AuthenticationWorld.com

Access Control Cards

Enterprises have a vast array of choices when it comes to access control cards.  In addition to traditional access control situations, cards and card readers exist that service biometrics, time and attendance, digital cash, IT secure authentication, guard tours, parking medical and service storage.  Additionally the same cards can be used for digital cash, vending and billing.

Access control cards use a variety of technologies.  These include magnetic strip, Wiegand and contactless smart cards.

Access Control Cards - Magnetic Strip

This type of card is capable of storing data by storing data by modifying the magnetism of magnetic particles located on the card, commonly referred to as a magstripe.  The card's magstripe is read by physical contract and swiping of the card past a card reader.

These types of cards are regulated by International Standards Organization standards ISO 7810, ISO 7811, ISO 7812, ISO 7813 and ISO 4909. 

Magnetic strip cards are commonly used in access control for building access as well as in identity cards.  The technology is slowly being replaced by contactless smart cards which offer more features and security than the magnetic strip card.

Access Control Cards - Wiegand

A Wiegand access control card uses a series of embedded wires made with a special alloy that make them hard to duplicate.  Wiegand cards are extremely hard to counterfeit. The set of wires contains data such as identity information, credit card information, medical information, etc.  The card is read by passing it through or, by brining it near, a device called a "Wiegand sensor".  Due to the fact that a Wiegand card can operate over a wide variety of temperatures, these cards have been widely adopted for use in more weather prone environments.

Wiegand cards are often used in proximity cards.  This means that a user only has to be near the reader but does not have to touch the reader.  Proximity cards are useful for physical building access and also on production workflows where employees need access to facilities and/or applications in a hurry.  However, proximity cards are not a strong source of user authentication since the token does not mean that the person holding it is actually the person it was issued to.

Access Control Cards - Contactless Smart Cards

The contactless smart card has a microchip embedded in the card with internal memory.  This enables the card to:

• Securely manage, store and offer data access to the card
• Perform complex functions and calculations (e.g. encryption)
• Interact with an RF device in an intelligent manner

Common applications of contactless smart cards include:

Mutual authentication:

The contactless smart card can verify that the card reader is authentic and then verify itself to the card reader before starting a secure transaction

Strong information security:

The ability of the microchip and memory enable the card to encrypt any identity information contained in the card as well as encrypting the RF connection between the contactless smart card and the card reader.

Tamper resistant security:

There are a number of hardware and software capabilities that is built into contactless smart cards to detect and react to tamper methods and help counter attacks on the card.

Authentication and Authorization Information Access Control:

The contactless smart card can protect the information contained within the card by authenticating the information requestor and then allowing only the release of information the requestor is authorized for.   The card owner may have additional methods such as a PIN number or a biometric to approve release of the information.This is an example of strong authentication.

Selection of the access control cards should be done in context of the enterprise access control and identity management systems.  For example, will the cards and readers integrate with the enterprise Lightweight Directory Access Protocol (LDAP)?  Can the access control provisioning system create, modify or terminate an identity on the access control card identity server?  What is the strength of authentication required for the access control card?  Is it easy to tamper with?

A good access control consultant can help you avoid unnecessary expenses, integration problems or potential security holes with access control cards. A recommended vendor of access control cards is HID Corporation.

Access Control Software Systems

Password Authentication Single Sign On Authentication Access Control Authentication Authentication-Enterprise Security Authentication Strength Authentication Transaction
Authentication Management User Authentication Authentication Federation Biometric Authentication PKI Authentication Token Authentication Wireless Authentication Document Authentication Authentication - Outsourcing