How We Sync Kiosk Attendance Logs Without Exposing Database Keys

Managing attendance hardware across 50+ branch locations presents a simple security problem: how do you let hardware kiosks send attendance data to the cloud without giving them database credentials or raw face photos?

Here is the exact sync architecture we built for Facenox Remote Dashboard.

1. The Threat Model

Traditional remote attendance hardware connects directly to central database instances via hardcoded connection strings or static API tokens embedded in local device storage:

[ Kiosk Device ] > (Hardcoded API Token) > [ Central Cloud DB ]

Vulnerability: If an attacker physically steals or dumps the flash storage of a single branch kiosk, they gain static API keys capable of forging logs for all branches across the organization.

2. The Zero-Trust Device Pairing Handshake

Facenox prevents static token compromise by enforcing an asymmetric Device Key Exchange upon initial kiosk provision:

[ Kiosk Device ] > (Ed25519 Key Pair) > [ Admin Approval Portal ]
                                                        |
                                                        v
[ Remote Dashboard ] < (Scoped Device JWT) <+

1. Local Key Generation: The local Electron app generates an Ed25519 digital signature keypair inside OS secure storage.
2. Admin Pair Approval: The administrator approves the kiosk's public key from the Remote Dashboard portal.
3. Scoped Ephemeral Tokens: The dashboard issues a scoped, short-lived JWT valid only for that specific kiosk_id and site_id.

3. Telemetry Signature & Replay Attack Mitigation

Every attendance batch payload synced over HTTP/2 contains an HMAC-SHA256 digital signature and a monotonically increasing sequence nonce:

// Sign telemetry payload before syncing to cloud dashboard
import { createHmac } from "node:crypto"

export interface SyncPayload {
  kioskId: string
  siteId: string
  nonce: number
  timestamp: string
  events: Array<{ employeeId: string; timestamp: string; verifiedScore: number }>
}

export function generateSyncSignature(payload: SyncPayload, deviceSecret: string): string {
  const message = `${payload.kioskId}:${payload.nonce}:${payload.timestamp}:${JSON.stringify(payload.events)}`
  return createHmac("sha256", deviceSecret).update(message).digest("hex")
}

Replay Attack Protection:

• The cloud dashboard verifies that payload.nonce is strictly greater than the last recorded nonce for kiosk_id.
• Payload timestamps older than 300 seconds are rejected immediately.

4. Database Schema Isolation

Synced events are stored in Neon Serverless PostgreSQL with Row Level Security (RLS) policies ensuring organization isolation:

-- Enforce organization-level data isolation on synced telemetry
CREATE POLICY organization_sync_isolation ON attendance_events
    FOR INSERT
    WITH CHECK (
        organization_id = auth.current_organization_id()
        AND kiosk_id IN (
            SELECT id FROM devices WHERE status = 'active'
        )
    );

Conclusion

By combining asymmetric keypairs, HMAC sequence nonces, and Row Level Security, Facenox guarantees multi-branch telemetry sync security without exposing cloud database credentials to physical edge hardware.