The Scramblepad Hardware and Protocol | Photons, Electrons, and Dirt

Photons, Electrons, and Dirt

A blog by Glen Akins

Skip to content

Home

Old Projects

My Videos (YouTube)

My Code (GitHub)

My Mastodon Profile

← Building a Simple RFID Door Access Controller

Building a DIP Switch USB Stick Using the Microchip PIC16F1459 →

The Scramblepad Hardware and Protocol

Posted on August 29, 2021 by Glen

I first saw a Scramblepad on the door of an office building I worked at while in high school in the late ’80s. I always wanted to own one or to make my own based on seven-segment LED displays but had trouble finding a suitable, transparent touchpad I could use for the buttons. I eventually gave up on building my own.

Luckily I found a few Scramblepads up for sale recently and decided to buy one to see if I could do anything useful with it. With a bit of work, I reverse engineered the communication protocol and can now use my Scramblepad with my own simplified homebrew door controller. Read on to learn more about the hardware, the communications protocol, and building a homebrew Scramblepad compatible door controller.

Why a Scramblepad / Why not a Scramblepad

The front face of the Scramblepad with randomized digits shown on the RED LED seven-segment displays.

The original Scramblepad patent was filed in 1982. An office building I worked at while in high school had one on the door for after hours / weekend access. Even though they’re very old by technology standards, they’re still somewhat fascinating today. I’ve heard anecdotal reports that a few office buildings in downtown Denver still have them.

The primary purpose of a Scramblepad is to prevent shoulder surfing the PIN needed to gain entry to a building. The Scramblepad has two strategies to prevent shoulder surfing:

The location of the LED digits on the keypad are scrambled on every activation. This prevents a person standing at a distance from watching where a user’s fingers land on the keypad and learning the code.

The viewing angles of the LED digits are heavily restricted. A user has to be directly on-axis horizontally to see the digits. The viewing angle is restricted vertically as well but not quite as severely. This prevents shoulder surfing by a person standing behind the Scramblepad’s user from learning the code.

The use of Scramblepads has fallen out of favor for a variety of reasons. They’re not ADA compliant. They need to be mounted at a specific height to let most users view the randomized digits through the viewing angle restrictions. This prevents users in wheelchairs from seeing the digits and using the keypad unless a second lower Scramblepad is installed alongside the higher Scramblepad. They’re also completely inaccessible to vision-impaired and blind users.

Even with proximity card readers, Scramblepads no longer provide adequate security. The protocol between the reader and the door controller is archaic and unencrypted. They’re also not vandal proof. Finally, they’re expensive. In the case where just a PIN is needed to enter a building, lab, or supply closet, it’s much less expensive to put a mechanical code lock on the door and call it done.

A Closer Look at the Scramblepad Hardware

Rear view of the Scramblepad showing the connectors and dip switches.

Let’s take a closer look at the Scramblepad hardware. On the back of the Scramblepad are a bunch of connectors and dip switches. The door controller connects to the DTRAC connector mid way down on the left. The other connectors connect the various boards inside the Scrambledpad together and allow for a door exit card reader to be connected to the Scramblepad for card + pin to enter then card-only to exit situations.

At the bottom is an eight-position DIP switch. The primary purpose of this switch is to set the address of the Scramblepad. The address set on the switch must mach the port the Scramblepad is connected to on the door controller. I have not investigated the eight-position DIP on the right.

Annotated side view of a Scramblepad.

The Scramblepad is complicated. The photo above shows the layers of mechanical and electrical hardware inside the Scramblepad. From bottom to top, this hardware consists of:

A plastic bezel with a snap-on plastic trim piece.

A transparent rubber membrane forming the buttons.

A transparent 3×4 touchpad button matrix.

A transparent acrylic back plate for the button assmebly.

A 13.56 MHz RFID PCB antenna.

A 125 kHz RFID coil antenna.

A series of metal baffles to restrict the digit viewing angles.

Ten seven-segment LED displays.

An LED display board.

A Match2 interface board.

A 125 kHz RFID reader board.

A 13.56 MHz RFID reader board.

A metal back plate.

Exploded view of the Scramblepad.

The Scramblepad comes apart easily by removing four screws. The photo above shows the Scramblepad after removing these four screws and separating the boards from each other.

Match2 board.

The photo above is a closer look at the...