- Credential, reader, controller, locking device. The reader captures, the controller decides.
- Lock power must never run through the reader housing. Check for this on every survey.
- 125 kHz proximity cards broadcast a fixed number and clone in seconds.
- Ask what happens when the network drops. Offline decision making is not automatic.
The four parts
The credential is what the person carries or knows. A card, a fob, a phone, a fingerprint or a code. The reader is the device at the door that captures it. The controller is the brain that decides whether that credential is allowed through that door at that time. The locking device is what physically holds the door.
The critical point is that the reader never makes the decision. It captures and forwards. The controller decides. That is why a reader can be mounted on the unsecured side of a door without compromising the system, and why attacking a reader should not open a door on a properly installed system.
On a badly installed system it does, because somebody ran the lock power through the reader housing. Pulling the reader off the wall then exposes the lock wiring and the door opens. Check for this on every survey. It is common.
Credential technologies
Older proximity cards at 125 kHz broadcast a fixed number with no encryption and can be cloned by inexpensive hardware in seconds. A great many buildings still run on them. Say so when you survey, because most owners believe their card system is secure by virtue of being electronic.
Smart cards at 13.56 MHz can do mutual authentication with encrypted keys, which resists cloning properly, but only when the installer enabled it. A smart card reader configured to read the card serial number only is no better than a proximity card.
Mobile credentials move the credential into a phone over Bluetooth or near field communication. They are convenient, they are revoked instantly, and they depend on a charged phone. Keep a physical fallback for every mobile deployment.
Wiring and the controller
Legacy readers talk to controllers over Wiegand, a simple one way protocol with no encryption, which means the wire between the reader and the controller can be tapped and replayed. Modern installations use OSDP over an RS 485 pair with secure channel enabled, which authenticates and encrypts that link.
Controllers may be a panel in a cupboard serving many doors, or an edge device built into the reader at a single door. Panels centralise power and decision making. Edge devices simplify wiring and scale one door at a time.
Whichever it is, find out what happens when the network drops. A good controller keeps its decision list locally and continues working offline. A poor one stops admitting anybody, which turns an internet outage into a building wide lockout.
Common Questions
What are the parts of an access control system?
A credential such as a card or a phone, a reader, a controller that decides, a lock that obeys, and a power supply. Most faults are power or wiring rather than the clever end.
Do I need a server for a small system?
No. A two or four door controller with a browser interface handles a small site. A server only earns its keep across many doors or many buildings.
Can access control replace keys entirely?
Rarely. Almost every site keeps a mechanical override for power failure, and the fire service usually requires one. Plan for the key rather than pretending it is gone.
Rather hire someone for this?
The directory lists security system installer businesses by city, each with a phone number and its public reviews.
Find a security system installerWhat the specialist badge means