Crayonic Bridge
© Crayonic B.V.
Crayonic Bridge is a small USB dongle that replaces the cable between a Crayonic wallet and the workstation. It is a Bluetooth Low Energy central on one side and a standard USB security key and smart-card reader on the other: when a Crayonic Badge™, Crayonic KeyVault™ or Crayonic Mobile ID Wallet comes within range, the Bridge connects to it over BLE and the workstation sees exactly what it would see if the wallet were plugged in by cable. No Bluetooth pairing dialog, no driver installation and no vendor software on the endpoint are needed for authentication.
Where this fits
The Bridge is the endpoint's wireless link to every Crayonic wallet and the piece that turns a security key into hands-free proximity login and auto-lock; see Solution Architecture for how it combines with the Crayonic Agent, Credential Provider, CDM and the BLE coverage used by RTLS and Comms.
What the Bridge does
- Makes a nearby wallet look USB-connected. The Bridge enumerates on the host as a USB composite device: a FIDO2 (CTAP HID) security key plus CCID smart-card reader interfaces. Windows, macOS and Linux use their built-in class drivers, so nothing has to be installed.
- Bridges every protocol the wallets speak. FIDO2/CTAP2 (passkeys, WebAuthn, Windows sign-in) and PIV smart-card traffic (ISO 7816 APDUs to the wallet's secure element over CCID) are relayed transparently. Badge models with an auxiliary contact reader expose it through the Bridge as a second CCID reader.
- Needs no pairing. Crayonic wallets and Bridges recognise each other by design; the user never sees a Bluetooth pairing prompt, and FIDO operations that would normally require a paired BLE link work immediately. This is what makes the Bridge suitable for fast-paced environments with many shared workstations.
- Tells the wallet where it is. On connect, the Bridge sends the wallet the name of the computer it is attached to, so a Badge or KeyVault with a display shows a "PC: name" indicator while bridged and lets the user see which workstation currently holds their session.
- Keeps scanning. The Bridge continuously scans for Crayonic wallets, connects to the closest one and can hand the active connection over when a closer wallet arrives. Only one wallet at a time is routed to the host for authentication.
Supported wallets
| Wallet | Over the Bridge |
|---|---|
| Crayonic Badge™ | FIDO2 and PIV; auxiliary contact reader on models that have one |
| Crayonic KeyVault™ | FIDO2 and PIV |
| Crayonic Mobile ID Wallet | Passkeys and certificates held on the phone are presented to the endpoint through the Bridge exactly like a badge |
The Bridge link is independent of the Mobile ID Wallet's own Bluetooth connection to a badge (used for badge management and secure-audio sync): a badge can be bridged to a workstation and connected to its owner's phone at the same time.
Proximity login and auto-lock
The Bridge measures the signal strength (RSSI) of each wallet it can hear and acts on three thresholds, all expressed in dBm:
| Threshold | Effect |
|---|---|
| Connect | A wallet whose signal rises above this level is connected and appears on USB. With the Crayonic Credential Provider installed, the logon screen can start the sign-in ceremony without anyone touching the keyboard; the user only confirms on the wallet (fingerprint or PIN) if it is not already unlocked. |
| Fast connect | A stronger, "in your hand" level at which the Bridge connects immediately rather than waiting for the signal to settle, for users who walk straight up to the workstation. |
| Disconnect | When the signal drops below this level the Bridge releases the wallet. To the operating system this is a security-key / smart-card removal, which drives the configured lock or log-off action (Windows smart-card removal policy or the Crayonic Agent's lock-on-disconnect). |
Thresholds can be tuned per Bridge with the proximity settings tool from the Downloads page, or centrally: Crayonic Device Manager (CDM) holds Bridge settings as organisation defaults, device-group settings and per-machine overrides, and the Crayonic Agent writes the effective values to the Bridges attached to each machine. The same settings switch FIDO and smart-card bridging on or off individually, so a site can, for example, run the Bridge in FIDO-only mode.
Fleet management with the Crayonic Agent and CDM
Where the Crayonic Agent is installed, Bridges become managed devices:
- Inventory and health — the Agent reports each Bridge's connection, firmware version and settings to CDM, and shows which wallets are currently connected through it.
- Firmware updates — CDM firmware policy (organisation / group / pilot) is applied by the Agent over USB, one Bridge at a time; results are reported back as firmware-update events. A stand-alone updater for unmanaged sites is on the Downloads page.
- Nearby-wallet visibility — the Bridge hears the advertisements of every Crayonic wallet in range, not only the one it is connected to. The Agent forwards summaries to CDM, which is how CDM can show which badges are near which workstation and how the Credential Provider can offer a tile per nearby user.
BLE coverage for RTLS and Comms (beta)
Because every Bridge is a BLE listener and transmitter at a known location, the Bridges already installed on workstations form the BLE mesh that Crayonic RTLS and Crayonic Comms build on: RTLS derives badge location from the advertisements the Bridges hear, and Comms reaches a badge's display through the nearest Bridge. Both services are in beta. Where workstations are sparse (corridors, wards, open areas) the coverage is extended with Wi-Fi access points that include a BLE gateway; see Solution Architecture for the deployment picture.
When is a Bridge required?
| Scenario | Bridge |
|---|---|
| Badge or KeyVault used by USB cable or NFC only | Optional |
| Proximity login and walk-away auto-lock | Required on each workstation |
| Shared workstations where pairing dialogs are unacceptable | Required |
| Crayonic Mobile ID Wallet as the credential at a Windows endpoint | Required |
| RTLS / Comms coverage (beta) | Bridges plus, where needed, BLE gateways |
| Secure audio upload from managed workstations (Option 4a) | Required together with the Crayonic Agent |
Specifications
| Authentication protocols bridged | FIDO2 (CTAP2), PIV over CCID |
| Radio | Bluetooth Low Energy |
| Temperature ranges | Operation: 0 °C to 45 °C, Storage: -10 °C to 55 °C |
| Physical interfaces | USB-A (USB-C optional per request) |
| Secure element | Optional per request |
| Management | Proximity settings tool, or Crayonic Agent + CDM |
Firmware, the proximity settings tool and the stand-alone updater are on the Downloads page.