Installation

Danger

When installing this system, install it in a physically secure location. If the system is not set up correctly according to this manual, there is a risk of information leakage.

Warning

When disposing of this system, follow the procedures specified by local law.

Integration Platform Installation

For the Integration Platform install instructions, refer to the NEC UNIVERGE Integration Platform Documentation located here:

https://uip.nec-help.com/latest-onprem/Install/Installation-and-Updates/

Warning

You need to install at least UIP version 1.15

UIP Adapter Hub Installation

For the Integration Platform Adapter Hub install instructions, refer to the NEC UNIVERGE Integration Platform Documentation located here:

https://uip.nec-help.com/latest-onprem/Workflow-Engine/Adapter-Hub/Adapter-Hub/

Warning

You need to install at least Adapter Hub version 1.0.20

Tip

It is recommended that the Adapter Hub is installed on top of an Ubuntu Server that uses disk encryption. Refer to Installing Ubuntu Server With Disk Encryption Support for more details.

Smart Check-In Client Installation

The Kiosk Client is the application installed on the machine that is to be used by guests to check in or check out of the hotel.

The Kiosk Client install is launched by running the KioskInstaller.msi file. There is an option where the KioskInstaller.msi file may be run from a command prompt using the values /L*v "%TEMP%\KioskClientInstall.log". This allows the

KioskClientInstall.log file, which can be accessed from %TEMP%, to contain a full log of the installation process if any installation problems do occur.

The installation begins with a Welcome popup that contains a short description of the product.

Clicking Next will display the End User License Agreement. Before the user is allowed to advance to the next step, the acceptance checkbox must be checked, enabling the Next button that will allow the user to continue with the installation.

The Destination Folder dialog box allows the user to select the installation path where the application will be installed on the local hard drive.

If the default path is accepted or once another path is defined, clicking Next will proceed to the next step of the installation.

Scanner Services

To install a scanner for a Kiosk Client, it is recommended to follow the installation instructions provided by the licensed document scanner verification software. The components involved typically include the document verification engine (service), document verification engine drivers and the connected scanner device.

The Smart Check-in Client supports the following third-party scanner verification software packages:

AssureID Identity Verification Software
Veridocs ID Authentication Software.

The AssureID and Veridocs document scanner software requires a license from the document scanner provider. The license is bundled with the Smart Check In license in the North America region. For other sales regions, contact an NEC sales representative. The license typical requires an annual maintenance renewal.

Install NEC Scanner Service

Depending on the verification software package used, install either:

NEC AI Scanner Service (NecAIServiceInstaller.msi) in conjunction with the AssureID software.
NEC Veridocs Service (NecVeridocsInstaller.msi) in conjunction with the Veridocs software.

To create an installation log during the installation, initiate the installation from a command prompt with /L*v "%TEMP%\.log" option for the corresponding .msi file.

Document Reader Devices

The Kiosk Client supports the following document reader devices:

Gemalto CR5400 Double-sided ID card reader
Gemalto AT9000 Full Page Passport and Document reader
Gemalto AT10K Full Page Passport and Document reader

A supported document reader device needs to be connected to each Kiosk Client machine via a USB port connection.

The NEC Smart Check In Kiosk hardware system comes installed with an AT10K scanner.

Client Adapter Services

Some hardware devices and external vendor software need a local service running on the Kiosk Client machine in order for the UIP adapter to communicate to it or to communicate to it securely.

Examples of these devices are key card dispensers which are not on the network and some payment services.

See UIP Adapter documentation "https://uip.nec-help.com/adapter/" for details if an adapter needs these local services installed on the Kiosk Client machine for communication.

NEC Serial2TCP Service

The Serial2TCP service is required to be installed on each Kiosk machine when the Kiosk Client is integrated with a key card dispenser that connects to the PC via RS232.

The Serial2TCP service connects to the Kiosk Server and registers to the internal router component using a kiosk client id and token. When an adapter connects to the kiosk router using the same kiosk client id and token, communication and data can then be passed between the adapter, to the serial2TCP service and then to the RS-232 serial port. The Kiosk Router method of communication is secured with the same certificate as the Kiosk Client.

Serial2TCP Service Installation

Note: this windows service can be installed on any windows machine on which a serial device is connected.

Install .NET Runtime 8.0.x and ASP.NET Core Runtime 8.0.x on the target Windows machine.
https://dotnet.microsoft.com/en-us/download/dotnet/8.0
- .NET Runtime 8.0.x (OS:Windows|Installers:x64)
- ASP.NET Core Runtime 8.0.x (OS:Windows|Installers:x64)
To install the service, run the Serial2TcpInstaller.msi install and follow the prompts Run the "Serial2TcpInstaller.msi" installer file.
After installation, the appSettings.json file should be opened and settings modified as needed to complete the service configuration. The appsettings.json file is located in the install folder.
```
{
  "KioskRouter": {
    "KioskConfigFile": "",
    "KioskRouterApps": [
      {
        "RouterToken": "",
        "PortName": "COM3",
        "BaudRate": "9600",
        "Parity": "none",
        "StopBits": "1",
        "DataBits": "8"
      }
    ]
  }
}
```
Key Definitions:
- KioskConfigFile: The full path to the Kiosk Client connection file. The Kiosk Client connection file is generated from the Kiosk position page in Kiosk Admin. See Position Settings in this document for more details about the client connection file.
  
  If backslash characters are used, they must be escaped by doubling them.
  
  e.g., C:\\ProgramData\\NEC\\kiosk\\client-config.json
  
  Important If the KioskConfigFile key is empty, the Serial2TCP service will look for the connection file in the ProgramData path used in the example.
- RouterToken: The token string that matches the token in the adapter. The token must be unique across Kiosk Clients. Copy this token from the adapter properties in UIP Admin from the adapter that is connecting to this service.
- PortName: The serial port name as defined by the Windows Operating System.
- BaudRate: The serial port baud rate to use for the RS-232 connection.
- Parity: The partial to use for the RS-232 connection. The default is none. Can be set to none, even, odd, mark, or space.
- StopBits: The number of stop bits for the RS-232 connection. The default is 1. Can be set to 1, 1.5, or 2.
- DataBits: The number of data bits for the RS-232 connection. The default is 8.
If using a USB to serial connector, go to the Windows Device Settings and determine the serial communication port name assigned to the device to use for "PortName" setting in the "appsettings.json" file.
Open the Windows Services application and start the "NEC Serial2Tcp Service".

Use the services control panel to start/stop the service.
Logs for the Serial-2-TCP service are located in the ./logs folder of where the service is installed.

NEC TCP Proxy Service

The TCP Proxy service can be used as a remote connection between a supported UIP adapter, and a device connected to a Windows PC with an insecure TCP port. The service provides a secure TCP socket with authentication to proxy requests to an insecure (usually local) socket.

TCP Proxy Service Installation

Install .NET Runtime 8.0.x and ASP.NET Core Runtime 8.0.x on the target Windows machine.
https://dotnet.microsoft.com/en-us/download/dotnet/8.0
- .NET Runtime 8.0.x (OS:Windows|Installers:x64)
- ASP.NET Core Runtime 8.0.x (OS:Windows|Installers:x64)
Run the "TcpProxyInstaller.msi" installer file.
To specify non-default settings, edit the "appsettings.json" file located in the install folder:
```
"ProxySettings": {
"ProxyPort": "8085",
"ListenPort": "10001",
"UseTLS": "true",
"CertFilePath": "certificate\\serverCert.pfx",
"CertPwd": "P@ssw0rd",
"SecretKey": "My$3cre7KeY",
"KeepAliveCheck": "true",
"KeepAliveTimeout": "30"
},
"KioskRouter": {
"KioskConfigFile": "FILENAME",
"KioskRouterToken": "TOKEN"
}
```
Key Definitions:
- ProxyPort: The TCP port for connecting to the service/device being proxied.
- If TCP Proxy should listen for incoming connections using TCP:
  - ListenPort: The TCP listen port for remote UIP connections.
  - UseTLS: The TCP port SSL/TLS connection setting. ("CertFilePath" and "CertPwd" must be defined if "UseTLS=true")
  - CertFilePath: The file path to a (.pfx or .p12) server certificate. The client or UIP system must import the CA Root Certificate into its trusted store if the certificate was not signed by a well know CA.
  - CertPwd: The server certificate access password (if defined).
  - SecretKey: An (optional) key or password that the remote application must send after a successful connection.
  - KeepAliveCheck: Set to true to reset connection when no data is received on TCP connection for a KeepAliveTiemout period. For Example: If the LAN cable is unplugged, the TcpProxy service may not reset in a timely manner which will prevent the adapter from reconnecting.
  - KeepAliveTimeout: Maximum amount of time to wait for data from the adapter before the external connection is reset.
- If TCP Proxy should connect to Kiosk Router:
  - KioskConfigFile: The full path to the Kiosk Client connection file. The Kiosk Client connection file is generated from the Kiosk position page in Kiosk Admin. See Position Settings in this document for more details about the client connection file.
    
    If backslash characters are used, they must be escaped by doubling them. e.g., C:\\ProgramData\\NEC\\kiosk\\client-config.json
  - KioskRouterToken: The token string that matches the token in the adapter. The token must be unique across Kiosk Clients. Copy this token from the adapter properties in UIP Admin from the adapter that is connecting to this service.
Open the Windows Services application and start the "NEC TCP Proxy Service".

Use the services control panel to start/stop the service.
Logs for the TCP Proxy service are located in the ./Logs folder of where the service is installed.

Example Steps for Kiosk Client and Client Adapter Services Deployment

For this example, a site has a CRT-591 Y dispenser and would like to install a Kiosk Client position and securely connect the CRT dispenser adapter to the Kiosk Client machine housing the dispenser.

Follow these steps to configure Kiosk Client, Serial2TCP service and the CRT adapter.

Create the Kiosk Position in Kiosk Admin (See "Position Settings" in this document).
From the Kiosk Position page in Kiosk Admin, create the Kiosk position filling in the position name, dispenser ID and other fields as needed. Download the Kiosk Position Config file (this file contains the server connection information and certificate information). This file is used by both the Kiosk Client and the Serial2TCP service to connect securely to the Kiosk Server.
Copy the file to the Kiosk Client machine and update the “kioskconf.json” file to point to the copied location (note: do not place this file in the Kiosk install folder as it will get removed on upgrade and uninstall).
Launch Kiosk Client and confirm it connects successfully to the Kiosk Server.
Install the Serial2TCP service. See section "Serial2TCP Service Installation" in this document.
Enter the path in the Kiosk router field to the Kiosk Position file.
Make note of the Kiosk Router Token field. You can set this to anything you want.
In UIP, install the latest CRT adapter and give that CRT adapter a name related to the Kiosk position that will connect to the dispenser. There will be one adapter per Kiosk position.
Enter the Kiosk Server URL. This is the same URL you use to launch Kiosk Admin. This is the FQDN server name or Ip address you entered in the Adapter Hub Services install template when you created the Kiosk Services.
Enter the Kiosk Position name you created in step 1 that has the dispenser this adapter will control.
Enter the Kiosk router token value you entered in the config file for Serial2TCP Service. These must match.
For Client Certificate and Private key, go to Kiosk Admin > Connection Settings and copy and paste the Certificate and Private key into the Client Certificate and Client Private key fields for the adapter. See screen shot below.
Select your Model = Y for CRT-591 Y
Save and start adapter.

Kiosk Services installation on Adapter Hub

Kiosk Services are required to be installed on an adapter hub. The adapter hub can be installed on the same server as the UIP or on its own server. The adapter hub installation of the Kiosk Services allows the communication to easily secured with minimal external ports regardless of the server configuration. Deployment of the Kiosk Services on the adapter hub server are performed through scripting run from the the UIP.

BEFORE INSTALLING THE KIOSK SERVICES, YOU SHOULD READ CAREFULLY THE SOFTWARE LICENSE AGREEMENT WHICH IS AVAILABLE HERE. INSTALLING THE KIOSK SERVICES INDICATES YOUR INTENTION TO USE THE KIOSK SERVICES AND YOU'RE AGREEING TO BE BOUND BY THE TERMS AND CONDITIONS OF THE AGREEMENT. IF YOU DO NOT ACCEPT AND COMPLY WITH THE AGREEMENT, YOU SHALL DESTROY OR DELETE THE KIOSK SERVICES, AND YOU MAY NOT USE THE KIOSK SERVICES.

The Kiosk Services template deploys the Kiosk Orchestrator, which in turn deploys the following components:

Kiosk Admin - an administration application
- configure the Kiosk Clients
- create usage statistics reports related to Kiosk Client activity
Kiosk Server - processes all requests in and out of the Kiosk Clients
- Kiosk Clients connect to the Kiosk Server to get configuration data
- Provide license support for Kiosk Clients
- Pass Kiosk Client requests to UIP adapters
- Track Kiosk activity for usage reports
MongoDB Server - provides support for persisting the configuration data and the HTTP activity data for statistics
- The MongoDB Server is only installed if the mongo_connection_string in the Kiosk Services template is empty. Otherwise, the external MongoDB Server specified is used.
HAProxy: A reverse proxy used when communicating with the Kiosk Services. See also Securing the Communication between Kiosk Applications.

The deployment of Kiosk Services under UIP Adapter Hub is controlled by a service template which is described in the following section.

Kiosk Adapter Hub Services Template

An Adapter Hub Service has its own template that describes the resources to create the service.

The template is a JSON file that defines the resources to be created by the Adapter Hub.

The sections used by Kiosk Services are:

Properties - specifies name/value pairs that can be replaced in the other sections of the template.
- The server_addresses should contain all DNS names and IP addresses used to access the Adapter Hub.
  - Multiple server addresses must be comma-separated. e.g., "kiosk-hub.company.com,172.0.1.100"
  - The first entry is used by Kiosk Client to connect to Kiosk Server.
    - If a Kiosk Client must use a different entry from the list other than the first entry, the connection json files downloaded for the Kiosk Client positions should be updated manually.
- See also Securing the Communication between Kiosk Applications.
Services - describes a Docker service to create. This will run a Docker image as a single-instance service.
- The service defined is the Kiosk Orchestrator, which deploys and configures the remaining services.
Volumes - a folder created on the Adapter Hub host machine that is used to persist data on the host machine.
- The volumes are referenced in the services section.
Child Stack Suffix - used to deploy the Kiosk Services
Secrets - a blob of data stored in Docker that can be read (read-only) by one or more of the deployed Docker services.
- The secrets are referenced in the services section.

See also the Adapter Hub Services documentation.

Kiosk Services Deployment steps

Open the UIP administration application in a web browser
Navigate to Adapter Hubs > Adapter Hub Service
Click on the Add Adapter Hub Service button to open the Add Adapter Hub Service page.
- For Name specify e.g. KioskServices or any other suggestive name
- Check Deploy at create
- In the Hub drop down box, choose the Adapter Hub machine where you want to deploy your Kiosk Services
- Check whether your desired Kiosk Services version already appears in the Adapter Hub Service Templates drop down.
  1. If a Kiosk Services entry with the desired version appears, then select it. Selecting it will populate the Template edit field with the JSON template contents.
  2. If the drop down does not have any suitable entries, then proceed as follows:
    - From the Kiosk distribution, locate the Kiosk services template. Ex: kioskservices-x.y.zzz.json.
    - Open the chosen template file in a text editor such as Notepad or Notepad++. Copy its contents in the clipboard, then paste it in the Template edit field in UIP.
At this point, the Add Adapter Hub Service page should look like below:

Update the "properties" section of the template:

"server_addresses" - must be entered and should contain all DNS names and IP addresses used to access the Adapter Hub.
- Multiple server addresses must be comma-separated. e.g., "kiosk-hub.company.com,172.0.1.100"
- The first entry is used by kiosk client to connect to kiosk server.
  - If a Kiosk Client must use a different entry from the list other than the first entry, the connection json files downloaded for the Kiosk Client positions should be updated manually.
"mongo_connection_string" - may be optionally defined
- It is possible to install Kiosk Services using an existing MongoDB database, as long as it is a supported version and it has been configured for TLS access.
- This may be preferred in cases when a site already has a MongoDB service and/or wishes to keep their database encrypted at rest.

Warning

Do not change anything else in the template unless advised by an NEC representative.

Click Save when done editing. If everything is OK, you will notice after some time that the deployment shows successful and the services will appear as started. The Service Status displayed is for the Kiosk Orchestrator. Once it is started, it will need to deploy the remaining Kiosk Services. Typically this stage takes 1...5 minutes, but it may be slower, depending on the speed of your Internet connection.