Access control

by Michael Smith
NBS Information Specialist

In physical security, the term 'access control' refers to restricting entrance to a property, building, or room to authorised persons. This article looks briefly at the technology involved.

What is access control?

Access control systems are key to a safe working environment; employers are expected to provide adequate security measures to protect staff and company assets.

Physical access control can be achieved by a human (a guard, doorman, or receptionist), through mechanical means such as locks and keys, or through technological means such as access control systems.

The right choice of system will depend on the building security requirements and also the degree of control needed for the effective management of the workforce.

System operation

Physical access control is a matter of who, where, and when. An access control system determines who is allowed to enter or exit, and where and when they are allowed to enter or exit.

Electronic access control uses computers to solve the limitations of mechanical locks and keys. An electronic access control system grants access based on the credential (see below) presented. When access is granted, the door is unlocked for a predetermined time and the transaction is recorded. When access is refused, the door remains locked and the attempted access is recorded. These systems often also monitor the door and sound an alarm if the door is forced open or held open too long after being unlocked.

This illustrates a single factor transaction. Credentials can be passed around, subverting the access control list. For example, Alice has access rights to the server room but Bob does not. Alice either gives Bob her credential or Bob takes it; he now has access to the server room. To prevent this, two-factor authentication can be used.

In a two factor transaction, the presented credential and a second factor are needed for access to be granted; there are three factors (types) of authenticating information currently in use:

• Something the user knows (password or PIN)
• Something the user has (smart card)
• Something the user is (fingerprint or biometric measurement).

However, even though some systems use more than one of these factors, passwords are still the most common means of verifying a user's identity before access is given to information systems.

What is a credential?

A credential is a physical/tangible object, a piece of knowledge, or a facet of a person's physical being, that enables an individual access to a given physical facility or computer-based information system. Typically, credentials can be a number or PIN, an access badge or card, key fob, or other key, a biometric feature, or some combination of these items.

There are many card technologies including magnetic stripe, bar code, Wiegand, 125 kHz proximity, 26 bit card-swipe, contact and contactless smart cards. Typical biometric technologies include fingerprint, facial recognition, iris recognition, retinal scan, voice, and hand geometry.

Types of readers

Access control readers may be classified by functions they are able to perform:

• Basic (non-intelligent) readers: simply read card number or PIN and forward it to a control panel
• Semi-intelligent readers: have all inputs and outputs necessary to control the hardware (lock, door contact, exit button), but do not make any access decisions. When a user presents a card or enters PIN, the reader sends information to the main controller and waits for its response
• Intelligent readers: have all inputs and outputs necessary to control hardware; they also have memory and processing power necessary to make access decisions independently. Much the same as semi-intelligent readers they are connected to a control panel, but this also sends configuration updates and retrieves events from the readers.

Some readers may have additional features such as LCD and function buttons for data collection purposes (e.g. clock-in/clock-out events for attendance reports), camera/speaker/microphone for intercom, and smart card read/write support.

Management of access

Electronic access solutions should be simple yet effective. The management of building access and door entry can at first seem complex regardless of the size of the business. In managing access there are many things to consider; for example what time do employees arrive and leave, how long do they stay on site, in the event of a fire or other emergency situation how is the staff roll call made.

Visitors to the building also need to be controlled and the system needs to be able to restrict access to various areas and monitor were visitors have been and for how long.

Advantages of electronic systems

Time keeping disputes are routinely faced by employers, so it's not surprising that more and more businesses are introducing employee time recording solutions through access controls.

Allied to this system, reports give a full record of personnel movements, visitors can be pre-booked to aid in administration and lost cards can be blocked at the click of a mouse.

State of the art

In affordable state of the art, high tech biometric fingerprint or handprint employee clocking systems are becoming more popular. They offer absolute reliability and quality and absolute certainty that employees are not 'buddy punching'.

Many current access control systems also offer absence planning and holiday entitlement tracking included in the software along with a wide range of application reports.

Related NBS information:

Articles:

• How locks work: key facts about how to obtain closure

Selected links:

• Doors, windows

May 2011

BackToTop