AFT3CH is a Windows desktop application for viewing and processing physiological signals from BIOPAC systems. It runs as a standard user-mode .NET desktop application without installing services, kernel drivers, or modifying firewall rules or Group Policy.
Network communications use BIOPAC's documented Network Data Transfer (NDT) interface over standard TCP/UDP on explicitly configured ports (trusted LAN/VPN only). Optional encrypted MQTT telemetry is tunneled through port 443 for restrictive environments.
AFT3CH makes a single outbound HTTPS request to updates.orbit-biomed.com for version checking only—no silent downloads or installations. There are no listening HTTP services or remote command execution capabilities.
Network Data Transfer (NDT)
AFT3CH communicates with AcqKnowledge using BIOPAC's documented NDT mechanism, where AcqKnowledge acts as the server and AFT3CH as the client.
Connection Types
- Control Connection: AFT3CH → AcqKnowledge for channel configuration, sampling rates, and acquisition control via documented NDT commands
- Data Connections: AcqKnowledge → AFT3CH carrying physiological data streams (ECG, EMG, respiration, etc.)
All communications use standard TCP/UDP sockets on configurable ports. The protocol consists of binary sample frames with no arbitrary command execution beyond documented acquisition control.
Port Configuration
Control Port
Direction: Outbound from AFT3CH
Target: AcqKnowledge control port (configured in AcqKnowledge → Preferences → Networking)
Protocol: TCP
Purpose: Query acquisition, specify channels, start/stop via NDT commands
Data Ports
Direction: Inbound to AFT3CH (optional, only if on different hosts)
Source: AcqKnowledge host
Protocol: TCP or UDP (as configured)
Purpose: NDT binary data protocol for physiological streams
Firewall Summary: Only explicitly configured NDT ports between AFT3CH and AcqKnowledge are required. No exposure to wider network beyond these connections.
Security Profile
- NDT is unencrypted; intended for trusted LAN/VLAN or VPN environments
- Payload consists of physiological waveforms and metrics only—no OS-level data, credentials, or file access
- No arbitrary command execution capabilities
MQTT Telemetry (Optional)
AFT3CH can optionally send telemetry using MQTT as a client only, never as a broker. All connections are client-initiated and encrypted.
Connection Architecture
- Connects to one configured broker endpoint through client-initiated tunnel on TCP 443
- MQTT over TLS inside the tunnel with broker's secure listener
- Publishes JSON summary messages (physiological and channel data) to topics like
aft3ch/summary/...
- No listening MQTT socket—client mode only
Dual-Layer Encryption
Transport Layer (TLS)
MQTT carried over encrypted TLS channel providing confidentiality and integrity on the wire. Tunneled through port 443 in restricted networks.
Payload Layer (AES-GCM)
End-to-end encryption using AES-256-GCM authenticated encryption. Only authorized endpoints with correct key material can decrypt message contents. Tampering detected via GCM tag.
Required Outbound: AFT3CH_PC → MQTT_ENDPOINT:443/TCP
No Inbound Required: AFT3CH does not accept MQTT connections
Important: MQTT is used for data exchange only, not code execution. Messages are parsed into fixed, documented schemas for telemetry and bounded application configuration.
Application Security
Platform & Privileges
- .NET 8 / C# WinForms desktop application running in user mode
- Executes under currently logged-in account privileges
- Does NOT install kernel-mode drivers or Windows services
- Does NOT modify Group Policy or firewall rules
- Does NOT require permanent administrative privileges
File System Behavior
- Configuration (JSON/settings) and logs stored in well-defined user profile directory
- Does not scan, index, or transmit arbitrary local files
- No hidden scheduled tasks or autorun entries beyond standard shortcuts
Licensing & Updates
- Licensing: Local license.json file (offline), no remote activation service
- Update Checks: Single HTTPS request to updates.orbit-biomed.com for version metadata only
- User Control: Updates require explicit user action—no automatic downloads or installations
Remote Access Risk Assessment
No Backdoor Capabilities: AFT3CH cannot be used for general remote access or control of the system.
What AFT3CH Does NOT Provide
- No remote shell access or command execution
- No remote file browsing or filesystem access
- No remote desktop capabilities
- No general-purpose remote command interface
Limited External Inputs
- NDT Binary Data: Physiological samples and acquisition control from AcqKnowledge only
- Encrypted MQTT: Structured telemetry and bounded application configuration messages (e.g., channel visibility, layout arrangement)
These inputs can only influence AFT3CH's internal visualization and configuration—not the underlying operating system or other applications.
Firewall Configuration Reference
Required Rules
# NDT Control (Outbound)
From: AFT3CH_PC_IP
To: AcqKnowledge_PC_IP
Port: [NDT_CONTROL_PORT]/TCP
Purpose: Acquisition control and configuration
# NDT Data (Inbound, if different hosts)
From: AcqKnowledge_PC_IP
To: AFT3CH_PC_IP
Ports: [NDT_DATA_PORTS]/TCP or UDP
Purpose: Physiological data streams
# MQTT Telemetry (Outbound, optional)
From: AFT3CH_PC_IP
To: MQTT_ENDPOINT_IP
Port: 443/TCP
Purpose: Encrypted telemetry (TLS + AES-GCM)
# Update Check (Outbound, optional)
From: AFT3CH_PC_IP
To: updates.orbit-biomed.com
Port: 443/TCP (HTTPS)
Purpose: Version metadata retrieval