An access control system using badges relies on three interconnected mechanisms: authentication of the bearer, verification of rights in a repository, and then control of a locking device. Behind this simple sequence, technological choices, network architecture, and identity management determine the actual level of security. Here, we detail the technical points that make the difference between a reliable installation and a bypassable device.
RFID Protocols and Encryption: What Separates a Secure Badge from a Clonable Badge
The radio frequency and communication protocol directly condition the resistance to cloning. A 125 kHz unencrypted badge (type EM4100) transmits its identifier in clear text. A pirate reader costing a few dozen euros is enough to duplicate it.
MIFARE Classic badges, widely deployed in France, use Crypto-1 encryption. This protocol has been publicly broken, making these badges vulnerable to relay or brute-force attacks on the sector key. We recommend considering them as an intermediate level of security, acceptable for low-stakes areas.
MIFARE DESFire EV2 or EV3 with AES 128-bit encryption currently constitutes the standard for sensitive sites. Communication between the badge and the proximity reader is end-to-end encrypted, with mutual authentication. Each transaction generates a unique session key, neutralizing passive eavesdropping attacks.
The architecture of the system is as important as the badge itself. When the access control badge is associated with a controller that includes a locally synchronized rights table with a central server, the decision to open remains functional even in the event of a network outage. This hybrid mode (local decision, centralized administration) avoids a single point of failure.
Convergence of Physical Badges and IT Identifiers: The PIAM Model
The most structuring trend in the access control sector is not the change of medium, but the unification of physical and logical identity. The PIAM (Physical Identity and Access Management) model merges the entry badge for the building and IT identifiers (workstation session, VPN, business applications) into a single repository.
The benefit for security is direct: an employee whose contract is terminated has their physical and digital access rights revoked simultaneously. Without convergence, the delay between the deactivation of the IT account and the withdrawal of the badge leaves an exposure window that we regularly observe during audits.
For the company, this model simplifies the management of authorizations. A single workflow provisions or deprovisions all access. It also reduces the surface of GDPR non-compliance, as the traceability of identification data is centralized in a single system instead of being dispersed between the access control software and the Active Directory directory.
Dematerialized Badge on Smartphone: Migration to Mobile Credentials
In recent years, the shift towards mobile identifiers has accelerated. The badge is replaced by a credential stored in the secure element or TEE (Trusted Execution Environment) of the smartphone. Communication with the reader occurs via NFC or BLE (Bluetooth Low Energy).
The mobile credential eliminates the risk of physical badge cloning. The cryptographic secret is never exposed: it is the smartphone that executes the proof of possession via a challenge-response, without transmitting the identifier in clear text.
Three technical conditions must be met for reliable deployment:
- A proximity reader compatible with NFC and BLE, with updated firmware to manage OSDP v2 protocols (encryption of the reader-controller channel)
- A cloud or on-premise platform capable of provisioning and revoking credentials remotely, in real-time
- A mobile device management (MDM) policy that ensures that only a compliant smartphone (up-to-date OS, no root/jailbreak) can receive a credential
BLE offers an operational advantage: hands-free remote opening, useful in parking lots or delivery areas. However, the wider range of Bluetooth requires fine-tuning of the RSSI threshold to avoid unintentional openings when a bearer passes nearby without the intention to enter.
Impact of NIS2 and the Cyber Resilience Act on Access Control Systems
The entry into force of the NIS2 directive and the Cyber Resilience Act modifies the requirements for companies operating connected access control systems. NIS2 expands the scope of affected entities and imposes risk management explicitly covering physical security when it interacts with the information system.
Specifically, an access controller connected to the company’s IP network falls within the scope of the cybersecurity policy. Firmware updates, hardening of network ports, and VLAN segmentation of the security subnet become documented obligations, no longer just best practices.
The Cyber Resilience Act targets manufacturers of products containing digital elements. Badge readers, controllers, and monitoring software must integrate security from the design stage (security by design) and provide security updates throughout the expected product lifespan. For installers and operators, this means that a contractual commitment to software follow-up must be required from the supplier.
Criteria for Choosing a Badge System for a Multi-Access Site
We recommend structuring the specifications around four technical axes:
- Minimum encryption level: AES 128 bits for sensitive areas, diversification of keys by site to prevent a cloned badge from working on another site
- The controller’s ability to operate in degraded mode (offline) with a synchronized local rights table
- Compatibility with mobile credentials to anticipate the gradual migration from physical badges
- OSDP v2 interoperability between readers and controllers, regardless of the manufacturer, to avoid vendor lock-in
The sizing of the identity management system remains the most underestimated factor. A site with several hundred employees, along with regular contractors and visitors, generates a provisioning and deprovisioning volume that, without automation, creates authorization gaps within weeks.
The choice of medium (DESFire badge, smartphone, or both coexisting) depends on the profile of the users and the existing fleet. The coexistence of physical badges and mobile credentials is the most common configuration during the transition phase, provided that the reader manages both protocols without degrading the level of security.