Meridian Security Follow

This article describes Meridian’s systems as they relate to security and privacy.

Overview

Click the image to see an enlarged version.

When we talk about security and Meridian, there are several different systems at play:

• The security of the Meridian Editor
• The security of Beacons hardware
• The security of the connection between Beacons hardware and the Editor
• The security of the Meridian-powered apps
• The security of the API

Meridian Editor Security

Traffic to and from the Meridian Editor is via HTTPS and requires a valid account. Once logged in, an account only sees the organizations and locations to which that account has access.

Controllers and the Meridian Editor

Controllers using AOS 6.3.X.X+ communicate with the Meridian Editor using HTTPS on port 443. They won’t respond to the Editor unless they’ve sent a message to the Editor first. Communications to the Editor are encrypted using Transport Layer Security 1.2 (TLS 1.2).

If you use a firewall, please add edit.meridianapps.com on TCP port 443 to your firewall allowlist. The Meridian Editor does not use a static IP address. We know that this causes problems for some firewalls, and you’ll need to contact your firewall technical support team for a workaround.

In order for a controller or IAP to connect to a Meridian Editor location it needs to have the unique access token generated by the Editor for that location.

The access token is located on the Beacons Settings page.

In the sidebar, click BEACONS. If you see Enable Beacons Management, click it.

To the left of the List and Map buttons, click the Settings gear button. Otherwise, you’ll find the token under Controller Configuration, next to ACCESS TOKEN.

Aruba Beacon Security

Once an Aruba Beacon is deployed to a map, it’s associated with that specific location in the Meridian Editor. Even if the Beacon is turned off, it will continue to be associated with that location when it’s turned on again.

If a Beacon is removed from a location’s map, it will be available to deploy to a map in another location, but you need access to a location to remove a Beacon from its map.

Even if a Beacon is physically stolen, it won’t be usable by another location, because it will continue to be associated with its location.

You can’t access Beacons in a location unless you have an account for that location in the Meridian Editor.

Bluetooth Security

Aruba Beacons transmit using Bluetooth signals.

Beacons transmit their UUID and Major/Minor values at regular intervals. This transmission can be intercepted with any device that has a Bluetooth radio.

All of the information about a particular Beacon is stored in the Editor. Without a connection to the Editor through a valid Meridian-powered app, none of this information will be visible.

Meridian-Powered App Security

In most cases, Meridian-powered apps are available to everyone and downloaded from the Apple and Google app stores. Most of our apps use maps of publicly accessible areas in venues open to the public.

For organizations that would like an app with limited access, our developers have created a feature called App Level Login, which puts a location’s content behind a login screen.

Visitors using the app will be presented with a login screen after the splash screen. Visitors won’t be able to see any content in the app, unless they log in with a valid account ID and password.

Limitations of App Level Login

If your visitors have another way to access the content in your app, the app level login won’t prevent them from seeing it.

If you have an older version of your app that doesn’t have app level login, visitors with the old version will be able to access all of the content in your app even if you’ve enabled app level login in the new version. If you want to use app level login, it’s best to add it to all published versions of your app.

It’s important to know that your Meridian-powered app content can be accessed using the Aruba Meridian app, if you have an account for that location or organization or a share link from someone who has an account.

There are other ways to access a location’s data. The Meridian API is open, which means anyone with a location ID can request data for that location through the API. Android also has apps that can launch specific screens within other apps, which makes it possible to bypass the Meridian-powered app login screen.

API Security

By default, the Meridian API is a public API. This means that anyone with a valid location ID can use the API to get information from that location.

The API’s security relies on obscurity. The location ID a long numeric string that’s a part of the Meridian Editor’s URL for that location. However, the only way to see that URL with the location ID is by logging into that location in the Editor.

If this level of security isn’t acceptable, a Meridian admin can force the API for your location to require token authentication. If you’d like to enable this, please contact Meridian.

For more information about token authentication, please see this article on Token Authentication.

Meridian Cloud-Based Infrastructure

The Meridian Editor is hosted on Google Cloud Services. Meridian relies on Google’s world class data security and stability to provide the foundation for every Meridian-powered app and the Meridian Editor.

Reliability

Meridian services rely on Google Cloud Platform’s stability which guarantees an uptime of at least 99.95%.

Server Security

Meridian’s security relies on Google’s server security. You can read more about Google’s server security here.

Data Center Physical Security

Meridian’s security relies on the physical security Google uses for its data centers. You can read more about Google’s physical security here.

Google Cloud Security Standards Compliance

The Google Cloud Platform is audited on its infrastructure, services, and operations.

You can see all of the standards the Google Cloud Platform meets here.

Notably, Google Cloud Platform complies with HIPAA, CSA STAR, and the EU Data Protection Directive.