View source for TachoSync/Company Card Authenticator (CCA) Setup

<!--- FOR EDITORS
PER PREZENTACIJĄ EVALDAS DARĖ VEIKSMUS PER WINDOWS SERVICES – PARAŠYTI ČIA?
--->
==Overview==
The '''Company Card Authenticator (CCA)''' is a software bridge that makes a tachograph company card accessible for remote downloads.

*Tachograph files can only be downloaded if the company card is periodically present during the authentication process.
*CCA ensures that the tachograph server can “see” the card over the internet, even though the card itself is physically inserted into a card reader somewhere (either at the provider or the end-client). [[TachoSync Company Card Authenticator#Smart Card Readers|Read below about company card readers]].
*CCA does not store tachograph files themselves. It only provides the “live presence” of the company card to the system.


==PC Requirements for CCA==
Download availability depends on the '''machine hosting CCA being online and actively connected to TachoSync'''.

PC Requirements for CCA:
* '''OS:''' Windows 10; Windows 11.
* '''CPU:''' Intel or AMD processor with 64-bit support.
* '''Disk Storage:''' 500 MB of free disk space.
* '''Internet connection:''' Required for downloading and operation.

'''TachoSync authentication service IP address and port:
* '''Address: https://tacho.teltonika.lt (3.126.35.133)
* '''Port: 7066


==How to Install CCA==
===Download it from TachoSync UI===
[[File:CCA.png|right]]
# Go to '''[https://tacho.teltonika.lt TachoSync]'''.
# Go to "Settings" in the top menu and select '''"Company Card Authenticator"'''.
# A window opens. Select the latest version and click '''“Download"'''. 
# Open the downloaded file and install CCA.
# Run CCA.
Now you can connect card reader with a company card that will be used for remote authentication.

For more information on how to add company cards, please refer to [[TachoSync_Interface#Adding_a_Company_Card|Adding a company card]].

===Version update via CCA===
# Another option is to update it directly from CCA's monitor view. Once a new version is available, a banner appears at the top of the CCA window. The banner contains the version number, release date and "Update" button. If the banner is dismissed, it does not re-appear until a new version is released.
# Click "Update" - the download starts, progress is shown.
# When download is completed, click "Install and restart".
# If the update fails, retry from the "Version information" button (bottom-right).

==Latest CCA version==
{| class="wikitable"
|-
!Version!!Release Date!!Release Notes
|-
|'''2.2.1''' 
| '''2026-05-26'''<br>[[File:Download_zip.png|100px|link=Special:Redirect/file/Company Card Authenticator v2.2.1.zip]]
|
* Resolved an issue affecting smart card reader stability introduced in v2.2.0. Customers using standard USB smart card readers are recommended to update to v2.2.1. 
|}

{| class="mw-collapsible mw-collapsed wikitable"
|+ style="white-space: nowrap" | Older versions 
|-
!Version!!Release Date!!Release Notes
|-
|'''2.2.0'''||'''2026-05-18'''
|<ul style="margin:1;">
* Improved authentication reliability with Lisle Hyper Card racks. Customers using Lisle racks were experiencing authentication failures where some company cards would fail while others succeeded on the same rack. This was caused by a protocol mismatch: some tachographs request T=1 protocol during authentication, but Lisle racks with firmware below v01.21 only support T=0. CCA now detects the rack's supported protocol and adapts communication accordingly. For customers on older Lisle firmware, we recommend contacting Lisle Design about a firmware update for full T=1 support - CCA's protocol adaptation improves reliability but updating the rack firmware remains the recommended long-term solution.
* Fixed Lisle rack connections becoming permanently suspended after an I/O error. Previously, if a Lisle rack encountered a communication error, the connection would stop working until the CCA Windows service was manually restarted. CCA now recovers automatically.
* Redesigned the CCA Monitor view. The company card table now includes search by Card Number and Card ID, filters by Company, Reader, and Status, column sorting, and a top navigation bar with CCA version information.
* Lisle firmware version is now logged automatically on device detection. When a Lisle Hyper Card rack is connected, CCA logs the card reader firmware version. This improves support triage for protocol-related issues.
* Fixed CCA not detecting an empty Lisle rack until a card was inserted. Empty racks are now displayed the same way as empty single card readers.
* Fixed CCA incorrectly showing a company card as present after physical removal from a Lisle rack slot.
* Fixed mouse wheel scrolling not working over the company cards list.
</ul>
|-
|-
|'''2.1.0'''||'''2026-01-14'''
|<ul style="margin:1;">
* Fixed an issue where company cards were not identified reliably when using Lisle Hyper Card racks.
* Fixed a rare display issue where the same company card could appear duplicated in the monitor view when using standard smart card readers (PC/SC).
</ul>
|-
|2.0.0||2025-12-18
|<ul style="margin:1;">
* Added version information to the CCA monitor, showing the installed version, release date, package size, and whether an update is available.
* Added a version history view with release notes for recent CCA versions, accessible directly from the application.
* Introduced in-app update flow, allowing users to download and install new versions directly from the CCA monitor view.
* Added non-disruptive update notifications with the option to update immediately or postpone.
* Improved stability when reading company card data via standard smart card readers (PC/SC), reducing cases where cards could become temporarily unresponsive.
* Improved connection handling between the CCA application and the TachoSync service, allowing the system to recover more reliably from temporary or stale connections.
* Improved internal handling of multi-threaded card operations to prevent rare issues during simultaneous card processing.
</ul>
|-
|1.2.1||2025-09-15
|<ul style="margin:1;">
* Fixed a rare issue where some smart card readers (PC/SC) did not retrieve ATR command correctly.
* Fixed an issue with Lisle devices where a card slot could appear occupied, but the card information was missing. The system now re-checks the slot to ensure the card is properly recognized.
</ul>
|-
|1.2.0||2025-09-11
|<ul style="margin:1;">
* Improved authentication speed when using Lisle Hyper Card racks – authentication is now 3–4 times faster compared to the previous version.
* Fixed a problem in larger Lisle Hyper Card rack setups (50+ company cards) where some cards were not identified correctly when inserted or after a service restart. The initial card reading mechanism has been improved to ensure all cards are detected reliably.
* Fixed an issue where smart card readers (PC/SC) were released too early in some cases, which would cause unexpected errors during communication with company cards.
</ul>
|-
|1.1.0||2025-07-04
|<ul style="margin:1;">
* Disabled internal logging to internal.log, keeping only the main application logs. This prevents uncontrolled file growth and simplifies troubleshooting.
* Updated the Card ID logic to use the full ICC (Integrated Circuit Card) value instead of CardExtendedSerialNumber, ensuring better uniqueness and alignment with tachograph standards.
* Improved connection reliability between the CCA application and the TachoSync server.
* Applied minor stability improvements throughout the application.
</ul>
|-
|1.0.0||2025-04-25
|<ul style="margin:1;">
* Reduced memory usage to improve performance and stability.
* Added TLS 1.3 encryption for communication with the TachoSync server.
* Added a new 'Card number' column to the CCA monitor view, displaying the official company card number used.
</ul>
|-
|}

==CCA Interface==
[[File:Company Card Authenticator interface window.png|link=Special:Redirect/file/Company Card Authenticator interface window.png|frame|200px|alt=Company Card Authenticator interface|Company Card Authenticator interface]]

The CCA provides the name of the connected reader(s) and the following information in a table:
* Card slot - identifier of card slot in the reader.
* Card ID - a unique identifier assigned by the smart card chip - '''copy this ID to TachoSync when adding a new company card - see [[TachoSync Interface#Companies|“Companies”]] for more information'''.
* Card Number - card serial number that is printed on the card (and encoded electronically) that uniquely identifies the card.
* Status - card status.
* Company - name of the company.
* Valid from - validity start date.
* Valid until - validity end date.

In the bottom-right of the window, the information icon allows seeing version information in-app:

[[File:Company Card Authenticator verion_information.png|370x370px]]

==CCA Hosting Models==
'''A. Centralized Card Management (Provider-hosted CCA)
*The service provider hosts the company cards of the end-clients.
*These cards are stored in card hotels / hyper-racks (hardware racks that can host many cards at once).
*The CCA software runs on the service provider’s infrastructure, making all stored cards available to TachoSync.

'''Key highlights:
*End-clients do not need to install anything.
*Provider must handle logistics (collecting cards, renewing expired ones, securing them).
*Works best for providers serving many small transport companies that do not want local IT hassle.

'''B. Local Deployment (End-client hosts CCA)
*The end-client (transport company) keeps the company card on-site, usually in a single-slot USB smart card reader connected to a PC.
*The CCA application is installed on that PC.
*The CCA ensures that the tachograph server can access the card remotely, but the card never leaves the company’s premises.
'''Key highlights:
*Security-sensitive clients prefer this, because the card never leaves their office.
*No logistics of sending cards away.
*The provider doesn’t need to maintain a card hotel.

==Smart Card Readers==
To securely access and download tachograph data, logistics companies must use a company card — an official smart card issued by authorities.

It proves company ownership of vehicles and unlocks access to the data stored in smart tachographs.

===Single-slot Smart Card Readers===
[[File:Single slot smart card reader Identiv.jpg|thumb|alt=Single-slot smart card reader (© Identiv, 2025)|Single-slot smart card reader (© Identiv, 2025)]]
Single-slot smart card readers are an effective and cheap solution for small companies to manage several company cards. Usually, up to 10 readers can be connected via USB to a single Windows PC/server.

Examples of single-slot smart card readers:
* [https://www.hidglobal.com/products/omnikey-3021 HID OMNIKEY 3021]
* [https://files.identiv.com/products/smart-card-readers/contact/2700R/uTrust_2700R_DS.pdf Identiv uTrust 2700 R]
Requirements for single-slot smart card readers:
* [[TachoSync Company Card Authenticator | Company Card Authenticator]]  installed on the managing PC/server.
* Every single-slot smart card reader may have specific drivers and other requirements.

===USB Limitations with Single-slot Smart Card Readers===
When using a small number of company cards, standard USB smart card readers are usually sufficient. However, as the number of connected cards increases, USB-based solutions begin to reach practical and architectural limits.

Modern operating systems and USB controllers are designed for general-purpose peripherals, not for handling dozens of continuously active smart card readers in parallel. In larger setups, this can lead to issues such as:
* Unstable device enumeration when many readers are connected.
* Increased likelihood of communication timeouts or unresponsive cards.
* Limited ability to reliably scale beyond a certain number of readers per host.
* Reduced overall stability when readers are frequently accessed simultaneously.
These limitations are not specific to TachoSync or Company Card Authenticator, but are inherent to how USB buses, hubs, and smart card drivers operate at scale.

'''For environments that require many company cards to be available at the same time''' (e.g., large fleets or service providers), dedicated "card hotel" solutions (multiple-slot smart card readers) provide a more reliable architecture.

Systems like Lisle Hyper Card racks, are designed specifically for high-density smart card usage and address USB limitations by:
* Centralizing card communication through controlled hardware interfaces.
* Managing card identification and access in a predictable and scalable way.
* Reducing dependency on multiple individual USB readers and hubs.
* Improving stability when dozens of cards are inserted and accessed concurrently.

By using a "card hotel" solution, Company Card Authenticator can operate more reliably in large-scale deployments, ensuring consistent card detection, authentication, and long-term stability.
For a deeper technical explanation of USB limitations and how card hotel systems address them, see [https://www.lisledesign.com/usb-limitations here].

===Multiple-slot Smart Card Readers===
[[image:Hyper-card-rack-120-img3.png|thumb|alt=Multiple-slot smart card reader (© Lisle, 2025)|Multiple-slot smart card reader (© Lisle, 2025)]]
Multiple-slot smart card readers are the preferred solution when tens of hundreds of smart cards need to be managed. Multiple-slot readers help avoid most USB limitations and are easily scalable.

Examples of multiple-slot smart card readers:
* Lisle Design Hyper Card Rack readers
** [https://www.lisledesign.com/products/hyper-card-rack-120 Hyper Card Rack™ 120 - Lisle Design]
** [https://www.lisledesign.com/products/hyper-card-rack-20 Hyper Card Rack™ 20 - Lisle Design]
* Lisle Design Standard Card readers – limited scalability compared to the Hyper series
** [https://www.lisledesign.com/products/standard-card-desktop-6 Standard Card Desktop 6 - Lisle Design]
More information about Lisle card reader differences can be found [https://www.lisledesign.com/card-reader-comparison here].

Lisle Design Hyper Card Rack requirements:
* [[TachoSync Company Card Authenticator | Company Card Authenticator]]  installed on the managing PC/server.
* Drivers: [https://docs.lisledesign.com/hyper-cards/utilities/hyper-driver-for-windows/ Hyper Driver for Windows].
<br>

===Multiple Rack Configuration===
More than one multiple-slot readers can be connected to a server.

In this case, each Lisle Design Hyper Card Rack™ 20 or Hyper Card Rack™ 120 must be configured using the „DIP“ switches.

The DIP switches set the index of the rack in a sequence as a binary number, e.g.:
* First rack: 0000 (all switches off)
* Second rack: 0001 (first switch on)
* Third rack: 0010 (second switch on)
* Fourth rack: 0011 (first and second switches on)
* Etc.

{| style="margin: 0 auto;valign=" left""
|[[File:Hyper-card-rack-120-img5.png|thumb|left|x300px|DIP switches, lower right (© Lisle, 2025)]]
|[[File:Hyper-card-rack-120-img4.png|thumb|left|x300px|Multiple racks connected (© Lisle, 2025)]]
|}
===<u>Troubleshooting</u>===
{| class="mw-collapsible mw-collapsed"
!Cards become unresponsive after inactivity
|-
|
'''<u>Symptoms</u>'''
* CCA shows as ''connected''.
* Company cards become unresponsive or show communication errors after a period of inactivity.
* Restarting the '''CCA Windows service''' restores functionality temporarily.

'''<u>Cause</u>'''
* Windows '''USB selective suspend''' may put idle USB ports into a low power state.
* USB smart card readers do not always recover correctly when the port resumes.
* As a result, CCA loses communication with the reader.

'''<u>Workarounds</u>''' <br>
'''<big>Option A</big> — Disable USB selective suspend (recommended)'''
* Control Panel → Hardware and Sound → Power Options
* Change plan settings → Change advanced power settings
* USB settings → USB selective suspend setting → '''Disabled'''.
* Apply for Plugged in (and On battery, if applicable).

'''<big>Option B</big> — Disable USB power management per device'''
* Open '''Device Manager'''.
* Expand '''Universal Serial Bus controllers'''.
* For each '''USB Root Hub''': 
** Right click → Properties → Power Management.
** Uncheck '''Allow''' the computer to turn off this device to save power.

'''Notes:'''<br>
* This is a '''Windows power management behavior''', not a CCA defect.
* The issue is more likely to occur on non‑dedicated PCs with active power‑saving settings.
* For dedicated CCA hosts, '''Option A''' is usually the simplest solution.

''For more information'':<br>
[https://learn.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-selective-suspend Microsoft documentation]|[https://www.pugetsystems.com/support/guides/how-to-disable-usb-selective-suspend-1190/ Puget Systems guide]|[https://www.ninjaone.com/blog/configure-usb-selective-suspend/ NinjaOne guide]
|}

==FAQ Company Cards==
====What is the best way to sync daily 200 vehicles at one company account with many company cards?====

:The best approach is to use '''multiple company cards''' within the same company account. TachoSync allows you to '''assign specific vehicles to be authorized by specific cards''', which helps distribute the load efficiently.

:Additionally, you can optimize the download process by '''splitting the schedule into two groups''':

:*Schedule the first 100 vehicles to sync at 08:00
:*Schedule the remaining 100 vehicles to sync at 15:00

:This method prevents overloading the system, ensures more stable performance, and allows all vehicles to complete their downloads successfully within the day.

====Do I need to split each company card into separate companies?====

:No, it’s not necessary to separate each Company Card into different companies.

:TachoSync allows multiple Company Cards under the same company account. '''You just need to make sure each card is properly authenticated''' and assigned within the same company environment.

====Does TachoSync support more company cards under one company account?====

:Yes, TachoSync supports multiple Company Cards''' within a single company account. 
:This is a common setup for large fleets. Each Company Card can authenticate downloads for vehicles assigned to the same company, provided the cards are properly configured in the system.

====Is it possible to download from many vehicles at one company at the same time using multiple company cards?====

:'''Yes, simultaneous downloads are supported.'''

:If multiple Company Cards are connected (via local CCA or hosted solution), the system can initiate parallel downloads from multiple vehicles within the same company. This significantly improves performance and reduces the time required to sync large fleets.

[[Category:TachoSync]]