What are the parts of an access control system?
Every system has the same chain. A credential is what a person presents. A reader captures it. A controller holds the list of who may go where and when, and makes the decision. A lock or gate operator actuates, often with a door position sensor and a request-to-exit device. Software manages users, schedules and logs. In a well-designed system, the intelligence sits in the controller inside a secure space, not in the reader on the outside wall.
That separation matters. If the reader merely forwards data and the controller decides, then stealing or tampering with the exposed reader does not unlock the door by itself. Controllers keep working when the network drops, storing rules locally and logging events to send later. Standalone locks combine reader, controller and lock in one unit for single doors, trading central management for simplicity. Networked systems add reporting, remote changes and integration with video and alarms.
What kinds of credentials are there?
Credentials fall into three families: something you have, something you know and something you are. Cards and key fobs, mobile phones and QR codes are things you have. PIN codes are things you know. Fingerprint, face and iris are biometrics. Each trades convenience, cost and security differently. A PIN can be shared or shoulder-surfed; a card can be lent or cloned; a biometric cannot be lent but can raise accuracy, privacy and legal considerations that vary by place.
Combining factors raises security. A card plus a PIN, or a phone plus a biometric, makes theft of a single item insufficient. Many sites apply stricter factors only to sensitive doors. Think also about lifecycle: how credentials are issued, how fast a lost one is revoked, and how visitors and contractors are handled. A credential that cannot be revoked quickly, or that anyone can copy at a kiosk, defeats the control.
How do card and tag technologies differ?
Older proximity cards operate around 125 kHz and simply broadcast a fixed number when energized by the reader's field. They are cheap and durable, but they offer no cryptography, so the number can be read and copied with inexpensive equipment. Newer smart cards operate at 13.56 MHz and can hold encrypted data, perform mutual authentication with the reader, and carry application data. They resist cloning if the system uses strong keys, though some early 13.56 MHz designs have known weaknesses.
Longer-range UHF tags exist for vehicles and gates, reading at a distance without a deliberate tap, and are covered in their own explainer. Contactless cards are passive: they have no battery and draw power from the reader's field. Metal, thick holders and stacked cards can detune them. When comparing technologies, ask three questions: does it use real cryptography, who controls the keys, and can the cards be copied by a standard tool? Ask the supplier, not the brochure.
How do mobile credentials and biometrics work?
Mobile credentials store an encrypted credential in a phone and present it to the reader over Bluetooth Low Energy or near-field communication. The phone provides a screen lock, remote revocation and easy issuance, and no plastic to lose. Considerations include battery, compatibility across phone models, how the reader decides a phone is truly intended to open the door instead of merely nearby, and relay attacks on hands-free modes. A tap or button press adds intent.
Biometric readers compare a live sample with a stored template. Matching is probabilistic, so systems balance false accepts against false rejects, and outdoor conditions such as glare, cold, wet or gloved fingers can reduce accuracy. Templates are sensitive personal data, so storage, consent and retention rules matter and differ by region. Biometrics often work best as a second factor or on interior high-security doors, with a backup method for when a reader fails.
How do readers connect, and what about standalone options?
Readers connect to controllers through Wiegand or OSDP, or through the network. Wiegand sends bits in one direction without protection, while OSDP offers supervision and encryption over a shared serial bus. Door hardware adds more choices: fail-safe locks release when power is lost, fail-secure locks stay locked, and life safety codes decide which is permitted on which door. Electric strikes, magnetic locks and gate operators each have different power draw and behavior.
Standalone and wireless locks suit places where cabling is hard: the lock holds its own credentials and rules, and a periodic sync updates it. The trade-off is slower revocation and thinner reporting if the link is intermittent. For gates, consider vehicle readers, intercom, and safety loops that prevent the barrier closing on a car. Whatever the design, plan for power outage behavior, manual override, and a documented process for lost credentials.
How does access control fit a remote or temporary site?
Remote sites such as construction yards, utility compounds, temporary events and ballot drop box areas have no building network and often limited power. Practical options are a self-contained battery or solar-powered reader and lock, or a small controller in a locked enclosure fed by a DC supply, with a cellular link for events and rule updates. Keep the exposed hardware simple, rugged and tamper-resistant, and keep the decision logic out of reach.
Pair access events with video. A door-open alarm or denied-credential event is far more useful when someone can look at what happened. If a site needs it, those events can reach a monitoring platform as webhooks or gateway messages, so an operations center can verify and respond. Plan offline behavior first: when cellular drops, will the gate fail open, fail closed, or follow cached rules? Decide deliberately and test it.
Key terms
- Credential
- The thing a person presents to prove identity, such as a card, phone, PIN or biometric sample.
- Controller
- The device holding access rules and making the unlock decision, normally installed in a protected area away from the reader.
- Proximity card
- A low-frequency card that broadcasts a fixed number when energized, generally without encryption and easy to clone.
- Smart card
- A higher-frequency contactless card able to store encrypted data and authenticate mutually with the reader before releasing any credential.
- Multi-factor authentication
- Requiring two or more different kinds of proof, such as a card plus a PIN, so one stolen item is not enough.
- Fail-secure
- A lock that stays locked when power is lost, as opposed to fail-safe locks that release; use is governed by life safety codes.
- Request to exit
- A sensor or button that signals a person is leaving, so the system unlocks the door and does not log a forced entry.
A remote access point such as a gate or compound door needs power, a protected controller, weather-resistant hardware and a way to report events. A trailer like this offers DC power and cellular connectivity, and if a site needs it, door events can reach the platform as gateway or webhook events where the operations center reviews them with video. Credential choices, wiring and lock codes are site-specific decisions.
Common questions
What is the most secure type of access credential?
No single type wins. Smart cards or phones using strong cryptography beat basic proximity cards, and combining two factors beats any one. Pick the credential that fits the risk of the door, and make sure lost ones can be revoked quickly.
Can proximity cards be copied?
Yes, most low-frequency proximity cards broadcast a fixed unencrypted number, so inexpensive readers can capture and copy it. If copying is a concern, move to smart credentials that use mutual authentication and unique keys, or add a PIN so a copied card alone is not enough.
Do I need a controller, or are standalone locks enough?
Standalone locks suit a few doors with infrequent changes. A controller adds central management, reporting, quick revocation and integration with video and alarms, and keeps decision logic away from the exposed reader. Choose based on door count and risk.