By /

Back to: Advanced Physical Security Integration (APSI)

0

Lesson 4.2: Reader Technologies & Credentials

Module: 4 – Access Control Systems (ACS) Prerequisites: Lesson 4.1 (Controller Architecture) Estimated Time: 45–60 Minutes

1. Learning Objectives

By the end of this lesson, you will be able to:

  • Differentiate between Low Frequency (125 kHz) and High Frequency (13.56 MHz) technologies.
  • Demonstrate why legacy “Prox” cards are insecure and easily cloned.
  • Explain the mechanics of “Smart Cards” (Mifare/Desfire) and their encryption capabilities.
  • Compare Mobile Credentials (NFC vs. BLE) and Biometrics as modern alternatives.

2. How a Reader Works (The Basics)

An Access Control reader is essentially a radio antenna.

  1. Energize: It emits a constant magnetic field.
  2. Excite: When a passive card (no battery) enters the field, the copper coil inside the card “wakes up” via induction.
  3. Transmit: The card spits out a binary number (e.g., 10110...).
  4. Forward: The reader sends this number to the Controller to check access rights.

3. The Evolution of Credentials

Generation 1: Low Frequency (125 kHz) – “Prox”

  • The Standard: HID Prox, Indala, AWID.
  • How it works: It acts like a license plate. It broadcasts a static number (e.g., Facility Code 100, Card ID 5555) to anyone listening.
  • The Vulnerability:Zero Encryption.
    • The Cloning Attack: A bad guy can buy a $20 cloner on Amazon. They stand next to you in an elevator, “bump” your back pocket, and copy your card in 1 second. They can then print a sticker, put it on their gym card, and enter your building.
  • Integrator’s Rule: Never install new 125kHz systems. Only maintain old ones.

Generation 2: High Frequency (13.56 MHz) – “Smart Cards”

  • The Standard: MIFARE, DESFire, HID iCLASS.
  • How it works: It acts like a secure USB drive.
    • The reader and card perform a “Mutual Handshake” using encryption keys.
    • Reader: “I have the secret key.”
    • Card: “Prove it.”
    • Reader: (Solves math problem). “Okay, now give me your ID.”
  • Security:High. Much harder to clone without the encryption keys.
    • Note: Early versions (Mifare Classic, iCLASS Legacy) have been hacked. Always use EV1, EV2, or EV3 (DESFire) standards for banking/government clients.

Generation 3: Mobile Credentials (The Phone)

  • NFC (Near Field Communication):
    • Range: < 2 inches (Tap to enter).
    • Pros: Fast, secure (Apple Wallet/Google Pay).
    • Cons: Often restricted by phone OS (Apple locks down NFC heavily for 3rd parties).
  • BLE (Bluetooth Low Energy):
    • Range: 2 feet to 30 feet.
    • Pros: “Twist and Go.” You can leave your phone in your pocket.
    • Cons: Slower than NFC (takes 2-3 seconds to pair). Can accidentally unlock the door if you just walk past it.

4. Biometrics: You are the Key

When a card isn’t enough (or people keep forgetting them), we use biology.

  • Fingerprint:
    • Pros: Cheap, proven.
    • Cons: Hygiene issues (touching the sensor). Doesn’t work well on dirty/greasy fingers (construction sites).
  • Facial Recognition:
    • Pros: Contactless (hygienic), fast.
    • Cons: Privacy concerns. Can be tricked by high-res photos (requires “Liveness Detection” – blinking/3D mapping).
  • Iris Scan:
    • Pros: The most accurate biometric on earth. Even identical twins have different irises.
    • Cons: Expensive. User must stop and stare into a camera close-up.

5. Wiegand vs. OSDP (The Wire Protocol)

Once the reader reads the card, how does it tell the controller?

Wiegand (The Old Way)

  • Wires: Green (Data 0), White (Data 1), Black (GND).
  • Flaw: Unencrypted. If I rip the reader off the wall and attach a sniffer to the Green/White wires, I can capture every card number that opens the door.

OSDP (Open Supervised Device Protocol)

  • Wires: A (RS-485+), B (RS-485-), GND.
  • Advantage: Secure Channel Encryption (AES-128). Even if I sniff the wires, the data is scrambled garbage.
  • Bonus: Bi-directional. The controller can send updates to the reader (e.g., change the LED color, update firmware).

Integrator’s Mandate: All new installations should use OSDP.