolt. A reversible motor drives a gear train coupled to A typical passive strike serves as a reinfortenwnt fcr the recess into a lead screw. When the lead screw is rotated in one direction, which the bolt or latch projects. %e simplest passive strike is a it threads into the bolt, retracting it. Rotation in the other fonned plate of nrtal with a hole in the center. De bolt or latch direction extends the bolt. NUREG/CR-5929 28 -- ______-_- _-_ _ .-- -_ . . _ - . . - . _ - . _ - . _ - _ _ - - - Imk Technohigies non, w , andsa..- 'the fait secure strike operates as follows. When the solenoid - is energized, it pulls the latch down. 'lhe bkg Ling bar is then p< mi free to move, and the strike is free to rotate, A latc h (not hen b shown) projects into the recess whcn the strike is kded. ', o yE When the door is pushed, it puts pressure on the latch, which . 3 MEN .. ,g;, puts pressure on the sirite. ~lhe strike pushes the bkding bar ,# ___ gg . y out of the way as the door is opened. When power is removed, ny, the return springs push the bkdhig bar to the right, and the i"",,L'L _I.__ latch up, preventing '',e stn, e from rotating and the door from -- swo being opened. e, - - - - Holt 't ,evel 'lhe fait safe suite & crates as follows.The solenoid is fixed l'igure 3 46. Ihample of electric holt with motor drhen I" P I d"' #h#".gwer is applied to the solenoid, it pulls an aucinbly (consnting of the washer, a shaf t, and the blocking lead strew bar) up. When the bhding har is up, the strike cannot rotate and the door cannot be opened. When power k removed, the return ynng puHs t e n@ar dow n, aHowing the see lloit s, latches and str iles operate in one of Iwo nnies:Iailsafe to totate, and dm dom to tw o;rned or Iail secure. l' ail safe is usually preferred because it k leu dangerous bec section 7 Safety Comiderations of Inks). Ilowever,itdegrades security because,intheeventof apower f ailure,it automatically unhas. Auxiliary power supplies are usually required. k 0 Reion, 'tnie o /~ spnrig N^ lilectric strikes are active;i.e. they have moving parts w hith Maion( __ y can he used to hx-L or unhd the door. I;igure 347 is an g / example of a fail secure electric strike. I:igure 3 48 is an 9 exampic of a fail safe electric strike.'Ihe ditference is that the 5"*'" %s f all safe desice unhas when power is rernoved, and the fail jMd%'["['d,, , secure device hd s when power is removed, lloth strikes are n, c]d to la k ; -g solenoid operated. sacona .. ._ , , stan As - V ~o\' eiurnH / swcl spnng Wadwt 0 onuito. or / p gsea,m,ouon O 3.a. l'igure 3 48, ihample of a fall safe electric solenoid u m ,,,, operated strike n., [ " ' " " " 3.3.4 Appliention Considerations krius - .-- Nase I 3.3.4.1 l*rm and Cons N 3 One advantage of mechanical bolts, stiikes, and latches is m_) , suma au - ( ~ ' ' " their relatively low cost compared to their cicetrical counter- [[ parts. 'l his low cmt includes not only the cost of purchase, but reduced installation cmt. For a mechanical system, installa. ,/o tion is $1mpler, and no wiring is required. t Attack rnethods such as shimming, drilling, sawing, and | | 17igure 3 47. Ihample of a fall secure electric solenoid env ironmental and t.hnmic al attack s can be u sed to de feat both operated strike 29 NURiiG/CR-5929 , | - , ~ . . ._ . . ~ Imck Technokigies - mechanical and electrical devices. In addition, electrical de- additional ilme to allow securi ty forces to respond io a vices may be vulnerable to attacks on the power supply or the breach of security. Examples are the bolts and latches used wiring. Devices which use a solenoid may sometimes be in prisons and bank vault doors. defeated by solenoid override. Electric motor driven ds ices do not share this vulnerability. De attack methods are de- * Monitoring door status (open or closed), either by security scribed in the Glossary, personnel or by an automsted alarm sptem, can increase - security. Mechanical devices have fewer types of vulnerabilities than electrical loc ks.This does not necessarily mean they are more * Construction of exposed areas of the device using case- secure. The entire picture should be considered: 1.e., the hardened steel may teduce vulnerability to drilling and design orthe mechanicallock, thedesign of the electricallock, other small tools, in addition, case hardened pins which continuous monitoring, alarm systems, response to crises, etc. rotate freely may be installed in the bolt or latch to prevent i sawing. Figure 3-46 shows how this is done in a bolt. An ~ There are a couple of disadvantages to mechanical devices, attempt to saw through the bolt results in the saw blade One is that they typically have no means of reporting status to resting agaimt the pin, which rotates, and prevents further : a central facility. Another disadvantage is the necessity for the cutting. physical presence of an authorized unlocker. Deperiding on the remoteness of the installation, this can result in significant * Latches which incorporate deadlatching devices are more ; ' time delays, both in time to allow access and in time to respond secure than latches without them. Deadlatches block at- to a crisis, tempts to open the latch by shimming. Electric bolts, strikes and latches have several advantages. * For key kicks, positively coupled deadbolts are mote secure One ad vantage is the ability for one security officer to monitor than intermittently coupled deadbolts, and control access remotely for multiple portals.This may be cost efficient when compared to the cost of having multiple * The strength with which a device is fastened to the door or securityofficers ortheinconvenienceofreducingthenumber iamb may also affect security. For instance, using more , of portals. Another advantage is that electricaldevices can be fasteners, or fasteners w hich ex tend deeper into the door or coupled with electronic recognition systems, such as key jamb material may increase security , pads, card readers, and eye scanners. A third advantage that electrical devices offer is a choice between fail safe and fail Features Specific to Electrical lloits, Strikes, pod secure operation. Caution should be used in making this Latches selection. If a device is chosen to fail secure, then personnel may be placed in danger, if a device is chosen to fail safe, a * Motor operated devices are generally more secure than power failure will provide a breach of security. Fail safe those operated by a solenoid because solenoids are vt.iner- devices should have backup power supplies. Fail secure able to magnetic attack, devices may require emergency exit hardware. * It is important to protect power sources and wiring, lloth Complexity ofinstallation may be considered a disadvantage should be installed inside the secure area, of electric devices, especially if a relatively large distance separates the control unit from the lock. Communications, , * Motor operated devices which depend on the rotation of a usually wiring, need to be supplied between the control unit - cam or lead screw should use case-hardened materials to and the remote lock. In addition, each lock needs' to be fabricate covers and any part of the mechanism used to supplied with electrical power, and sometimes bac kup power. -move the bolt, particularly the lead screw or cam.- 3.3.4.2 - Design Features Which Increase Security 3.3.5 Standards and Specifications Features Common to Mechanical and Electrical Holts' See Appendix A for addresses and telephone numbers of the Strikes, and t.atches organizations from which these standards and specifications - * * * Physical size and strong materials generally make these - devices more difficult to forcibly defeat. They provide * +NUREG/CR 5929 - 30 . +--a $. - * ' e wr , w w ,, <- m1 -~,---e---w--4- e-r +r 3 -%,-*--+w-r - y ,-q,ve y f g r-e,------~ -. .-._ _ ~_. - - . ~ _ . - _ . - - - - * ImL Technologies , ANNI /IlllM A A156.51984-American National Testing is specified in a wide range of areas. Electrical testing Standard for Ausillary lagks and Asu>ciated Products, includes normal operations, input and output measurements 7 Part 11. for the power t upply, standby power, over and under volt. age, leak age curr ent. clectrie shock cuttent. voltage over kiad. , ' Part I of this standard covers ausiliary tuned and mortise dielectile voltage withstand, electfical transient, battery re- hicks, rim kicks, and cyhnders and includes security tests, placement, disconnection and reconnection, and terminal opesational tests, finish tests, and dimensional criteria. assemblies. Part 11 of this standard establishes requirements for exit Environmental tests check temperature, temperature rise, alarms, exit hds, electric strikes and indexed key control humidity, and nokture absorption. Resistance to distortion systems and includes operational and finish tests. and creeping at temperature is also required. 'The following is a summary of the portion of Past 11 concerned Mechanical testa for endurance, strain relief, mechanical with ch ctric strikes.Other parts of this standard are reviewed strength, jarring, sureness of terminal connections, and fles. in the appropriate section of this NUREG. ing of wire without breaking are discussed. ; 'Ihe standard defines three grades of electric strikes, Grades 1. Tests for ilammability and resistance to ignition from electri- ' 2, and 3, with Grade i being the best both in operation and cal sources are required, and include fire resistance to hot security. As a minimum requirement for Grade 3 certification, flaming oil, molten pVC, and molten copper. An abnormal the standard requires that electric strikes meet ANSI /UI, operatior, test is also required to show that the risk of fire or 10M. For Grades 1 or 2, tables are provided w hich show the electric f. hock is not increased, enhanced requitementx for endurance cycling and force. Tests specific to electric locking mechanisms include a salt "Ihe standard ahn contains finkh, corrosion resistance, elec- spray corrosion test, rain test, dust test, forcing tests, and tool trical, and safety requirements, attack tests, t Descriptions and drawings of ditferent types of electrical *Ihis specification may be obtained from Underwriters 1. abo- strikes are included. Each different strike has a type number ratories, w hich is used to specify strikes w hich meet this standard.The number refers to this standard, and gives information on ANSI /IlllM A A156.21989. American NationalStan. material, type of product, specific product function, and dard for bored and preauembled locks & lakhes grade. 'This standard is summarized in section 3.1.4. This specificark n may be obtained from the 11ullders liard. ware Manufacturers Association. ANSI /IlllMA A156,121986. American National , Standard for interconnected locks & latches ANSI /UI,1034. Iturglary iteshtant I'lectric la>cking Mechankms This standard is summarised in section 3.1.4, This specification covers a broad spectrum of topics including ANSI /IllIMA A156.131987. American National elecuomagnetic hic ks, and electric strikes, bolts, and latches. Standard for mortise hxks & latches Security and personnel safety aho are addressed. This standard is summarized in section 3.1.4. This specification goes into entreme detail on requirements for electrical enclosures, field wiring, internal wiring, wire 3.3,(> Directory of Certified Locks ant! Lutches sites and lengths, color of ground wires, insulation thick ness, wiring methods, circuit separation, grounding options, splic- 'Ihis document is published yearly by the fluilders liardware ing, component mounting, insulation, power supplies, Manufacturers Association.'lhe directory is a listing by ' ove current protection, printed wiring boards, semiconduc- manufacturer and model number of devices meeting the ' tors, transformers, materiah, resistance of terminal connec, requirements of ANSI /1111M A A.156.2 and 156.13. Manufac. tions, and mini mu m internal spacings required for appropriate turers may choose to participate in the certification prograa voltage holdoffs, whether or not they are IlllM A members. 31 NUREG/CR 5929 i i | l | - - . - , - - - . . . .- .-- . , . ~ _ _ _ . , . - . _ _ _ _ . - , , . _,.-_-J _ _ _ _ _ . ______. . _ _ - ______.__ _ _.. . _ , __ _ lak Technologies | 1his directory may be obtained from the lluilders liardware | lhe code rnethanism varies arnong manufacturers. In one ' Manufacturers Anociation. design, the spring loaded latcicbolt is held in the hxked paition by two nded sliding plates w hich move up and down 3.4 MCCllHilleul C0ded locks cach time a bunon is pushed. Fridion betw een the bolt and the , c det plates holds the plates in position. When the correct ! Mec hanical uded h(ks are briefly descobed in this section. %e is entered, gates hecated in the plates allow latch / bolt 1 hey are convenience locks which are used in low security *'thdrawal. A reset button realigns the coded plates in their applicationt llowever, they are so commonly used that a ind.al p s on. nunknadons can only be changed by description is included for purposes of cornplete icss. uplacement ofinemal pans '3'4*y g- Another push button design associates each button with a gated gear wheel. When a button is pushed, it rotates its .these krcks are A mechanical coded lock h a self-contained door krk. Push- buttons are used for entry of the combination. Following 3.4.3 Applicallott Consideratiotts combination entry, the latch or bolt may be withdrawn.1hese kicks contain up to 10,000 p>ssible combinations, Oded krks have one significant advantage over key kicks in There are seseral push-button hwk designs on the market that they climinate the p>tential for breach of security result. w hich contain a five- or ten-button display for code entry (see ing irom last, stolen or impressioned keyo Ilowever, they Figure 3-49). Code selection varies from a one number to a of ten are designed with bypass key control in case of mechani- seven number code. Of ten, the same number can be nepeated C"I I"Ilure. Key bypass can aho be used by security personnel . and different numbers can be pushed simultaneously. w n n n unpradical fm them to renember emnbinations to every kwk. While providing a minimum lesel of security, these kicks u ," NE have the adv antage th at they are quic k and easy to operate.The 'NN con nadons am umaHy shmter and easier to temember than NN a dial combination krk. N5 l EE I'" An extensive list of vulnerabilities is not appropriate for this 3 type of kick, since it would not be chosen for its ability to _,_ _ withstand attack by an adversary. llowever. it should be noted u.a m., N ru, that a systematic trial and error adack by a passer by has a reasonable probability of success because there are not that snany combinations available, , , 3.5 Electromagnetic Locks ' o a na 3.5.1 Uses q -/ ' -~ 'lhe primary use of ekctmmagnetic locks is in axess control systems. A commercial example is that a rrec[nriist can permit or %g g, deny access to the premiws without having to walk over to the dmr. * rue Because of their strrngth, ekttn unagnetic k rks can also be uni in ! security area access control systems.1 hey can te actuattst renvitely by a swurity oflieer after the pnon desiring entry is klentilix1.1his Figure 3 49. Mechanical nded push button h>cks all ws a central location to control access to many prtals. NUREG/CR-5929 32 , y n, . .-,-em-~v- ,-~-,n-,-r- - . ~ ~ w. ,,,---,y-- - , - - -,e - , m. _ _. . __. - .. _ ._. _ . . m _ _ . . . P Imk Technologies o,._ - e An electromagnetic lock can be used la c9njunction with an **"* *'** %* identity verification system, such as a card reader, key pad, y C-- / b~ W=+ fingerprint or hand shape recognition device, eye scanner, or E ' EME other automated identification system. - - -DI7T: N toev w !!y adding additional wiring,it would be straightforward to , ,, combine an electromagnetic loc k with an automated monitor- tw \ t*we \ (f ing or alarm aystem. " rw uia po u.m 3.5.2 liardware Description Figure 3 51. Crw acetion of shear resistant electro- '" " An c!cctromagnet is made from a coil of wisv. When an electric current passes through the call, it creates a magnetic ficki, turning the coil into a magnet.The higher the current the stronger the magnetic field The magnetic field ceam as stx>n The strength of commercial electromagnetic krks ranges as the current ceases. from approximately 600 to 1,200 pounds. %us, electromag. netic locks can be made as strong as desired, limited only by in a standard design, the electromagnet will be surface. such practical matters as size and cost. mounted on the door Jamb, and a stnke plate made of a magnetic material, such as steel, will be rurface mounted on 3.5.3 Application Considerations the door (see Figure 3 50). When the current is tumed on, the electromagnet and the strike plate will be magnetically at. 3.5.3.1 Pros and Cons tracted, hxking the door. When the current is turned of f, the door 1: automatically unlocked. One advantage of electromagnetic locks is the ability for one security officer to monitor and control access to rnultiple portals. This is potentially more cost effective than having multiple of ficers 110 wever, savings on personnel need to be - traded off again-t the cost ofinstallation. 'g,4 . . - Electromagnetic locks work well with electronic identifica- tion systems, automatic monitoring, and alarms. As a result, ' k $~\ electromagnetic locks are extremely well-suited for high 4 q'N security applications. N s Electromagnetic locks are intrinsically fail-safe because w hen ,V. power is removed the electromagnet is no longer attracted to the striker plate. While these devices are safe, the disadvan- tage is that a simple power failure will provide a breach of the security perimeter. Auxiliary hardware and a backup power supply are required to make such a device fail-secure. Figure 3 50. Typical electromagnetic lock Ilecause there are no moving parts, an electromagnetic lock should require little maintenance. - ; a alternative design is the shear type electromagnetic lock, Complexity ofinstallation may be considered a disadvantage, >hown in Figure 3-51. This design mounts into recesses in the especially if a relatively large distance separates the control door and doorjarnb, thus hiding the lock from view.The part . unit from the lock Commumcations, usually wiring, need to mounted in the door recess will typically have movable steel be supplied between the control unit and the remote kick. In " bolts." These are attracted to the electrornagnet in the door addition, eac h loc k needs to be supplied with electrical power. jamb when the door is closed and the cunent is applied, They act as deadbolts to strengthen the door against forcible attack, j 33 NUREG/CR 5929 |~ ; | , -, - , - - , , , ~ -w--w - , - - -= - _-_ - .~--_ - - ~~ -._-. ------ 14rk Technologies i llec ause the electromagnetic loc k is so dependent on its power 3.5.4 Standards and Specifications : supply, it is vulnerable to attacks on the pow er supply and the v wiring. See Appendix A for addresses and telephone numbers of the organizations from which thesc standards and specifications Electromagnetic locks, especially those which have a lower may be obtained. holding force, are vulnerable to magnetic attack, An intense . ' magnetic field in close prosimity may be able to override the ANSI /UI,1034. Iturglary I esistant Electric lacking electromagnet, allowing the door to open. Mectanisms 3.5.3.2 Design Features Which Increase Security His specifintion is summarized in section 3.3.5. ! o Power sources and interdevice wiring should be protected. 3.6 Self Contained Electronic Colnbl. Service wiring should always be inside the protected vol- ume, and backup power should be considered. Ilillloft Locks * De force necessary to open an electromagnetic lock can Unlike entry control systems which utilize ehrtric bolts, ury from approtinately 600 to 1,200 pounds. The lock strikes,andlatches,self containedelectroniclocks(hereafter should have enough holding force for the intended applica- abbreviated elec tronic locks) require no e n ternal wiring.Within tion. the lock case are electronics, a power supply, and the locking mechanism. The electronics contains memory to store the . Monitoring of door status (open or closed)either by secu. combination, and logic to determine whether the correct rity personnel or by an au tomated alarm system can !ncrease combination has been dialed.De logic is also used to contro! security. It is straightforward to combine an electromag- security features suc h as two person contml, different combi- netic lo k with an automatic monitoring system.This can be nations for each user, limited try feature, and time delays. done by using a sensor to detect when the electrornagnet and Depending on the design, an electronic lock may havc signifi- the strike plate are joined. Since wiring is needed for the cant advantages over its mechanical counterpart. electsomagnet anyway, the additional wiring for the sensor can be added at the same time. An understanding of sections 3.2, Combination locks. and 3.3, Bolts, Strikes, and Latc hes, will be helpful in understand. * Some electromagnetic locks incorporate mechanicallock- ing this section, ing devices to allow fail-secure operation. An example is shown in Figure 3 52. 3.6.1 Uses Electronic combination locks have been designed to replace . A m nI their mechanical counterparts in applications requiring me- / Magnet | "" h . continuous dium to high security. His includes safes. vault doors, and / T Duty solenoid other security containers. I - * " * ' :: Deadtma h ~o- 3.6.2 Ilardware Descripilon Figure 3 52. Fall secure electromagnetic lock At the time of this report, detailed information was available on only one design, the MAS Ilamilton LO7. Figures 3-53 , an s w s na cwe mm mm and M, * The shear-type electromagnetic lock shown in Figure 3 51 - a particular electronic lock is the only lock which at this - may improve security because of the dead bolt action of the ume is GSA-approved;it meets the requirements of Federal steel. Ilowever, this type of lock may need the dead bolt pec anon %2Wm Wsreason, mom WormadoMs action to withstand a level of forcible attack comparable to presented on the X-07 than on other electronic locks. In the the standard electromagnetic lock. Which design is more """U #I*" * *"I "EE" ^' vulnerable depends on the details of the designs being compared. NUREG/CR-5929 34 . - . - - - . . __. - - -- . . . - - _. _ .______.__ _ _ _ . _ __._ _m ______._ _ _ __ , i tock Technokigles i Microproceswr Other loc k designs use batteries.One system has two batteries , ""# ##" *" * # "I ## connector "" ' "E circuit replaced. kne W h cuemal baucry compamnents Daard f , , ,, w hich allow rapid bauery replacement. | G,enerskir - r- - g | [dggg Combination Storage 1.ini api x- 0 O w ^ reature or some eiectronic iocks is tani combinationi are . > xKxm stored in non volatile memory.This type of menmry does not , Q require constant power to retain its data. Other hxk designs @ require pow er to store the combination. . $. ' " - Combination Entry laL U"' c,g. m ,,, Some electronic hicks use a key pad for combination entry. Others use a dial which looks similar to a traditional combina. tion kck, but has *m electronic display serren. In the X-07, l'is:ure 3 53. X 07 Ilear emer/clectronics package there is no correlation between dial position and the number displayed. In addition, the limited viewing angle screen is designed to be ditficult for a bystander to read. Iloth features make the lock more secure. Ir. another design, the dial is om,n com rnarked with numbers, but the number is not electronically f tm Mee displayed. To open tad inn \ [ twpt"," Electronics Design and Security Features ,- .[ sur , O \' O O led - . m. De electronics package consists of a generator or hattery, C""' b - microprocessor, and other circuit components.The functions . of the ek tionics package are to store combinailomiin non. @ Oy volatile rnemory, accept entry of combinations, compare "'' # F entered combinations with stored combinations, recognize O changing of combinations, and activate the unk)cking mecha. - 6(o)" Dme /' nism when a correct combination is entered. Cam kim Depending on the design, the electronics package may also Figure 3 54. Itack siew of X-07 keep track of and display other information such as the number of opening attempts, the number of failed opening attempts, the dates and times of past openings, and which user opened the kick. his information can potentially be used to Re function ofelectronic hxks is the same as that of mechani, determine if the kick has been attacked, e al combination locks: to recognize a correct combination and allow retraction of the bolt. The method by which this is The X-07 lock has three modes of operation: single combina- accomplished, however, is quite different, tion mode, dual combination re se, and supervisory /subordi. nate mode. In the single combination mode, the krk is Power Source perated by a three-aumber combination. %is is comparable to the mechanical combination kick, in single combination - Electronic locks may neceive power from a generamr or a mode, this electronic lock has a full one million possible bauery. combinations. Unlike a mechanical combination kwk the number of usable combinations is not degraded by tolerances in the X 07, the dial is attrhed to a spindle which gces through and combinations which cannot be used because the kick mechanical linkages to drive a small electric generer. Four to sin mechanism may jam, turns of the dial generate sufficient pawer for the electronics. He per is stored by the capritas shown in Figure 3-53. 35 NUREG!CR-5929 ___ _ _ , __ _u - _ : - _ | | 1 lack Technologies in dual combination rm(le, two dif ferent three number com. enhanc e security; these are covered in the hardware descrip- binations have to be entered within forty seconds to operate tion section. A disadvantage is that the electronic hicks neal the hw L.1hir, allows two-person control.1he X 07 has five power to operate. hundred billion combinations in dual combinathm nule. I filectmnic kwks may be vulnerable to certain attacks,includ- In supervhor/ subordinate nuxle, the subordinate combination ing decoding, systematic trial and error, and force, lhese h active only between entries of the supervisor combination. vulnerabilities are described in the Gionary, potential vulner. ' 1hus the supervlaor can control when uuterdinate has access abilities are based on descriptions of the locks and not on to the safe.1he ka L has two rnillion combinations in super. esperirnental analysh, Manufacturers rnay have additional I visor /r-ubordinate nuxle. information. 1here are many other security features of f ered by electronic Unlike e mechanical combination lock, an electronic kick is k r L s. Not all feat u res are of fered on any particular design. For not vulnerable to radiographic attack, Since there h no rne. - imtance, rach user may be aufgned a ddferent combination; c hanically4tored informat lon, a . tsys cannot be u sed to deter. ; a time delay may be required befuse the kick can be opened; inine the cornbination. die lock may be able to be opened only at specified times; a limited try feature may cause the kick to not functhin if an 1he X-07 allows the cornbination to be recoded if the serial inconect combination is attempted too snany times; the krk number of the lock n krown. In contrast to a mechanical may be able to recognise an autmlialer; and a tamper alarm combination hg L, the eshting combination h not a prerequi, may be added. All of these fcatures have potential ..lue in site for changing the combination.'Ihh feature helps prevent security systems. hickout-a situation in which the kick is unusable, While knowledge of the serial number is not suf ficient to open the Dial Anembly krk,it may increase vulnerability to adversary attack.There- fore,it is irnportant to protect the serial number of the lock to lhe X 07 has some notable featuru in its dial auernbly First, the same degree as the infortnation the kick is protecting, ; llere h the liquid crystal display screen and its anociated circuitry, The display screen provides all communication 3.6,3.2 General Design Features Which increnw betw een the loc k and the user. Second, the dial aue mbly hokh Security metal tubes in place which in turn provide physical protection e for the wiring and protect agaimt ekctronle emanations. 1hese design features are quite similar to those for Combina. tion locks, section 3.2.3, Methmk for Iteleasing the 1.ock Mechankm ~ . Knowledgeof thecortect,currentcombinationshould bea Once the combination b properly entered, there are several prerequbite for changing the combination, lhls prevents ways to move the bolt.1hc X-07 uses a small notor to move unauthorlied individuah frem installing a combination of a bkwLing device called a slide. The movement of the slide their cimosing, w hich would allow access at a later time, noves the drop lever below the kick case lever stop and into contact with the gate in the drive cam (see Figure 3-54). The * 1here should be no openings in the case of the kick through bolt can then be retracted by dialing in the direction shown in which a device may be inumluced into the kick body 1his ' the figure. Other locks may use different methods to m.ae the inc ludes change key openings as well as other openings. For bolt. For example, a latch may be closed by spring action, and - mechanical kicks, one concern h that a device could help : , opened with a solenoid; a ruotor driven dead bolt is aho decule the combination. For an electronic k,ck, unautho- por.sible, Still another alternative is for the user to provide the rired operation of the motor or solenoid h a concem. mechanical action to retract the bolt, as is done on mechanical krks. * The combination shouki not be decipherable w ben the krk is open. 3.6.3 Application Consitierations a lhe resistance to systematic trial tmd error attacks h di. 3.6.3.1 - Pros and Cons rectly dependent on the number of usable combinations which may be encated in the hich Some cicuronic kicks 'Ihe elecuonic combination kick has some advantages over are designed to permit huge nu.nbers of possible combina. both mechanical combination hx i s and k ey kick s. it has many tions, f ar more than their mechanical counterparts, features not offered by mechanical kicks w hich can be used to ' - NilRIIG/CR.$929 = 36 . -' ' _ --- _-- - - Y--- InelTechnokyies . The mate,tals used for the construction of permanently Factors w hich afIcet emanations are power dissipation, rise insta!!al combination locks should be high strength and and fall times, wiring, and shielding. high quahty, and exhibit resistance to wear and carrmion. * Precision balancityof thelotk met hanismhelps toinerease 1he f ollmiing f9tures w di provide a hia.h loel ci tell-tale the dif ficulty of vibration attack. to urxthWa en9y; * Bolt mechanisms driven by a motor rather than a solenoid -lhe ku finish should be easily marred. If a le t has a an; less vulnerable to magnetic attac k, finish which P can!y .aranA, u wilt Nvide an excellent indicator of awowiluv% emry. It may 3,(i.4 Slantlat cis ant! Specificallons also indicate sorne forms of sune;Aious cntry. T1.c hick comtrut tion and materialnhould tie such that any See Appendit A for addresses and telephone numbers of the attempt at unauthortred disanembly wdl permanenny o liMiom from which these standards and specifications dktort and rnark the comp > nerts. may be obtained. - Forcible entry should irreparably damage the kick.1his lhe follow ng specifications aresummariredin 3.2.4.*lhough will prevent surrepiitious lurcible entry escept m the sorne parts of these specifications weie written for mechanical case in w bLh a empete replacement kick is available, lock s, they all contain intormation which is also applicable to and can be enuxted with the correct combination irom electronic locb. the damaged one. ASTM F 47176 Standard Definitions of Terms 3.6.3.3 Specific Design I catures Wh!ch increase IWdg m Codinadon ImM Scority ANSI /Ul. 76fl . Underw riters 1 aboratory Standard for 1he ability to recognize and resist opening by autodialers Codinadon la b was one of the original reasom for developing electronic locks. 'l his ean be accornplished with a limited try counter' Mll, t-15596G Military Specification, lab Combi- or by detecting dialing speed. nation,for General Serskes Administration Apprmed " " ' ' . Use of encryption to store the combiruian in a different form after each use sould make it extremely difficult to lhe following specification is required for GS A approval: determine the combination through emanations' FF-1, 2740. Federal Specification, luks, Combination * Featutes such as time delays, time keks, and limited try counters help to restrict access to authorized personnel at 3.7 Atitlltionalllartlware Issues authorized times. 1he purpose of this r.ection is to briefly mention some hardware issues which are associated with, but not cential to, * Ability to report the number of openings and attempted openings can help determine if unauthorized entry has been locks.1he intent is to make sure that the reader is aware that these issues should be addressed. Ilowever, the information is 0 attempted. not presented in depth. . Knowledpc of when a particular user opened the lock, w ith time and date, can help both in attack deterrence and The most important topic is the discussion of commensurate detection, levels of security, Other topics include hinges, screws, hasps, hardened barriers, doors, and door jambs, a Dissociation between dial position and displaye number can make it extremely dif ficult for a f ystander to determine 3,7,1 Conunensttrate Levels of Security the combination. A related factor is limited viewing angle of the display. It is important to match the security of the lock to the security of the rest of the protected container,if the levels of security a lhe use of electronics which have low emanations will of different parts of the system vary widely, there will be a make electronic kicks less vulnerable to a" bugging" attack. weak link for an adversary to attack. For example, a high 37 NUREG/CR 5929 ______- - _ - ______- - ______. I ac k Tec hnologies security deadbott iot t wilt rust enhance the sec urity of a room liasp designs usually vary t onsider ably duc todif ferent mount- if the door is hollow core womi. ing requirements. Ilasps can be either mounted with non. ternovable twilts or welded direct.ly to the door or frarne. Not A typical entry punt for burglars breating into commercial all padloc ks and hasps can be combined, but many are univer. buildings is through a hole chopped through the roof of the sally adaptable. Figure 3 55 illustrates a typical padim L/ hasp bml hng. I aise Iacades give good cover for the operation of configuration, cutting the hole, and rmf entry bypasses allim Ls and portals. 3.7.2 Illnges 1 I s E v /j v v lor security apphcations, hinges snould be manufactured ""E y Shadle f rom strong snaterials, such as heavy br ass, hardened steel, or [ ([ g stainless steel. In general, the more massive the construction - II of the hinge, the more secure the installation will be, ~~ padl 4 #/ "Il llody N Key Mc(hanism llinges shouhl be mounted with the hinge pin inside the % ' protected area, if at all pasible, and hinge pins should be /y eitne spot welded or peened to prevent removal A k L__, la king pins are usef ut in the installation of hinges.These are pins designed to rephace one pair of screws in each hinge.The pin projects from the leaf of the hinge mounted on the door F 3 55. Glaw dew of key padhgk and hasp j amb into the mating hole in the moveable leaf, preventing the door from being removed even if the hinge pins are removed. 3.7.3 Screws 3.7.5 liardened Ilarriers Special secunty screws should be used to rnount security Few hic king devices contain hardened bar riers to deter the use hardware located outside the secured prea and, dependmg on of force. Key cylinders occasionally contain hardened shickis application, sometimes those motmted inside the secured (platet or pins) to resist drilling (see I igure 3-56). area. There are two basic varieties of security screws: those w hic h c annot be removed once installed. and those which may be remos ed only with a special tool once installed. Adversar. ies are hkely to have access to the special tool- 1)till Resistant liardened Steel if screws are used w here they are accessible by an ads ersary, ,-, Shields they should be installed with their heads welded to the device . / dwy are f.ccuring, Screws used for mounting security devices / | should be hardened. If the hardware is mounted on wtxxi, a o ' 7- higher level of r.ecurity may be achieved by using screws long I [f , - enough to embed themselves in the underlying structure, _ |g ' ; , ;} , 1 / - ' ' 3.7.4 Ilasps - - p'/ { < L/ A hasp is a nrtal fastener with a rninimum of two mtim "Ihe j weiorts are attactni to a nunable and a fim! banier or to two i. tr:ovable barrim. Wien the banier(s) is ckml, tie two sectiorts of r de hasp ;ue pw.norn! toneller in such a nunner that the shackle of '([]' ' a p.uthx k can le irwerted dmiugh toth to fasten the two sectiorts tagether. Ordy a few uuiciies of hx.ps are comn rstially available. hkrst are mt compirable in quality (in ternts of tesistance to h ircible Figure 3 56. llardened shleids attack) to tic highwurity pallocks which nught te uvd m fmjurttion with them. NUREO/CR 5929 38 , I - - . _. __ lxick Te(hnokigic> Often padhrk bodies and shac kles are hardened, w ith shackle Cs . exposure ranging from exposed to totally concealed (see IK'or re , Figure 3 57). b' ? . ' ^x / O O , IkO ciB) _- , [- - ;# d_1/ Padhxk with Guard Phtte Ondectron - - O O w _w Lipued Shukle C1med Shai Lie Ikor 1.ock with Guard F*f ' s u _ . Plate Protection f n nygy ' &/'~ ,,, r liardered Recened _ Guard R ng Tapered and I' vee to liointe L__ _: Figure 3 59,liardened guard plates and ringt. / shrouacd shutie Gerendly, the nore n-nrwtd the kick is frun the face of the (inr, the non pnxetted its position. ~1his pmtection can also be pnwided by the use of a guani plate which covers as much of the cylinder as Figure 3 57. Shackle expmure possible w hile still permining the key to he tumed. llartknxi guard rings should be recessal and have sufficient taper ani rotation to withst.ux! fornble defeat, as shown in Figure 3 59. Altnost totally hidden, hardened box like concealment is Safe and vault doors are often desigrui with a hartkinal plate obtainable for padlocks (see Figure 3 58). sumunding the combination kick."Ihe kick is usually emtekkxiin the pmtected container, with rektking; devices suc h as stressalglass covering vulnerable areas. Figure 340 illustrates a hanlened com- - llox 'I.yPc + t>>or rage liardened bination kick Welded to Ibor 11mier i f \ 3.7.6 Doors and Door Jambs % / [f , Ikurs and doorjambs should be of secure constructhin. Many , ! materials are used in the construction of doors and frames, j/ ranging from glass and alu minu m to wood or steel. Doors used ["/ as security portals should be manufactured of heavy duty Padim k material, preferably steel. If wooden doors are used, they should be of solid core constniction. While glass panels in doors are esthetically pleasing, they degrade security consid- etably. Tough plastics, such as Lexan, are more impact Figure 3-58. liardened bm padlock concealment resistant than glass, but suffer other vulnerabilities. For ex- ample, plastics typically cannot withstand high temperatures. Since the anywnt of key rotation for padkicks is smaller than the key rotation for door kicks, the padkxk box can often be if wooden d(xir frames are used in construction, any hardware extended into the key-turning area, providing guard plate secured to them should be installed using screws which are protection (see Figure 3 59). long enough to pass through the trim completely and embed themselves in structural members behind the trim. Iborjambs manufactured from steel offer more security. 39 NUREG/CR 5929 - - _ _ _ - _ . ______- ______- _ _ _ - _ _ _ _ - _ _ lack Technoh>gies 'Ihe door and j amb should fit as tightly as lesiMe, while still sueued Glau operating properly. liscessive space between door and jamb \ container Wall niay provide attack points for an adversary. N ~ y, ' N / N ' - w['A ' s .. ,% 'N[ N s 'j s, .,' s - ' N g'' o- x:p[ | P 4 ~ ~ G x ' %N [Q,/ Change - ' x Keyhole s. liardened flot L Surrounding % Cornbination in k / i l'igure 3 60,liardened combination kick N NUREG/CR 5929 40 - ______-. - ______ i 4 Vaillts i Vaults are generally large walk in structures with either dards for vault construction which rank the thickness of walls, single-leaf or double leaf doors and reinforced concrete and/ roof, floors, and doors in several classes with different con- 1 or steel walls, floors, and ceilings. Vaults are usually located struction options for walls, n>ofs, and floors. In general, as the within a large r structure, however. rm>dular vault designs may semitivity of the vault contents increases, the resistance to be free standing or incorporated into a building structure, penetration of walls, doors, and other elements should also , %ey inay be designed to provide physical security for stored increase. Tne vaults dx)uld be constructed of materials that anets or Gre protection. The designs for physical security afford at least burglary equivalent resistance. , protection and fire protection can be very different. The ! ' following discussion is limited to vault designs which pmvide A design that has been used for some vaults (Figure 4 1)is one protection against physical security threats. having walls, roof, and floor of at least 1/2 inch-thick steel with fireproofing, or 12 inch thick, non reinforced concrete, 4,I Valull Construct |On either of which can be penetrated rather quickly with the appropriate toolsc 4,1,1 Uses Table 41 shows the range of mean penetration times for typical vault walls. The door, the largest opening in the vault, he design of a chosen ktorage vault should reflect the types should provide a!rnost the same delay time as the other major of threats that may be attacking the vault.De kication of the elements. The vaults described above may te penetrated in vault within a facility which has its own phyucal security tieveral minutes. elements may also inlluence a vault design. For example, an exterior wall kication may provide un adversary with a stcahhy penetration path.or permit the use of e xplosives on the wall or 4.2 Wall C.onStruction roof with the same impunity with which he could attack an exterior building wall. 4.2.1 Uses When the vault is emplaced within the building, an adversary Reinforced concrete walls are commonly used as a cost- may be reluctant to use explosives, or may be limited in the effective materialin vault construction for supporting struc- i amount he could detonate without causing structural building tural loads and for deterrence and delay against security failure. Also, early intrusion detection and quick response to threats. Concrete alone has good mechanical properties in . 3 intrusion alarms can offset protection provided at the vault compresslor , but little strength in tension and flex ure, which - itself. are approximately l0% and 20%, respectively.of the value for > compressive strength. Steel reinforcing resists the tensile and 4,l.2 llarthvare Descripilon flexural loading. A vault is generally composed of four basic structural ele. 4,2.2 Ilar(lware Description - ments-a floor, walls, a roof, and a door (s)-which should meet specific criteria for containment of material. In addition, Reinforced concrete walls,8 inches thick of greater, provide . " somo vaults have utility penetrations which should be consid- substantial resistance to hand, power, and thermal tool at- cred as potential entry paths for adversaries. tacks. However, against explosives, thicker walls with heavy reinforcing are generally required. Steel reinforcement can - An important consideration for any vault is a balanced design. extend the penetration delay time against explosives in most All potential entry paths into the vault structures should be designs. Even though the concrete may be penetrated by the designed to provide approximately the same specified access explosion, the reinforcing material usually remains intact to - delay into the interior A standard, industrial pedestrian door the extent that it needs to be removed before entry can be. on a vault constructed of 3 foot thick reinforced concrete is an accomplished. Removing the rebar often requires more time example of an unbalanced design, than is needed to remove the concrete; therefore, using addi- tional rebar, increasing rebar size, or decreasing center-to- De Bank Protection Act of 1968 (revised 1973), the Ameri. center rebar spacing can be advantageous. , can Society for Testing Materials (Standard F-1090), Under- writers Laboratories (UL) (Standard 608), and.the Depart- The amount of explosives necessary to breach reinforced con- ment of Defense (DoD $220-22 M) all have dif ferent stan- crete surfaces increases significantly for wall thicknesses gr eater r 41- NUREG/CR-5929 i ' . , , ,rp.--y_m-w.7-,,-+.-.c,--c, y 7~ws,v..,,, ..as.- .y p- - -- -,,.n. ,,,.-emy Mwe,,.,.,..y ,--.m ,_.- - , - - , , - .- - . . , -e-. -., u-. c mi-. . . . . - - .. . . , . - . - . - . . _ . . . . - . . ~ - . . . . - - _ - . .- - _ - - Vaults Steel Reinforced Concrete Walls, Ibor a.d ceiling _ WallOpening for Air lxxL , * * ' * ". Atarin Corduit i Conduit k' I ard Outlets # NrLl N - I , p ; ,, I, ; - 4> Ster!!)ning ; , i ift auft !.it I " i Pit ior setting i - | and incling thwir |j 4 - ; 'g),P([[,*\"(',',"''d'uoni Wall Opening for renergency Vault Ventilakir Figure 41. T 3plcul vault construction Tahic 41. Vap!! gnetr niion mean times (minutes) Explosives lland, l'ower, Vault Construellon and Toons Tlierntal Tools 1/2" Steel Plate with 4" Fireproofing <5 <5 to 10 8" Concrete Block Deformed Bar Reinforcing <5 <5 to 10's 8" Concrete Ilhick Deformed liar Reinforcing <5 <5 Cores 1 illed With Mortar 12* Concrete with Deformed Dar Reinforcing <5 10's 12" Concrete with Expanded Steel Mesh <$ 10's Class-5 Wult Door <5 <5 ! NUREG/CR-5929 42 , _. . - ~-- - . - - - - - .-- _ _ _ ._. ______ ! ! vaults ' I than 1024 irwhes. Also, the vault structure resistance to Some vault s,urf. ices are constructed with 3h11b/f t3 ot 61b/ft3 penetration can be improved by installing steel liner stall e spanded steel bank vault rnesh with embedded s,teclicinfore- plates, spred w alls, stando!f barriers, and os esburden if the ing smiin a stackal pirement sening as the reinforcing. In structures and location of the vault allow it.1hc use of steel some designs, stect weights with this type of reinforcing can iinert, can significantly improve explosive penetration resis. be greater than 30 lb/f t'. Hgure 4 2 illustrates an esample of tance; howevet, the utilitation of these liners does not necer capanded metal concrete wall construction. , Sat ily allow a reduction in the reinf orced concrete thic knew of | ! the wall. The liner is relatively vulnerable to thermal tool 1 inally, steel fiber reinforced concrete can be utilind for wall ' attack, and cornideration should be given to delay times for construction.1hese materials generally eshibit irnivoved both explosives and other tools, penetration resistance against Iower tool attacks and have ,i i I a | | | - | , r | I | , - , ~ ~ ~ - | n v , s.. , ' i,.. ! ' 4 | - . L i , . < - I ] A , 4_ -. f i _ ; S.- T , s ,. p I | , ra ,. ,- - ; m } % g -* . , . ww.f. ' ' w .. . \ < ~, , '~ U1 m . s ; ~- . , - ; . - >y-j-. _. , ' I W. j _e 2* ! , | l'igure 4 2. Espanded metal concrete wall construction 1 43 NUR[iG/CR-5929 , . - - . - . . _ - _ _ . _ - _ - - _ . _ _ . ._ . . - - . _ . . ~ . - .------~ . - - ~ ~ - I l Vaults penetration tesistance compardble to standard reinforced con- times lighter sections than a comparably rated cast-in-place crete against explosive attack. vault system. 4.2.3 Appi ration Considerallons 4.3.4 Standards and Specificallons I , 4.2.3.1 Factors Which Affect Security See Appendis A for addresses and telephone numbers of the ASTM and UL specifications, Penetrations in a vault structure l.c., ventilation ducts-.may provide a weak point in an otherwise hardened structure. Here are a number of standards and specifications applicable Dese need to be considered in the over all design of the vault. to secure vault construction. In g eneral, penetrations grea ter than 96 in' req uire the addition of barriers to provide delay commensurate with the overall %e ASTM vault construction Standard F-1090 is based on vault construction. the UL Standard 608 for vault doors and modular vault panels. Dese standards specify protection classes based on net attack 4.2.3.2 Design Features Which increase Security times by two skilled and knowledgeable adversaries. Dese standards consider only the use of common hand, power, and increased penetration resistance of a utility port may be thermal tools to determine access delay tirnes. nermallances achieved by the installation of protective coverings such as and explosives are not considered in the tests. ' grills. bars, expanded metalmesh,orscreens.Similarly, grids and grates constructed of steel mesh, expanded metal, bar The protection classes and delay times defined by the UL stock, tubing. orjail bars can be used to reduce the site of the standard areoutlinedinTable4 2. Alsoincludedareconstrue. ! opening in utility ports to less than crawl through sire, tion specifications for each of the protection classes as defined by the ASTM. Grills of 1/2 inch diameter mild steel rebar on 6 inch centers provide nominal delays of approximately one minute against ne Federal Reserve vault specification based on the require- hand tools, increasing the bar diameter to 3/4 inch improves ments of the revised Bank Protection Act requires that vaults the delay time as hand tools become ineffective, and tooling constructed after November 1,1973 have walls made of steel. of a higher category is required for penetration Grills should reinforced concrete, at least 12 inches thick, have weldedjoints and should be constructed with a sulficient nu mber of vertical and horizontal bars so that multiple cutting O M, ih D001'S operations are required to produce a crawl-through opening. Re protective grill should be adeq uately anchored to the wall to ensure that the time required to remove it and the level of . -4,3,1 Ilardware Descripilon difficuhy involved are equal to or greater than the wall penetration time and difficulty. Vault doors are usually classified according to the thickness of solid steel in the door. Security vault doors were formerly liar placement is important in the construction of grids and classified by the Insurance Services Office as 1,3,4, SR,6R, grates, and weight is a limiting factor, if more steel can be 9R, and 10R, with 10R !adicating the greatest thickness (9 1/ placed in an adversary's path, the delay will be greater. Floor 2 inches). grating of 2-1/4 a 3/16 inch steel can provide substantial penetration resistance against hand, power, and thermal tools. Classifications 11,12, and 13 indicate recommended bank Other utility penetration enhancements include barbed tape vault doors; mercantile vault doors were classified as B, C, E, liners or segmented ducts with rectangular or circular pipe, and G.These rank.ings coriespond to classifications I,3, and 5 for security v$ ult doors. Underwriters Laboratories and the Modular vault panels constructed of various combinations of Bank Protection Act requirements set the comparative ratings steel, hardwoods, and precast concrete are commercially for vault doors as well as forother vault construction features.- available. Depending upon specific requirements, these sys- tems may offer construction time, and possibly even cost- 4.3.2 Standards and Specifications benefits, compared to permanent vaults, i De Federal Reserve vault specification based on the require- Some of these products meet the UL 608 penetration resis* ments of the revised Bank Protection Act requires that a vault tance requirements listed in Table 4 2 with thinner and often door be made of steel or other drill- and torch resistant ! I NUREG/CR-5929 44 m - _- _ _ _ , _ . _ __ _ _- . . ______- _ _ _ _ _ Vaults Table 4 2 Protection clanes and delay times UL 60N Delay Tirnes Class (rninutes) Construcilon Specificallon M 15 9 inch reinforced concrete, with a minimum of two grids of number 5 rebar, or two grids of expanded steel mesh weighing 6 lbs/ft2 and having a diamond pattern not more than 3 by 8 inches placed parallel to the face of the stab; or Modular panels, Class M, Burglary. Resistant Vs.:lt, UL labc); and Vault doors with UL Class M Vault Door label. 1 30 12. inch reinforced concrete with a minimum of three grids of number 5 rebar or two grids of espanded steel, as for M; or Modular pancis with ULlabel for Class ! Vault; and Vault doors with UL Class ! Vault Door label. 7 11 N) 18 inch reinforced concrete v ith a minimum of four grids of number 5 rebar or three grids of expanded steel, as for M; or Modular panels with UL label for Class 11 Vault; and Vault doors with UL Class 11 Vault Door label. , 111 120 27-inch reinforced concrete with a minimum of five grids of number 5 rebar or four grids of expanded steel, as for M; or Modular panels with UL label for Class 111 Vault; and Vault doors with UL Class Ill Vault Door label. - _ material at least 31/2 inches thick, and should be equipped allowed for testing against the class 5 vault door are based on with a dial combination hxk, a time lock, and a substantial. . the following entry methods: lockable day gate. Surreptitious Entry. Unlin.hWools and devices, except that g Class 5 and 6 vault doors conform to Federal Specification the total weight of the tools used for a single test shall not " Door Vault, Security / AA D 6000, exceed 150 lbs. Class 5 vault doors afford the following security protection: Coverf Entry. Power tools-clectrical or battery powered- should be commercially available. Drills should not exceed 20 man. hours against surreptitious entry ' 5000 rpm. Pressure rigs with a lever arm not exceeding 30 * 30 man minutes against covert entry inches may be 'used. Tools and devices shall be capable of i 10 man minutes against forced entry being carried in two bags or cases, each of which shall not exceed 1 1/2 ft'in volume, Total tool weight for a single test Testing performed in accordance with specification A A.D- shall not exceed 150 lbs, excluding the cases. lleat.prooucing ' 600B is limited to no more than two men working simulta- tools shall be limited to single tank propane,' butane, or neously during each entry attempt. The tools and devices equivalent devices which fall within the weight and volume 45 - NUREG/CR 5929- . . ' m w wO-Pt+-'T +''t---*'wF-?MW W rv'F-op-was=*-- y - # W e-y'we v-'''TFr P Ww y'''-*Mtv- D- "TT h T *% Tr' W 4 y-rg -y-twy- y y''Tw T-**y- l Vaults - limits specified above. Acetylene,MAPP(Methy! Acetylene a wide variety of portable electrical and mechanical power - Propadiene Petroleum mixture), electric arc, burn bar, or any tools to attack the door. Oxy fuel gas cutting torches are - oxidizer-assisted products or explosives will not be used, . allowed; however, the total gas volume consumed is limited [ __ to 2000 ft' for any one test. Burn bars and explosives are Forced Entry. Tools and devices will be limited to non- specifically excluded from the attack threat. I powered tools only, in addition, the weight of tools and devices used in a single test + Class 6 vault doors are intended to meet the following criteria: is restricted to 150 lbs. The tools must fit within two cases or bags, each case or bag not exceeding 1.5 ft' in volume. There a 20 man hours against surreptitious entry are no limits on the number of methods of surreptitious, a 30 man-minutes against covert entry covert, or forced entry attempted. . no forced entry requirement Other door features include the following: Requirements for the class 8 vault door are contained in federal specification AA D-2757, " Door, Vault Security." . a permanently installed escape device which requires two lhe door may be used as part of a fixed vault structure, or in unidirectional actions, such as push and turn, to activate the - " conjunction with federal specification AA.V 2737." Modular release of the vault door bolts Vault System," to form a removable vault system- . a detent on the locking mechanism to hold the bolts in the A class 8 door should provide the following pmtection: open pasition when the bolts are retracted and the door is swung open 20 man-hours against surreptitious entry 30 man-minutes against covert entry the ability to secure the combination lock with the bolts 15 man-minutes against forced entry retracted and the door open, and automatically throw the bolts when the door is closed, thereby securing the door. The forced entry test allows a knowledgeable, two-person adversary team to use common hand tools, picking tools, and . | . NUREG/CR-5929 - 46 - - _ _ _ - _ _ _ - _ _ - . __. : ..:. - . . .- - . - - . - - - - . . . . - - - -=. - - . .-- - . .i , |~ 5 Safes and Security Containers ;- Significant changes have cccuned in the safe industry over the past ' A 1 * fl'V s$N " few years. New barrier nuterials and krks haw increased security ( m M Ms[k,i\*if(+N "/{|[fM*/f''4~ companxi to previous designs, dj r .jb d 5.1 Uses W .3 .? & W% 4 lt is irnpartant to use a safe, yault, or security emtainer of the proper J level for protection to meet or exceed the value of its contents. De M safe or vault is the last line of defense against an attack. Titre is a burglar's worst enemy, and the beuer the safe or vault, the letter the 4 chances that the intruder's tine will run out. 9. / . p Gercral Services Adnunistration-approved security untairers and s ., safes are available in many styles and sizes to handle a large range g'tiy ' -| of applicatims. a et; .I (d5 ~ - 5.2 Ilardware Description i 4 [Mf' ;9 %g w - Barrier materials are materials incorporated in the safe'sconstruction U** Mi dh N as a means to delay an attacker's prtyress in neu tralizing the locking n ochanisnt ney can be rositioned to protect only thecombination Figure 51. Carbide included barrier plate - lock, or, as in the case of the ultra high security safes, they can be ., pixed throughout the entire door and body The lauer is refened to , as six sided protection. > - 3 Carbide-Included Barners Dere are specific barrier materials for specific duties. Since one of the nost comnnn attxks on safes is the drill, the most common .> = barrier material is drill resistant steel, referred to by many in the f$f industry as "hard plate" By pixing a harderni piece of steel !k /7 between the outer portion of the safe door and the locking mecha- kMbh - nism, effective protection can be attained against a standard drilling kN W i atixk. His type of;m:cetion has been used for many years but is easily defeated by carbide tippeddrill bits and high speeddrill nuors.New high-tech, carbide-included barrier plates ditTer in nuny respects from old industry standard hard plates (Figure 5 1). Carbide-included barriers are one of the most effective barriers against drill attxk. Carbide is the hardest metal known, but used 9 ' alone, it is very brittle. Carbide-included barriers have thousands of . L snull,in egularly shaped pieces ofcarbide in various binding agents, | bonded to and encked in a steel clackling or envelope.De highly irregular surfre of these barriers effectively chews up high speed or i cobalt drill bits, and disintegrates carbide-tipped drill bits (Figures 5- , .| 2, 5-3). Figure 5-2. Plate under attack - 47 NUREG/CR-5929 . . . - - . - . . - . . - . - _ - - ,. .- -_ - - - .- .. -_ .- Safes and Security Containers y p$ n yrgr1 Many manufacturers are switching to concrete because of its w d)%g-w- many advantages. New high tech cement mixtures have been - y 1a j gg/ developed over the past few years that are superior to previous t -g b[W@^ ;c g' 'g 1 recipes. One manufacturer in Florida has tested some of its p 4 , y4 . cd . samples at over 18,000 psi.nese mixtures, which are held ( 2f ;) ?' proprietary by their manufacturers, are meticulously mixed 'M" 1 M $' ;. g^g^I c and cured using precision measuring techniques. This cement | ?"- *< N offers good protection against the most common form of | c thermic cutter, the oxy acetylene cutting torch, as well as drill attacks. $ Manufacturers can add various otheringredients to their super cement recipe such as granite chips, chilled iron shot, and f.. Safe design and construction has drastically changed since the b * If development of this high psi concrete. Doors and bodies can It' L now be constructed of more cconomical thinner steels to form inner and outer walls. The hollow portion between these walls y) can then be filled with cement, which is also more economical .. j than steel. Walls can be spaced at varying distances from each . d other so that more or less concrete can be added for varying , , w 3W,4 levels of protection, r. 'h _ y wy% ; . w a 4.. ~ s - au n Another advantage of this technology is the additional benefit of fire protection offered by the ultra denseness of the cement. Figure 5 3. Defeated drill bit Some manufxturers are now offering one and two hour UL fire ratings on their UI-rated tool. resisting burglary safes. his double rating, coupled with the torch protection of these Sont brands ofcarbide-included barrier plates aho offer pruttetion safes, make them an excellent value. against x rays.~llese plates, which are a minimumof 3/8 inch thick, are effective in slowing x rays due to the denseness of the carbide. New high-tech vault doors are built in a similar manner with While x-rays with sufficient magnitude and exposure time can varying thicknesses for different levels of protection. Most penetmte almnst any s ubstance, in terms ofpanability, space, pow er, manufacturers cast their doors in steel molds which have all and working time, x-ray penetration is unlikely, the boltwork, lock, and hinge mounting plates and bosses placed so that when the door comes out of the mold, the slab Otler types of carbide-incluckx! barrier plates include steel plates is simply wrapped with polished stainless steel or painted with rows of welds laid down by an are wekler using a welding rod sheet metal. locking mechanism and fittings are then in- containing carbide. stalled, and the door is fitted into the steel door jamb. This method of manufacturing is much less costly than the conven. Tungsten carbide and steel powder bonded together form another tional process of machining the door slab out of solid steel, type of banier plate. Still another carbide-inchaled barrier uses a Concrete modular vault panels are cast using the same method process of flame spmying chrome carbide 3/16 irth thick over 3/16 as the door except that finish metals are not installed. . inch thick steel plates. A box made of these plates encapsulates the combination lock on GSA-approved security containers. Glass llarriers Concrete Barriers Glass barriers are one of the most effective deterrents to any penetration attack. Although they are not drill resistant, torch Burglary-rated safes and vault (kxxs ccxistructed of heavy steel resistant, or explosives resistant, they can offer protection plates arc expemive to poduce and off er little protection against the from all of these attacks. Tempered glass plates (Figure 5-4) oxy-acetylene cutting torch. Insteal, concrete barriers are becom- are mounted between the door slab and lock mechanism with ing popular in the safe and vault industry. cables connected to them (Figure 5-5). At the other end of i these cables are devices called "relockers." ! NUREG/CR-5929 48 i ! , ______. _ ...... Safes and Security Containcts K f Wf*y'~''k[s?W ' ' ; ' ~ } . - f^ (R$ & tM f g& w:- ;ML , _+ .y w%,g . :pxAg- ky ay , yyy q& >q n. +> | Y} ut e * + e*~ +*' ^ q.;;g* ;3 , . N , hidi h5 .. a I'.p j ty g.;y;p q y g y - V d- ' s Igh gnfsyk g - f Pk j V ? $' %% @Mdf & h%f37y . . ~w , i auxL;h g 3g - Figure 5 5, Glaw plate with cable Figure 5-4, Glaw plate for keylock 5.3 Application Considerations . ";he relocker is a secondary spring loaded or " deadlocking" Class 6 containers are generally good for storage of classiGed device. Itsjob, when released,is to block the movement of the and secret iniormation, documents, small devices, etc. Ilow- kx; king bolts. Even if the combination kick were to be blown ever, different government agencies have varying guidelines e off the back of the door, the kicking bolts would still be held concerning selection of a particular class of security contain- in check by the rekxking device. The cables running from ers. Factors such as location, alarms, and security patrols may gmmmeted holes drilled through the glass keep these rekickers affectselectionrequirements. Avallableclass6containersare in a cocked position. Any attack would cause the tekickers to as follows: inst mtaneously fire into their kicked F>sition. * Site 1 2; drawer, legal size As the use of glass has become known to some of the more Size 11 4 drawer, letter site sophisticated safe crackers in Europe, they have started at. = Sire 111 4-drawer, legal size tacking the safes frotn the top, sides, and back, utilizing * Size IV 5 drawer letteraire . precision drilling and long boroscopes (inspection lights) to Site V .tdrawer, legal size aid in defeating the rekickers. Manufacturers have responde,l Size VI 2 drawer, special size (mobile) by installing multiple glass plates interconnected via th. . Size Vil 1. drawer, special size (mobile) cables so that an attack from any direction woukt activate the * Size Vill 1 drawer, special site for Geld use relockers. * Size IX 2 drawer, letter size 49 NUREGICR-5929 - , , -. .-.. . - . . . , .. .- Safes and Security Containers Probably the mos t conunon is the class 6 standard legal size 4- . ,. or 5-drawer cabinet with single lock (Figure 5-6). gf " bg@@iy q p * v gg * w a M; _. - Mi 5 Q W M- , Figure 5 7. A dual-lock cabinet Figure 5 6. Standard 4 drawer single lock cabinet Dual-multiple lock containers (Figure 5-8) have indepen- dently controlled locking drawers with each drawer having _ one or two combination locks. These containers can be tai- I red to the user't, requirements. For example, the cabinet can 'Ihe class 6 scope of products has the largest choice ofoptions from have two drawers equipped with dual locks for dual custody which to choose. Single lock designs have one drawer (control and the other three drawers equipped with single locks, drawer)cquipped with a single combination kick. When this drawer is ckwed and locked,it secures all other drawers."Ihese cabirets are hiultiple lock cc, tainers (Figure 5-9) have independently available with 5,4, or 2 drawen. Special size 1. and 2&awer controlled locking drawers with each drawer havmg its own cabinets, designed for mobile applications, are also available.Dese Individualcombinationlock Multiplelockcontainerscan be cabinets should be anchanxi to the vehicle or aircraft via the pe- used for applications where multiple users. not requiring a lot drilled holes in the bottom. A singledrawer field safe is available that of stot age space,can have their own drawer in a single security has a steel shield protecting the lock and bolt control handle as well cn ner. as lifting haMles that hinge up for easy canying. Class 5 security containers and safes (Figure 5-10) offer Another locking design is a dual lock, and has two combina- pr tecti n against forced entry and may be required by some tion locks (Figure 5-7). This design provides for dual custody government agencies and the military m applications of" Top - of a container which requires the presence of two authorized , Secret" protection. As m the case of class 6 contamers, individuals to gain access. As with the single lock design, one circumstances may dictate class a protection. Class 5 security - drawer is equipped with the locks and controls all other containers in 2- and 4-drawer legal size are the only file # * ##*' cabinet type containers available at the time of this printing. NUREG/CR-5929 So - _ _ - _ _ _ _ - _ _ _ - ______. . _ . _ .._ . . _ . .- . _ . _ _ . _ . i 3ges ud Security Conuincts ' . , ;;[ ;.. , r . , - -~r ww >. 1 i3, }; :. e%ekem ,vue ; y s .: = 19~ ' ;q ~ .f;)f f :,;Y .Qe| . : 3 g ,g .,. ; c n. + - - /t , a.a. ' ' ' 'W 3 *'5'.4- p j ~~ - wpy, . e ,*' DN i ,4 N. , a 1 ' ej ,_- ; ' ;. ' ; . \ ' . ' - - }j'[ g ) . J., ., ' , t Y,' , , .- , . , ,, \ h_ ; ;, ?. _, a >' , Q e a.w . . r f*', I < g3 .fw . = , , i =9-- f.d y ,\ . 7 .gg " '; , .g- ~;u. , ] :g 4 g}g-'( ,; : 4 u' 1pt; i ,e (jgi7, w. : e , .. g , y:y 1A Ek y .- , . . , . ~ . ! > CTi, - tc . 4 nSO %, V; , N .i < i. 17 '. e sd sM. g 14, ks?.: it jd " 797 ;;;wss+k.hkW y i s+w% - - 'N g Figure 5 3. A dont multip eg kwk cabinet Figure 5 9. A ""gggp ge kwk caunct , _? '"" I'l ; ~:" [email protected];. y , M f.'! ,z , y , , a n Figure 510. Class 5 safe 51 NUREGICR-5929 . - - .__ . - __ . _ - - _ _ __ Safes and Security Containers ' '' Class 5 general pur}ue safes can be used far a wide variety of r -g i applications including starage of narmtics, funds, and bulky sensi- ( . tive items. Dese safes can be fitted with a wide range of interior 0 1 - equipment to cmform to many applications. Class 5 map and plan files (Figure 5 1 I) can also be custom designed with many interior {M 4; 3, ,* cmfigurations. Drawers can be added to store such items as s ' computer tapes, microfilm, and filing cards. ']1 Wh' 1 (:y. ,ek - @I E: i ? hillil! Hit >k,. : . ;u ;> .: h ? ; ! Q' a , r> m ; %'.' l l. : 4 ,* i W .8 i ' q w~nt s 1 ; Id.d$h N,k s , ' , gffy'YfJ d'Nh .. ,t Figure 5-12. Class 5 weapons safe [ gqp, 6 Ap p ' ) safe and lock opening equipment, such as drilling rigs, re. Figure 5-11. Class 5 map and plan quired a reassessment of materials, designs, and construction. Drilling equipment, which had been previously ignored by government testers, has now been included in 358G. As a * e . Pl agn the candy manufactumd Another common application for these safes is the secure em nas am almost imposstW to penetrate, storage of weapons and ammunition. Interior arrangements are available for military rifles and automatic weapons (Fig- ue .ssu arria matnia forced anotherchange.m ure 5-12). A properly configured weapons safe can store a design. and construction. Since drilh,ng methods of entry are totalof 36 M-16 rifles. unsuccessful, m the case of a forgotten combination or lock malfunction, the entry method involves totally destroying the 3.4 Standards and Spec,ficat,onsi i drawer head. Therefore,35SG ealls for the drawer heads to be removable and replaceable (Figure 5-13). 5.4.1 Specifications of GSA Security Containers ne locking drawers manufactured under 358 F for class 5 and GSA approved security containers have undergone some 6 containers could be drilled and repaired to DOD specifica- notable design changes since the enactment of the new Fed. tions as outlined in the Industrial Security Manual for Safe- eral Specification A A-F-358G.This specification superseded guarding Classified Information, DOD $220.00-M. These the old specification AA-F-358F. (The old specification will 358F drawers had the drawer pan welded to the drawer head, be referred to as "358F" and the new specification will be and were expensive to replace in the event that untrained referred to as "358G" from here on.) personnel had to destroy a drawer to g ain entry,358G contain- en can be opened by less experienced personnel (with proper in the almost 18 years that passed before 358F was revised, a instruction), and can be more economically repaired by re- number of factors contributed to its revision. Availability of placing only the drawer head. NUREG/CR-5929 52 , - _ __ - - ______- - -.- .- . - . _ . . . - Safes and Security Containers A new specification has been added to 3580, termed " Covert vault in a battery of tests. Underwriters Laboratories (UL) Entry? Coven entry is defined as "a method of entry which tests safes and vaults against a stopwatch to ascertain if the would leave evidence, but would not be detectable by a user given sample is worthy of a particular level of compliance, during normal use, but would be detectable during inspection ne UL labeling system lists the qualifying net working time by a qualified person? Tools and equipment that are used by limits on the labels. For instance, a UL Tlel$ label signifies professional safe technicians (or illegal safecrackers) have that a safe has qualified for resistance against tool (TL) attacks been incorporated into the covert entry testing program, for a net working time of 15 minutes. Net working time is the actual time spent attacking the safe. Time spent setting up 358G has also increased its " total tools allowed'' in testing to drilling equipment, delays encountered because of tool fail- 150 lbs which can be carried in two tool cases with a volume ure, etc., are not counted in the test time. UL offers a total of of I-1/2 ft' cach. 358F allowed 25 lbs of tools that could be ten labels for burglary rated safes: | carried in one tool case 1-1/2 ft'/9 in. thick. A typical covert entry would include pulling the dial and drilling a hole to open (1) TL- 15 the lock, then replacing the dial and lock parts with ones (2) Deposit Safe | identical to the original. The user of the container would not (3) TL-30 be able to determine that the safe had been compromised. (4) TL-15x6 Ilowever, a thorough inspection by a professional safe tech- (5) TL-30x6 nician would readily determine w hat had been done. (6) TRTL-30 (7) TRTL-15x6 5.4.2 UL Standards and Specifications (8) TRTL-30x6 (9) TRTL-60 Underwriters Laboratories labels safes according to UL 687, (10)TXTL-60 Burglary Resistant Safes. ' he most common of these labels are the TL-15 and the TL- In the commercial and banking field, safes and vaults are rated 30. Safes bearing these labels offer protection in the door and by the time it takes to successfully compromise the safe or front face only. Tools used in the attacks consist of common O D g gg p. g 4 . '7 i * ' 10(2) hhk Wh$ % \ i3 -[[ t* [ 21 , % YLO N 29 (2 ca. side) N 18 28 (2 ca. side) f[b in' i 5 , 7 , , 17 , TO $i, - O ;g '20 if- - ' 16' k'D % \ t . 7 13 IS 25 26 , | Figure 5-13. New style removable drawer head l 53 NUREG/CR-5929 - _ - _ _ _ _ - _ _ - _ - _ _ _ _ - _ - _ _ _ _ _ - _ Safes and Security Containers hand tools, portable electric tools, c arbide drills, and pressure ne TRTL-60 is the same as the TR'It 30x6 except that it applying drill rigs. The TL-30 must also provide protection offers and additional 30 minutes of protection on all six sides, against abrasive cutting wheels and power saws. Finally, the TX'1L-60 offers protection against torch (T), nitroglycerine and other high explosives (X), and all the tools The Deposit Safe is a type of safe w hich has a built-in deposit listed for the other labels (TL) for 60 minutes. In addition, it mechanism to receive deposit bags and envelopes. Its test is must weigh a minimum of 1000 lbs and be equipped with a the same as the TL- 15 but also includes testing against fishing UL-approved group 1 or 1R combination lock. At the time of and deposit trapping attempts through the deposit mechanism. this writing, there are only two manufacturers building these UL-rated safes: one in England and one in Israel. There are All the previously mentioned safes are tested on the door and even safes built to standards exceeding those of UL. front face only.TL-15 x6 and TL-30x6 afford protection on all six sides (x6) and are the newest labels added by UL These 5.5 Management of Security Contain- safes are tested using the aforementioned tools as well as abrasive cutting wheels and power saws.These new labels are crS and SafcS - a direct n:sult of the new composite and super concrete construction. Although management systems will differ from one govern- ment agency to another, standard basic practices should be ne TRTL-30 requires protection from all previously men. followed. GS A-approved security containers should be used tioned tools, plus the oxy gas fuel cutting torch (TR). The for safeguarding all " Classified Information" (top secret, TRTI-30 provides a requirement for the body to be encased secret, and confidential). Security officers should maintain a in a minimum of 3 inches of reinforced concrete. The total currentlist of all classified storage containers by serial number weight of safe and encasement is not to be less than 750 and their locations (the building and room nu mber wherc each pounds and should be equipped with a UL group 1 or IR container is located). Containers will bear no extemal mark- manipulation proof combination lock. This safe is tested on ings indicating the level of classified material authorized to be door and front face only. %e remaining four labels are tested stored therein. on all six sides. Good security practices are that security containers and safes TRTL-15x6 and TRTL-30x6 safes are attacked by all the should be located in non-congested areas and should be free ' previously mentioned tools and cutting torches on all six of any clutter or items stored on top of them. No calendars or sides. The last two UL labels are the highest safe ratings pictures should be hung on any security container, offered, but no American manufacturer builds a safe of this magnitude of protection. NUREG/CR-5929 54 - _ _ - ______- _ .. . . 6 Management of Lock Systems The purpose of this section is to describe some of the impor- Possible threats may include terrorists, competing com- tant aspects of managing locks. Policy and procedures play a panies, insiders, and burglars, and attacks may be forcible major role in lock effectiveness. An organization which does or surreptitious. not have a systematic method of lock selection, maintenance, key and combination control, and access authority will not ne policy also needs to state what assets and information have a secure locking system. Effective policy and procedures are most important to protect. Different levels of protec- should also cover other issues, including security objectives, tion are appropriate, depending on the consequences of trade-offs between security and convenience, and responsi- losing panicular assets and information. The most valu- bilities of management and staff. able items may need sufficient protection to stop an attack w hile it is occurring. For less valuable items, it may be De ideas presented below apply primarily to companies or sufficient to have knowledge of an attack after it has -- organizations in which security is both crucial and complex, occurred. The ideas are not by any means exhaustive. As is appropriate for this NUREG, locks are covered in more detail than other Security and convenience need to be traded off in a aspects of security, conscious manner. For example, master-keyed locks provide convenience, but reduce security. Combination 6.1 Management Issues Common to All locks take longer to operate than key locks, but they can increase security. It is not appropriate for the policy to ,fypes of Lock Systems specify which locks to use. Ilowever, the policy needs to contain enough guidance that such decisions can be made 6.1,1 Management Policy by knowledgeable lock experts. As discussed in section 2, locks are an important part of a Access Authority physical protection system. A management policy is needed to ensure a systematic approach to all aspects of security, In any physical protection system, it is fundamental to including locks. Such an approach can increase effectiveness allow access only to those who need it. One person, or at and reduce cost particularly in complex systems, most, a small number of people, should have the authority to determine who needs to have access to each area. The Only the high level management of a company can determine need for access should be reviewed penodically. the priority of security compared to other important matters. Consequently, management needs to make policy decisions Changing the Lock or Combination on security. Subordinates can present options and implement the policy, but management needs to make the difficult The policy should state under what conditions locks need decisions on how much security the company needs and can to be rekeyed, replaced, or have the combination changed, afford. This should clearly be done if there is evidence or s uspicion th at the security barrier may have been breached. In organizations where security is important, the policy needs llowever, there are less threatening circumstances in to be effectively communicated. Management and staff need which it may be useful to limit access. Such circum- to understand their responsibilities. If employees are to be stances include an employce who no longer needs access ; held accountable for certain aspects of security, such as lock one who has retired or left the company; a disgnmtled keys and combinations, and reporting of irregularities, this employee; or one under suspicion. accountability needs to be made clear. Keys and combinations should be c hanged periodically if Objectives important assets or information are being protected. This should be done even if there is no specific event to trigger To keep things in perspective, the management policy needs the change. to state the credible threats to a physical protection system. 55 NUREG/CR-5929 Management of Luck Systems 6,1,2 Implementation-Turning Policy into the security system, other areas may be sppmpriately covered Apgjon by procedures. Designated Cimtrol Officer or Security Organiiation 6.1.3 Maintenance and inenfory in companies where security is impirtant, it is crucial that Vulnerabilities can be intmduccd due to wear and tear.corro- someone have the primary iesponsibility for making sure the sion, and lack of preventive maintenance. These vulnerabili- management pilicy is implemented. Whether it is a part-time ties can cause several problems. First, a failure can be made job for one person or a full 4imejob for a whole organization credible, if a poorly-maintained lock is broken, it could be depends on the site of the task, and how much can be attributed to the condition of the lock, rather than to adversary delegated to line organizations. If one person has the respon_ attack. Furthermore, an adversary could forcibly open the sibility, it will probably be necessary to train an alternate. For lock, then substitute a non-working replacement lock. Sec- the remainder of this section, the term Desigt ated Control ond, an adversary may be able to open the lock if he dials a Of ficer w ill be used w ith the understanding that more than one combination or uses a key which is close to, but not eaactly, person may be needed. conect. Finally, a poorly maintained hick can be difficult to open by an authorized user. When a lock is difficult to open, The Designated Control Of ficer is responsible for pla..ning, it is also difficult to verify that the k>ck is kicked,intraiucing operating, and maintaining on access control system to meet another vulnerability, management policy. His person should be responsible for making decisions such as the types of access control,includ. Maintenance operations should be done in house. Using out- ing hxks, alarms, and monitoring devices, to be used in each side contractors to maintain the security system can signifi- area. This per>on needs to have technical expertise, but may cantly increase vulnerability, need help from other e xperts. The Designated Control Ot ticer should not be a dictator;instead, he/she should regard it as his/ R eg ular maintenance on k ey loc ks will help to avoid mec hani, her duty to provide viable options to meet the needs of the cal failures, if management policy requires cylinders to be company. perimhcally rekeyed, some maintenance will be done in conjunction with rekeying. Maintenance for key kicks which The Designated Connol Otficer should hase the ultimate are one part of a high security system may only be necessary restunsibility and authority to ensure that procedures are if a h(L fails.When a lock is part of a security system which followed and reflect policy. includes guards, alarms, and fences, this may be acceptable. Procedures Combination locks should be regularly inspected for signs of attempted defeat, including insertion of devices which w ould if the security system is complex, procedures need ta be assist in decoding the combination.This may conveniently be established which implement management policy. done whenever the combination is changed. The primary danger o' procedures is that they can become Maintenance records should include h)ck failures, especially lengthy and bureaucratic. When this happens, they lose their " fail safe" failures in w hich the failure compromised security. value. It is crucial that pn>cedures do not camouflage the in this type of failure, a post mortem should be performed to entical issues in their desire to be complete. provide information about which component of the kick failed. lock-out failures should also be noted, to determine if He most valuable procedures are written by the people who higher than expected rates of failure are occurring. are responsible for following them. Guidance should be provided on w hat is important. llowever, people responsible The inventory required will depend on seseral factors: the for implementation are best able to decide w hat to do, w ben to number of kicks to be maintained, the availability of replace- do it, and what records are appropriate to keep, ment parts for the kicks selected, and the skill level of the individual or individuals performing the maintenance. If the Suggested lock areas to be covered by procedures include Key maintenance personnel are highty skilled, and there is a ready Lock Conaol, Combination lock Control, Loc k Monitoring, availability of parts ior the locks used, the inventory required Compensatary Action (what to do in case of h>ck failure or will be small. On the other hand,if the maintenance personnel suspected attackh and Auditing. Some topics to include are merely replace entire h>cksets.or if the kic ks selected are non- covered in sections 6.2-6 6. Depending on the complexity of standard in some respect-e.g., a proprietary keyway design- -the inventory needs to be correspondingly larger. NUREG/CR-5929 56 ______. ______- - _ _ _ Management of Lock Systems De inventory of replacement parts ma) be broken down into 6.3 Issties Specific to Combinatlon two classificauons; sensitive parts, such as keyed cylinders and cut keys, and non-sensitive parts, such as bolts, latches, Lock Systems and strikes. It is accep>able to lock non-sensitive items in cabinets providing lower security than that necessary for This section discusses some of the management issues which sensitive items. Keyed cylinders and cut keys should be are important to combination lock systems. Depending on the protected at a security level commensurate with the items they application, some or all of these issues should be addressed in will eventu ally protect. Master keys should be protected at the any procedure written for combination lock control, highest security level of any item they may protect. Master keys issued to personnel, such as security forces, should be . De combination should be entered in a way that prevents inventoried often, perhaps daily, bystanders from observing the combination. De Designated Control Officer should be the only individual . De combination should not be written in an unsecured authorized to purchase, or permit the purchase of, replacement place, such as a Rolodex file or on a slip of paper in a desk parts. drawer. * ^v id f b ys 6.2 Issues Specific to Key Lock Sys- , ph nu rs o,jnus c nmbinations., , ecu suj,h as_ b)n icms bers, etc. His secion discusses some of the management issues which Keep track of previous combinttions used for a lock, and do are important to key lock systems. Depending on the applica- not use them again. Also make sure there is no pattern. tion, some or all of these issues should be addressed in any procedure written for key lock control. . Up-to-date records should be maintained which include lock identifiers, lock location, people who know the com- . Key and lock inventory should be done periodically under bination, and the dates of changes. A cross reference of normal circumstances, and if any breach of security occurs people who have the combination of various locks may be or is suspected, useful. If combinations are recorded, records should be protected to at least the highest level of protection that the . Each key should be clearly marked "DO NOT DUPLI. combination lock provides. CATE." . A fundamental principle of security is to allow access only Keys should have an identifying number stamped on them to those who need it. For combinition locks, people who for inventory purposes. The number should not indicate need the combination should memorize it, and access to the which locks can be opened with the key, combination should be denied to all others. Keys should be stored in a protected facility. Recording the combination potentiaby provides access to people who do not have the nead. The main reason for -Protection should be at the same or higher level as the recording a combination is so it can be retrieved, especially highest level of information or material to be protected. in an emergency. Storing combination records in a separate secure container decreases the vulnerability if access to the -Only the Designated Control Officer should have ac- s+ parate secure container is limited to those who need cess to key storage. access to the original lock. Ilowever, the most secure method is to not record the combination at all. -Storage should be systematic to enable rapid inventory ofkeys. Not recording the combination works best when several people know the combination so it is not easily forgotten. . Up-to-daterecordsshouldbemaintainedwhichlistallkeys, locks, identifyinb numbers, and personnel having access to . It is more secure to select the combination using random keys, including dates of access. It may be helpful to include numbers to avoid patterns, obvious combinations, and ' cross references which allow determination of all of these previous use, records starting from any one. For a large system, this is particularly important. . All combination locks should be examined periodically for insertion oldevices which would aid in decoding. 57 NUREG/CR-5929 .- . - . -. . -. .- . ._- -_ - Management of Lock Systems 6.4 Lock Monitoring 6,6 Auditing Dis pnredore s!x)uld cover de ck. tails of clurking that krks are ne purpose of an audit procedure is to make sure that secunx1, typical!y at the erx! of the w(rk day, it is imprtant that management policy is being implemented. Ilowever, there are personnel te trained to krow exactly how tic krk shouki be effective and ineffective ways to accomplish this, nunit wed. For mstance, c discovering individual to keep guard until reinforcements , , . Another way to make an auditor effective is to give him/her " "' authority to change, or at least influence, policy and proce- dures. When an auditor performs an audit, he/she will dis, a Determining the probable cause of lock failure will help to cover practices m an organization that could benefit the whole avoid taking unnecessary and costly action.The failure may be due to normal causes or obvious adversary attack, in company.1f these practices become widespread, the company cases of suspected surreptitious attack,it will probably be {mproves, the organization which on,g, mated the practices is _ j ustifiably proud, and the auditor is more likely to be regarded riccessary to contact knowledgeable experts. as an expert helper. * After the cause has been determined, it is important to determine if the failure could be avoided in the future. It may be appropriate to change policy or procedures to avoid recurrence. NUREGICR-5929 58 i , , . . ., . ------. - - . . ----_ i __ -- . -.- _ - 7 Safety Considerations of Locks This section ailresses safety cmsidaations of krking systems. Different actuating devices include a panic bar, push pad, and p;ddle Some use latches, some use deadbohs, and some are 7.1 ConflictingNeeds akenui Most are mechanical, but sont are electrical.%e oint. ton of Certified Exit Des ices lists the & vices w hich meet sprifc standards A sununary of this directory can be found in section7.2.4. To protect human life in an energency, the Uniform Building Code, the National Fire Code and the Life Safety Code, along Even though many options are available, emergency exit devices all with most local building codes, stipulate that a (klor which may have a comna ftmetion to aHow an able-bodied pern m the be used for an emergency exit should not be locked or otherwise secured in a manner that prevents emergency egress w hen the jnsi& to open the doorin an emergency situation,even if the person is in a parucked state of nund. area they serve is occupied. Emergency exit devices should satisfy tirir own safety nquire, When both safety and security are at issue, there is an intrinsic rnents.Dey shoukt fail safe, and should not be dangeruus to people conflict: the nrasures w hich add safety will often degrade security. using them. These requirements are detailed in section 7.23, St ndardsandSpecifrations. Emergency egressshouldtecarefully considenxlin detemuningthe types of krks to be used in a scurity system. I.ocked doors present 7.2,1 1lardware Descr. t.ip ion two specife hazards The most common method of poviding safe exit through a door (1) They prevent egress of personnel fmm the emergerry. which is nonnally locked is the use of a panic bar (Figure 7-1), also known as acrash bar ar cross bar.When a force is applied to tl e pmic (2) They pcvent immediate access to the area by personnel bar in the direction the door op:ns, the bar releases a latch, allowing assigned to mitigate the emergency. the door to open. On the oder hand, devices installed to provide emergency ingress and egress increase vulnerability. Typically, it will be easier to successfully attack a door which has such a device. In addition, the device allows an intruder to freely leave the building.%e door may als o be left open for unauthorned individuals. C., Safety ar d security should therefore bebalanced.The installation of a Ygh cost, high security system nuy not bejustifiable if the system will be &grackxl because of safety requirements. 7.2 Emergency Exit Devices a% Safety requirements are typically nrt by installing enrrgency exit o , devices on doors which should usually remain krked. Rese devices allow doors to be readily opered from the inside during an ; emergency. De Life Safety Code nx)uires the emergency exit device operation to be obvious, even in darkness. Some devices M / degrade security rnore than others.1f an appropriate energency exit ' - device is chosen for a given application, safety needs will be served, and security will be degraded as little as possible. Dere are many emergency exit devices in the commercial market. L ney fit dilTenent types of doors, with different ancillary hardware. Dere are also several difTerent mounting styles, including rim, Figure 7-1, Rim-mounted panic bar . mortise, surface vertical rod, concealed vertical rod, and combina- tion. 59 NUREG/CR-5929 -_ _ - . Safety Considerations ofImks A push pad with an alarm is shown in Figure 7 2. In buildings which are protected by an approved automatic fire detection system or automatic sprinkler system, the Life Safety Code may allow the installation of a time release - [ mechanism to improve security. When the emergency exit device is actuated by a person wishing to exit, an irreversible 9" process is initiated which will release the lock within 15-30 seconds. %c time delay may allow security personnel to arrive before the individual activating the alarm can leave. Bere are several conditions which must be satisfied by a time . . ever there is loss of power, Third, the Life Safety Code allows g this type of system to be used only in low or ordinary hazard areas. s / 7.2.2 Application Considerations " 7.2.2.1 Pros and Cons Panic bars do not increase access to an emergency area.Other (r methods, such as readily available keys, should be added to allow authorized personnel access to mitigate the emergency. An electrical release mechanism increases access to the emer- Figure 7 2. Push pad with alarm gency area as well as allowing personnel to exit. A method of providing both emergency ingress and egress is Alarm systems are subject to false alarms. nese are not simply the use of electrically opented bolts, strikes, or latches which a nuisance, but degrade security in two ways. First, security are designed to be fail safe. A further option is to use an personnel may regard a real emergency as just another false electromagnetic lock, which is intrinsically fail safe. These alarm. Second, security personnel responding to a false alarm devices allow an operator to release the door in an e mergency, are not available to respond to a real emergency. Rey release automa:ically when they lose power, and can be designed to release when a sensor, such as a fire or radiation One vulnerability of emergency exit devices is that an adversary sensor, trips an alarm. may use them to gain access. For example, the adversary could use a stiff wire to apply sufficient pressure to the device,causmg To meet the Life Safety Code, the electrically operated de- it to operate.This may be accomplished if the tolerances in door vices should also have some means by which a person on the fit are sufficiently large to admit the wire,or if the adversary has inside can release the lock. One method is to install a mechani- sufficient time to drill through the door. cal panic bar.The mechanical panic bar also has an electrical equivalent: the motion of the bar actuates an electrical switch, Another vulnerability is that a person on the inside could leave which releases the door. Care should be taken to insure that if the door unlocked for unauthorized personnel, the panic bar is pushed at the same time as electrical release, the mechanism does not jam. Electromagnetic locks and electric bolts, strikes, and latches may be vulnerable to attacks on wiring and power supplies. There is another type of electrical panic bar which has no Some are vulnerable to magnetic attack.These vulnerabilities moving parts, it operates using body capacitance to actuate are described in the Glossary. the electronics. It is adjustable to be sensitive enough to operate properly through gloves or heavy clothing. ilowever, 7.2.2.2 Design Features Which Increase Security to guarantee that this device is fait safe, it must also be equipped with a mechanical switch which can release the * Doors should fit their frames with very close tolerances. No latch, space should exist which will allow a shim or wire to be inserted past the door and into proximity with the emergency exit device. | | NUREG/C!l-5929 60 - ____-_ - _ _ _ ..___ _ - . . .___.m _. _ _ _ - Safety Considerations oflocks * It is important to select a locking device which allows no meet all requirements of ANSI /BHMA A156.51984. The more access than is actually needed. For instance, suppose only additional test is a torque test to insure that excessive - a particular door is used only as an exit. In this case, there force is not required to open the latch with a key. is no reason to install a lock which can be opened from the exterior if such a lock is installed, it degrades security. The requirements for Grade I hardware are significantly increased over UL 305. Grade 1 must pass the same cylinder . Status monitoring and alarms should be installed to give test as Grade 2. Grade 1 must be cycled 250,000 times, instead # indication of the position of the latch or bolt, and the door, of 100,000 for Grade 2 (and UL 305). In addition, Grade 1 If only the position of the door is detected, the door may be requires a security test in which the device must function left closed but unlocked. properly after an attempt is made to forcibly open the door from the outside. Grade 1 also requires an inside pull test and A simple method is to install a sensor which will not allow a push test, which make sure the device functions if unusually an electric bolt to extend unless the door is shut. For an large forces are applied to the exit device from the inside, electric strike, a sensor can detect if the latch is in the recess. While these sensors do thejob for which they are designed, Finish testing includes salt spray, humidity, pencil hardness, they would be quite easy for an adversary to defeat, and perspiration. The standard does not describe these tests, but does provide references to the appropriate standards and * For electrically operated devices, status monitoring should specifications, include whether the lock is on backup power, as well as whether the door is secured. A list of definitions for panic device hardware is supplied. Design features which increase security of electrically His specification may be obtained from the Builders liard- operated locks are presented in sections 3.3.4 and 3.5.3. waie Manufacturers Association. - * Astragals are devices which mount to the edge :f a door and ASTM F 571-87 Standard Practice for Installation of extend over the outside of the doorjamb.ney are designed Exit Devices in Security Areas to cos er the space between the edge of the door and the door jamb, to prevent anything from being inserted to actuate the This standard provides information for the installation of exit emergency exit device. Astragals are also used on double devices used in security areas with the goal of achieving the doors to cover the space between the doors, greatest security possible without violating safety require- ments. High level security is not always possible if exit ' 7.2.3 Standards and Specifications. devices are required, but some types of devices are more - secure than others. This standard gives information on what See Appendix A for addrestas and telephone numbers of the exit devices to choose if both security and safety are important organizations from which these standards and specifications factors.- may be obtained. This standard also offers installation guidelines for doors and ANSI /IlllMA A156.31989 American National Stan. frames, associated hardware,cxit devices on single and double dard for Exit Devices doors, and exit locks. Pertinent information is provided con- cerning exit device functions, optional security features for This standard provides operational and security testing and exit devices, and fasteners used in installations. grading for exit devices. All hardware described in this specification should, at minimum, meet all requirements'of ne following information on exit device functions pmvides UL 305, Panic liardware. Eleven types of exit devices and six an example of the type of _information contained in this -types'of ancillary hardware are named.' Twelve possible standard. Functions of exit devices range from those having functions of the different types of hardware are described. The no operation on the exterior side of the door, to those which ~ simplest fu nction is exit only.The other functions include how can be operated by a knob, lever or thu mbpiece on the ex terior i entrance from the exterior side is accomplished. side. The most secure devices are those which cannot be operated from the exterior side. These are called " exit only he requirements for Grade 2 hardware (the lower grade) are devices." The second most secure are those operated only by approximately the same as UL 305. The differences are that key from the e xterior side. Least secure are those which can be this standard adds a cylinder test, and is slightly more specific left unlocked, and can be operated by a knob,' lever, or on the other tests.The cylinder test requires that the hardware thumbpiece on the exterior side. , | i |' 61 NUREG/CR-5929 ! | . . . . - Safety Considerations of Locks His specification may be obtained from the American Soci. releasing device having an obvious method of operation ety for Testing and Materials. under all lighting conditions (including darkness). Doors shall be openable with no more than one releasing opera. UL 305 Panic Ilardware tion. This specification covers exit devices actuated by a panic bar . No lock, padlock, hasp, bar, chain, or other device shall be for outward-opening doors, designed to facilitate the egress of installed on any door on which panic hardware is required people from buildings in the event of emergency. if the device prevents egress. Exit devices a e required to(.perate properly and be maintain. Locks on doors in buildings with approved, supervised, auto- able. Materials nust be corrosion resistant, and must not melt matic fire alarms or automatic sprinkler systems may be at temperatures less than 1000 degrees Fahrenheit. equipped with approved locking devices which shall Safety requirements for exit devices specify that the ends of . unlock upon activation of approved fire alarm system or fire the panic bar must be designed to preclude catching on extinguisher system; clothing; the mechanism must not depend on springs to open the latch; no locking or dogging devices may be installed * unlock upon loss of power controlling the locking device; which prevent the release of the latch;if a deadbolt is used, it and must be operated by the panic bar; and the panic bar must not unduly restrict the exit opening when the bar is depressed.The initiate an irreversible process that will free the latch within panic bar must not be deformed by the tests, and must always 15 seconds whenever a force of 15 lbs is applied to the allow a spacing of at least 1 inch between the bar and the door release device. He authority having jurisdiction may ap- face, to prevent fingers from being smashed. prove a delay not to exceed 30 seconds provided that reasonable life safety is assured. A 100,000 cycle endurance test is required at a rate of 30 cyeles per minute. His special type of locking device is allowed only in low and ordtnary hazard areas. The exit device must operate with a horizontal force of 15 lbs of less. If a horizontal force of 250 lbs is applied to a latched Sections 14 and 15 of the Life Safety Code deal with provi- door in the direction of opening the door, the exit device must sions for detention and correctional facilities. While the operate with a horizontal force of 50 lbs or less. functions of such facilities differ dramatically from the func- . tions of nuclear facilides, the s#ety requirements are in some For double docrs, a horizontal force of 250 lbs is to be applied ways similar. De requirements provide some insight into against the midpoint of the outer stile of each door.The exit methods applied to problems associated with locked doors device must operate with a horizontal force of 50 lbs or less, under emergency conditions. This specification may be obtained from Underwriters Labo- * Detention and correctional facilities must be provided with ratories, Inc. 24. hour staffing. Staff must be within three floors or 300 feet of the access door of each resident housing area. Life Safety Code llandbook . De arrangement shall be such that the staffcan start release - This handbook is an annotated version of the National Fire of heks for emergency evacuation within two minutes of Protection Association's publication 101, the Life Safety alarm. Code,1988 edition. * Provision shall be made so that residents can readily notify Section 5 of the Life Safety Code establishes criteria for door staff of an emergency. hardware and emergency exit devices. Some of the criteria - follow. A plan for the protection of all penons in the event of fire ' must be written. All employees shall be instructed and A door shall be readily opened from the egress side when- drilled with respect to their duties under the plan. : ever the building is occupied. , . Doors from areas of refuge (areas where people can gather a A latch or other fastening device on a door shall be provided wi:hin the detention facility, but removed from the emer- with a knob, handle, panic bar, or other simple type of gency) to the exterior may be locked with key locks in lieu 4 NUREG/CR-5929 62 1 - - - - _ _ _ - _ - - - _ _ . . ______. _ _ _ _ . . ______ ' Safety Considerations of Locks of ternote locking devices. The keys to unlock such doors Part 11 of this standard establishes requirements for exit shall be maintained and available at the facility at all times, alarms, exit k(Es, electric strikes, and indexed key con- and the locks shall be operable from the outside. trol systems, and includes operational and finish tests. * Any remote release used for egress shall be provided with ne following is a summary of the portion of Part 11 a reliable means of operation, remote from the resident concerning exit alarms and esit locks. Other parts of this living areas, to release locks on all doors. An exception is standard are reviewed in the appropriate section of this that the requirement for remote locking and unlocking may NUREO. be waived, provided not more than 10 locks must be unlocked to move all occupants. Ilowever, the unlocking * Exit alarms must pass a cycle test to meet this specifi. mum be done as promptly as reqaired for remote unlocking cation. The number of cycles is 10,000. devices.The opening of all necessary locks shall be accom- plished with no more than two separate keys. * Exit locks must pass a humidity test, cycle test, and operations test. A latch bolt must be cycled 100,000 + All remote release operated doors must be provided with a times, and a deadbolt 5000 times. The operations test is redundant means of operation, similar to one of the tests in UL 305, The exit lock must operate with 15 lbs of force applied at the center of the . Doors remotely unlocked u nder emergency conditions shall actuating mechanism, not automatically telock when closed unless specific action is taken at the remote location to enable ck> ors to relock. - . Descriptions and ilhistrations of a few types of exit alarms and locks are given.The part numbering scheme . Alikt s necessary for unlocking doors shall be individu ally describes how to specify what you want to purchase: identified by both touch and sight, material, type of product, product function, and grade. - Standby emergency power shall be provided for electrically This specification may be obtained from the Builders - operated locks. Power shall be arranged to automatically liardware Manufacturers Association. operate upon failure of normal power within 10 seconds and to maintain the necessary power for at least i 1/2 hours. 7.2,4 Directory of Certified Exit Devices Ee Life Safety Code and the Life Safety Code 11andbook This document is published yearly by the Builders liard. may be obtained from the National Fire Freection Associa. ware Manufacturers Association. The directory is a list. tion, Inc. ing by manufacturer and model number of devices meet. ing the requirements of ANSI /BIIM A A 156.3. Manufac- - ANSI /1111MA A156.519M American NationalStan* turers may choose to have their hardware listed whether dard for ausiliary locks & associated products or not they are BilMA members. Part I of this standard covers auxiliar/ bored and mortise his directory may be obtained from the Builders liard- htks, rim kicks, and cylinders. Security tests, operational ware Manufacturers Association, tests, finish tests, and dimensional criteria are included. i | | u | ! | \ ' | | 63 NUREG/CR-5929 |= l Appendix A Addresses for Specifications 'Ihe American Society for Testing and Materials 1916 Race St. Philadelphia, PA 19103 (215)299 5400 * Builders liardware Manufacturers Association,Inc. 355 Lexington Ave. New York, NY 10017 (212) 661-4261 Defense Printing Service (for both military and federal specifications) 700 Robbins Ave. Building 4, Section D Philadelphia, PA 19111-5094 -(215)697-2000 National Fire Protection Association, Inc. P.O. Box 9146 Quincy, Massachusetts 02169 (800) 344 3555 Underwriters Laboratories, Inc. 333 Pfingsten Rd. Northbrook IL60062 A*ITN: Publications (708) 272 8800 l 1 65 NUREG/CR-5929 - Appendix B Standards and Specifications . t " 8 9 ~t b D k k .t &x i 3 o En se 3 5 e f 13 8 ' ' , % ., L h a8 Subject j$R $3 i X J g y Si 8 . f B 3 g of a is i i e 1 *9i Standard No, dc3 c:*i U W id W r.X U > Page No, A-A 1027C 1989 X tt 11,15 A. A-1930 A 1982 X __ A- A-193? A 1982 X 14 A A-D-600R * X 45 A A-V-2737 * X e A A-D-2757 * X u A A-F-358F 1971 X 52,53 AA-F-358G 1989 X 52,53 ANSI /BilM A A156 ? 1989 X X 12,31 AN51/BilM A A156 3 1989 X 61,63 ANSI /BilM A A156 5 1984 X X X 12,14,31,61,63 ANSI /BilMA A15611 1991 X 13 ANSl!BHMA A156.12 1986 X X 13.31 ANSI'BilMA A15613 1987 X X 13, n ANSIlUL 76R 19R4 X X 20, 22,24 25,37 ANSI /UL 1034 1987 X X 31,34 ASTM F-1090 * X 41,44 ASTM F 471-76 1976 X X 25, 37 ASTM F 571-87 1987 X 61 ASTM F 883-90 1990 X X 14, 15,24,26 , 9ank Protection Act 1973 X 41,44 DnD 5270-22 M * X 41,52 X 24,25,26,34,37,71 FF-1 -2740 19R9 _ X FF-P-1100 1987 X 15,24,26,71 1.ife Safety Cale Handbma 198R X 62 Mil AIDBK-1013/8 1989 X 26 Mll,1.-155960 1988 X X 24.25,37 Mil A.-7898D 196g X 11,13 Mil P 43607G 1986 X 1 t,14,15 Mll P-43951 A 1989 X 11.14 UI,305 1979 X 61,62.63 UL 437 1986 X t1,13 UL 608 * X 41, % 45 UL 687 1991 X 53 * Information taken from previously-written document. Specification not available. Please use latest issue, 67 NUREGICR 5929 - . _ .. . _ . - GLOSSARY nit glossary includes words having specialized meanings, chemical ottack - the use of corrosive chemicals to degrade technical terms, and actonyms as they are used in this NUREO. lack materials to the polnt of lock faiture. Because the primary subject matter of this NUREG is locks, most of the terminology is specific to either combination locks combination lock - a locking device which does not require a or key locks. key. Instead it relies on entry of a single or ordered series of digits or letters to permit opening. ANSI- American National Standards Institute, core removal / pulling - the forcible removal of a lock cylinder ASTAf - American Society for Testing and Materials, core to defeat the lock, autodialer- a device which systematically attempts all pos- covert entry- a method of entry which would leave evidence sible combinations for a combination lock. An autodialer which is not detectable by a user during normal use, but j may be computer-driven. would be detectable during inspection by a qualified ' person. antillary lock - a lock having a latch bolt or a deadbolt operated by a key or a thumb turn or both. An auxiliary cylinder - the portion of the pin tumbler or wafer lock con- lock is often used in addition to another lock, taining the locking mechanism. lillAfA - 13uilders liardware Manufacturers Association. cylinder plug or core - the tubular portion of the cylinder which may rotate within the cylinder body upon insertion bitting or Aty cut - the pattern of cuts, consisting of both of a correct key. :ocation and depth, which must be machined on a key blank to correctly operate a particular lock, deadbolt - a lock component having an end which protrudes - from or is withdrawn into the lock by action of the lock bolt - the painf.a lock which kicks or bkxks another mecha. racchanism. A deadbolt is part of the barrier. nism from verating until it is retracted. deadfasch - a spring-actuated latch bolt with a beveled end bolt manipulation - manual retraction of a bolt without and incorporating a plunger which, when depressed, operation of the krk mechanism.This is effecGye only automatically krks the projectedlatch bolt against retum for intermittently coupled bolts. . by end pressure, bolt track - the machined area within the lock case in which decoding - the use of special tools and techniques to deter- the bolt moves. mine the bitting for the correct key. For a combination lock, decoding is the use of special tools and techniques boltcutters - a cutting tool comprised of long lever.hke to determine the combination. handles providing closing force to short, hardened cut- ting jaws. drilling attack - drilling a hole into a lock, safe, or vault for either direct defeat or to provide xcess to the interior for - boredlock -a lock fitting round bored openings in the face and other defeat methods, edge of a door, door stile - the vertical portions of a frame around the glass breakawy line - a line scored or etched on the rear cover of portion of a door, a combination kwk along which the cover will break if force is applied from the front. The purpose is to avoid electromagnetic lock - a k)ck comprised of an electromagnet ' defeat by punch attack, and strike plate made of ferrous material. Application of electric current creates a magnetic field, which holds the cum stop - combination locks using a " butterfly" to lock the electromagnet and strike together, securing the portal dial permit the buttorfly to engage only when the dial is set to zero. Cam stops cast in the back cover of the lock environmental attack - the application of e xtreme heat or cold prevent attempts to engage the butterfly if the dial is nat to cause the materials used in fabrication to degrade to the set to zero. point of failure, case - see lock case. 1 1 ' 69 NUREG/CR-5929 - ______- _ _ _ _ - - _ - _ - - _ - - _ ------_ ------ _ Glossary exit alarm - an alarm triggered by actuation of an emergency latch - a lock component which is part of the barrier. A latch exit device. has a beveled end which projects from the lock in its extended position, but may be forced back into the lock fence - the portion of a combination or lever lock which case by end pressure or drawn back by action of the lock engages the gates and translates rotational motion to mechanism. linear motion to withdraw the bolt. lever lock - a lock which requires one or more levers to be forcible entry - a method of entry which leaves evidence moved into proper position by the key bitting before w hich is detec table during normal use. Examples include permitting bolt withdrawal. sawing, grinding, chemical, and environmental attacks. lever stop (as applied to a combination lock)- a barrier gate - the cutout in the wheel of a combination lock or the machined or cast into a combination lock case to prevent lever of a lever lock which the fence must engage to allow the lever from moving when the fence and ates are not E _ bolt retraction. aligned. This prevents bolt manipulation, grinding attack- removal of material by grinding, allowing a lock case - the exterior housing of a lock, lock, safe, or vault to be dismantled and defeated, magnetic attack - the use of a magnet or electromagnet to index mark - a mark engraved on a combination lock dial ring override the magnetic field of an electric bolt, latch, or to which combination numbers are aligned during entry strike or an electromagnetic lock. 'fhis allows operation or change of a combination. of the device without authorization. impact vibration attack - striking a spring loaded padlock manipulation - opening a lock, safe, or vault in a way it was may cause vibration which momentarily releases the not intended to be opened without alteration of the shackle, thus opening the padlock, physical structure or disarranging or substitution of any parts, impressioning - creation of a correct key by copying an impression of the original key, or by impressioning the master-keying - to combine a group of locks or cylinders such pins or levers within the interior of the lock cylinder using that each is operated by its own change key as well as a a key blank. master key for the entire group. indexed key control system - a system of records used to mechanical probing - the use of a small probe to aid in control issue of access keys. Cross references are main- opening a lock, tained to quickly determine who possesses keys, how many are outstanding, etc. mortise lock - a lock designed to fit into a rectangular cavity cut in the edge of the door. interconnected lock - a mechanically interconnected locking mechanism having a separate latch bolt or dead. locking NFPA - National Fire Protection Association. latch bolt and deadbolt designed for installation in round bored openings in the edge and face of a door, pawl- a hooked arm assembly used to translate linear motion into rotational motion, but only in one direction. key blank - an uncut key which fits the keyway in a lock. physical manipulation - see manipulation, sense manipula. key-change hole - the keyway in a combination lock provid- tion. ing access for the combination change key. pin-tumbler lock - a lock requiring the key to correctly key 'ock - a locking device operated by a key, position a series of pins with respect to a shear line before allowing key rotation, keyway - the cross section of a keyhole. The profile of the keyhole is designed using wards or obstacles to restrict picking - the unk)cting of a key-operated lock by the use of the profile of keys capable of enteting, various tools which simulate the action of a key. NUREG/CR-5929 70 ) $ _ - _ _ - _ _ _ _ - _ - _ - _ - _ - _ _. | Glossary punch attack (as applied to a combination lock)- an attack in signature analysis attack- analysis of audible x & tonic which hammer blows are applied to the spindle.This will signals for patterns which will help decode and open a cause the back of the lock to break away. A lock design locking mechanism. to counter this attack has a breakaway line in the back of the case and a relocking device, spindle (as applied to a combination lock)- the rod connecting the combination lock dial to the wheel pack, radiographic attack- the use of a radiation source to produce an image of the interior of the lock to aid in defeating the strike - a metal plate or box attached to, or mortised into, the locking mechanism. door jamb to receive and reinforce the lock bolt. relocking device - a device separate from the primary locking surreptitious entry- the definitions from FF L 2740 and FF- mechanism which functions to block withdrawal of the F-1100 differ slightly. Both specincations agree that bolt if the lock, safe, or vault is forcibly attacked, surreptitious entry is a method of entry which leaves no evidence which would be detectable during normal use. - removable core - a method for re-keying a lock in which the FF-L-2740 in addition requires that surreptitious entry entire core is removed and replaced with one operated by not be detectable during inspection by a qualified person, a different key. systematic trial anderror- an attempt to open a combination rim lock - a lock mounted on the surface of a door, by systematically attempting all possible combinations, rotational tolerance - the tolerance within which a combina- thernud sensor - material installed in a lock, safe, or vault tion must be entered, i.e., the nu mbers must align with the which melts at relatively low temperatures.The sensor is index mark within plus!minus 1 digit, or 1 1/2 digits,etc. used to trigger a relocking device.The purpose is to avoid defeat by environmental attack. sawing attack - use of specialized cutting tools to cut through a barrier in a lock, safe, or vault. thumb turn - a device used in place of a knob or key to retract a latch or bolt. scrambling device - a device installed in a mechanical com- bination kxk which scrambles the position of the wheels UL - Underwriters Laboratories, after the lock has been opened or closed to prevent decoding. Electronic combination locks may perform wafer (or disk) lock - a lock w hich requires several disks to be automatic combination scrambling as part of their pro- correctly positioned by insertion of the key before per- - gramming. mitting key rotation. - self-contained electronic lock - an electronic combination warded lock - a lock requiring cuts in the key to match krk requiting no external source of energy in order to permanent barriers in the keyway (wards) in order to function. permit key rotation. . sense manipulation - reliance on the senses of touch, hearing, 2-ray radiography - see radiographic attack. and sight to assist in a manipulation attack. shackle - that portion of a padk)ck which secures the movable barrier to the non-movable barrier and is then secured into the padhxk tufy. 71 NUREG/CR 5929 Distribution: Michelle Myers B E inc.- P.O. Box 381. Ilwy 278W Airport Industrial Park Barnwell,SC 29812 ~ Steve liighland Albuquerque Safe Company 7401 Indian School Road N.E. Albuquerque,NM 87110 5932 K.T. Gee (5) 5932 M.G. Wilde (5) M00 N.R. Ortiz. MOS D.A.Dahlgren 9500 D.S.Miyoshi 9503 J.W. Kane 95G1 R.W. Moya 9543 J.C. Matter (2) 9600 J.R. Kelsey 9611 S li. Scott (2) 7141 Technical Library (5) 7151 TechnicalPublications 8523-2 Central Technical Files 73 NUREG/CR-5929 i , _ _ . .. _ . . . .- - . . . _ _ _ _ ...... m ._ ., ._ . . . U.S. NUCLE AR REGULATORY COMMttsloN 1. Rt FoR1 Nuvet R N'.C 8cau 335 ' EY4sio2 #C%||*,,%^|||*,Vi|';/,7 ""- noum BIBLIOGRAPHIC DATA SHEET isn ineirucriom en ene r ,,,j NUREG/CR-5929 7,16TLt AND SU81till SAND 92-1682 ' . Locking Systems for Physical Protection and Control 3 ~j . oaf t RtroR1 PUsussto - uoe ,. j staa November 1992 4. F #N OR GR ANT NUUSE R L1387 6 AUlttoRt58 6. TYPE OF R(PORT . Kathleen T. Gee SNL Technical .. Steven H Scott, SNL ; Marion G. Wilde, SNL L Pt Rioo Covt Rio n,ia, c o.,,,, Steven E. Highland, Albuquerque Safe Company : PE RF oRMING oRGANG ATioN - N AME AND ADDR f $$ fu h4C, pem omw% ONss er Meeren, U.3 hwes, AvvWay Comains M, eW aisefig wem d eer+ww. rote nome ong naneMy enesar) , Sandia National Laboratories Albuquerque, New Mexico 87185-5800 9. $PoN$oRING onG ANGAlloN - N AME AND ADDR ESS in wec. em seg e. eso.r.c na euww.p=m mac o.. ona e nes.u. u 5 mwme, ae,.anwy cesi,vi.e.ea. ertW mesMt $$lk.et) -Division of Safeguards and Transportation Office of Nuclear Material Safety and Safeguards U.S. Nuclear Regulatory Commission Washington, DC- 20555 10, SUPPLtME NTARY NOTES ' 11. AB5 TRACT (Joo.wm er aus The purpose of this NUREG is to present technical information that should be useful for understanding and applying locking systems for. physical protection _and control.' There are major sections on hardware for locks, vaults, safes, and security containers. Other topics include management of lock systems - and safety considerations. This document'also contains notes on-standards and specifications and a glossary. _. is, ne v woRDsiotscR:etons tim -,a.= ,ac.--= ==a-= =.am ea --n e u ava'ta w n5'ana m - Unlimited- Nuclear Safeguards i..ucuairvetaw "cano~ Physical Protection ' nr i . Locks Unclassified Vaults tra., a=+ . Safes Unclassified- -Security Containers u.NuustR os eAGes 16 PRICE - aexc ponM 3JS (249) ' d , _ - . , _ . _ - - . . . _ ...... - . - - . . - - . - . . - . . . . . - - . . . | | | q | Printed on recycled paper D Federal Recycling Program . . _ . - - . .. * - < t k I ; I. h e -_ O. 4]> . - t . . 1 Mg_ 5 - , > J' - - - y , _ '} . - ' | < ~- m. 4 . t 1T - i < ^^ , < n Ao ' i R A [l . - SP / . 7 . f , S s- -i A E 6- [ ,L Crc,t G ,., MoaO R_m.; T w mN P AsTuf U M O - .O Fc~RE N A E . t T P , As~f .,. Co EP P ., S - * ,, * . _ . :. L . O , R T _ N O , C D ,- , N . A ) _N , [ _ f. ,- _O_ I * _ _T_ _ r- _ _C_ _ _E g .- _ ':e. .O.T a. _ R ' ~ ,F, ,' - _l l m".' . A . . e L C - I S Y , . ,H . ,F., . - , _. . R , ,. O .F % . .S. . ' .M ' _.T E -_ ,. S , , I'3_3 , . Y * ,. S G .N .r , I , ( .K , , . C ' . =O q .. L , . t , , N O , I 1 - ,C S0 + [. S0 0 y I 0 0 M- 3 , 5 $ % ~ ' M5 E. d - SO5 S S - . EC0 a 2 SE U ~ T ' Y: INE T - A R . T SU A S O C. BI V , TD R L P i DA , A EL R N d TUI ICI O 9 O FF 2 NG T F 9 O V - b 5 U E T - :- R G L N A R RI m. N * oC A H E Y / .E S P .. G LA ..E . R -.CW U ..U N' ~,N,- ; , , 4 *L ' ..).O - - . 3 . 4 + w 4 p q.v gy_. .mm ,7 y m 7py_ m--m m _, . . , , . . . , . _ . _ _ , _ . , . . _ _ , 1 J na. n _ g,waa u a ~ nmwn ww~ - agay_n_nfqhkff kfe ?bjb{pu _aaweea- wn. )f g g _f f .f j h 3 r . "h) f. s%c stA Q}:pw 4 m }d g g; w g g aqAg4;p gg;p3ghypqgp g s j pg g& ggspyan p _(f.$g$h q4gdfgg3 f y $,| f h h | k g hy$ h y! h yf.( f hh hh mrp nun n su momnannmounweanewmmmnennameammeas 4sewamewam ma e w %egq p #p s sesamw!q;%+Agggdeffmpg%nw4g45g g 3 gae,a gg !d%[4Qy gs pgggigfcaps w&qwasgpaw':m;woeg wgg Sgk ;s MhN muhNhMmMIkh@w%gm@mw;hibh , u|m%mmecawnwen bh5Nkhd4N'_*w+@w khbhNNNSNIhfM ui:dh k$5n I;N$nemam$u$shhawafNkkdwm h}k$$s$ -- - ,--- , -~n, aa-_ .k.hhh hhhhhhhh_hhhhh- k' ,_ma m- ~ ~ann n nna ,e m s _n m + m,a_a_m__ma_m__a_sh_m m, A%|-, y_%%.-goA-mY _,,_ o_,__ __ _ a_ x n w n w$ ? ka,wnnne-au+ n--- k.pk_n h--_-_ans_n MMWW$4Cd%@fi2EMQnOMdW8@Mi