Architecture
Well-known encryption methods and digital certificates
XoT is built on proven technology. The encryption comes from WireGuard, and identity is based on digital certificates. This page describes how the parts work.
15
patent claims were granted by the European Patent Office. That was every claim in the application.
Twice
a minute, the user and the Lock check each other.
4 questions
decide every authorisation: who, what, where and when.
No passwords
are used. Identity is based on certificates.
Identity
Every user and device has its own certificate
A digital certificate works like an identity document for computers. In XoT, every user, every device and every system has its own certificate. The certificates follow the X.509 standard, which is common for this type of certificate.
The certificates are issued by XMS or by a certificate authority your company already uses. XoT uses no usernames, passwords or shared secrets.
A certificate you revoke stops working at the Lock immediately.
Encryption
The encryption comes from WireGuard
WireGuard is a modern technology for encrypted connections. WireGuard's code is about 4,000 lines long. That makes it possible to review in full.
WireGuard uses a small number of well-known cryptographic methods:
| Task | Method |
|---|---|
| Exchange keys securely | Curve25519 |
| Encrypt the traffic and protect it against changes | ChaCha20 with Poly1305 |
| Calculate checksums, known as hashing | BLAKE2s |
The methods are fixed in advance. So no one can force the connection to use a weaker method.
"WireGuard" is a registered trademark of Jason A. Donenfeld. Read more at wireguard.com.
Checks
The user and the Lock check each other twice a minute
When a connection opens, the user and the Lock check each other's certificates. The check is then repeated twice a minute while the connection is open.
So the user must be authorised for as long as the connection is open, not just when it opens.
Access rules
Four questions decide every authorisation
An access rule in XMS answers four questions. The user can reach the equipment only if all four conditions are met.
Who?
The rule states which user or group may connect. The groups can come from Active Directory, LDAP or Entra ID.
What?
The rule states which equipment the user may connect to.
Where?
The rule can limit where the user may connect from, such as a particular site or a particular network.
When?
The rule states when the access applies. The access can end after a set time, according to a schedule or when a time window closes.
The Lock
The Lock comes in several forms
The Lock is available as the XoT-S1 hardware, which is designed and manufactured in Sweden. It is built for an extended temperature range and has no moving parts.
The Lock is also available as software. The software runs on ARM and x86 processors and on devices that run RutOS. It can also run as a virtual machine in Azure or AWS.
The whole of XoT can run in the cloud, in your own data centre or as a mix of both. It can also run completely separated from the internet.
Review
Reviewed, tested and patented
Proven standards
The technology is built on proven reference standards and frameworks.
Tested against attacks
Several companies have tried to break into XoT in what are called penetration tests. Would you like to run your own test? Talk to us.
European Patent Office
The application was filed in October 2019. All 15 patent claims were granted on 24 August 2021.
Common questions
Have you developed your own encryption method?
No. The encryption comes from WireGuard. What is ours is how the protection is built and where it sits.
What do we do if a certificate falls into the wrong hands?
Revoke the certificate in XMS. A certificate you revoke stops working at the Lock immediately.
Can we use our own certificate authority?
Yes. XoT can use certificates from a certificate authority your company already has.
Want to know more?
Get in touch if you would like more technical material about XoT.