Physical Access Control Systems: An Overview

What Is a Physical Access Control System?

A Physical Access Control System (PACS) manages who can enter which physical spaces and when. At its simplest, a PACS replaces the mechanical lock and key with electronic credentials and automated decision-making. At its most complex, it integrates with video surveillance, intrusion detection, elevator control, visitor management, and enterprise IT systems.

Every commercial building you have badged into, every hotel room you have entered with a key card, and every parking garage that reads your credential uses some form of PACS. The global market for physical access control is worth over $10 billion annually and continues to grow as organizations replace mechanical locks with electronic systems.

Understanding how these systems work - and where they fail - is essential for physical security professionals, penetration testers, and facility managers.

The Four Layers

graph TD
    subgraph Layer_1["Layer 1: Credentials"]
        Cards["RFID Cards/Fobs"]
        Mobile["Mobile Credentials"]
        Biometrics["Biometrics"]
        PIN_Cred["PIN Codes"]
    end
    subgraph Layer_2["Layer 2: Readers"]
        RFID_Reader["RFID Reader"]
        BLE_Reader["BLE/NFC Reader"]
        Bio_Reader["Biometric Reader"]
        Keypad["PIN Keypad"]
    end
    subgraph Layer_3["Layer 3: Controllers"]
        Panel["Access Control Panel"]
        IO_Board["I/O Board"]
        Lock["Electric Lock"]
        REX["Request-to-Exit"]
        Door_Contact["Door Contact Sensor"]
    end
    subgraph Layer_4["Layer 4: Management"]
        Server["Access Control Server"]
        Software["Management Software"]
        Database["Credential Database"]
        Audit["Audit Logs"]
        Integration["VMS / Alarm Integration"]
    end
    Layer_1 -->|"Credential presented"| Layer_2
    Layer_2 -->|"Credential data sent"| Layer_3
    Layer_3 -->|"Access decision"| Lock
    Layer_3 <-->|"IP/RS-485 network"| Layer_4

The four layers of a physical access control system - each layer has distinct attack surfaces

A PACS has four functional layers, each with its own technologies, protocols, and vulnerabilities:

1. Credentials - The tokens that identify authorized users (cards, fobs, phones, biometrics, PINs)
2. Readers - The devices that capture credential data at the door
3. Controllers - The hardware that makes access decisions and operates the lock
4. Management Software - The central system for administering policies, users, and audit trails

The security of the entire system depends on all four layers. A weakness at any single layer can compromise the others. A system with cryptographically secure credentials is still vulnerable if the controller accepts unencrypted data from the reader. A system with strong controllers is still vulnerable if the management software has default passwords.

Credentials: What You Carry

The credential is the first link in the access control chain. It is what the user presents to identify themselves. Credential technologies span a wide range of security levels:

RFID Cards and Fobs

The most common credential type. RFID credentials range from completely insecure (125kHz proximity cards like HID ProxCard II and EM4100) to highly secure (13.56MHz smart cards like MIFARE DESFire EV3 and HID SEOS). The security difference between low-frequency and high-frequency RFID is enormous - see our article on HF vs LF RFID for a detailed comparison.

Key considerations for RFID credentials:

• 125kHz cards (ProxCard II, EM4100) can be cloned in seconds with cheap equipment
• MIFARE Classic (13.56MHz) has known cryptographic vulnerabilities
• DESFire EV2/EV3 and SEOS offer strong cryptographic security
• Multi-technology cards can support both legacy and modern protocols during migration

Mobile Credentials

Smartphones as access credentials, using NFC or BLE (Bluetooth Low Energy). Mobile credentials offer advantages: they are harder to share or lose than cards, can be provisioned and revoked remotely, and can require biometric authentication before presentation.

HID Mobile Access and other mobile credential platforms use the phone's NFC or BLE radio to communicate with compatible readers. BLE-based mobile credentials have the advantage of working at longer range (several meters for hands-free access) but introduce their own attack surface through the BLE protocol.

Biometrics

Fingerprint, iris, facial recognition, and hand geometry readers use physical characteristics as credentials. Biometrics cannot be forgotten, lost, or (easily) shared. But they have significant limitations: they can be spoofed (fake fingerprints, photographs), they generate false positives and negatives, and they raise privacy concerns.

Biometrics are typically used as a second factor alongside a card or PIN, not as a standalone credential.

PIN Codes

Numeric codes entered on a keypad. PINs are the weakest standalone credential - they can be observed (shoulder surfing), shared, guessed, and do not identify a specific individual. However, they add a useful second factor: something you know combined with something you have (card + PIN) is significantly stronger than either alone.

Readers: The Interface

The reader is the device mounted at the door that captures the credential data and sends it to the controller. Reader selection has major security implications.

Reader Types

Proximity readers (125kHz): Read LF RFID cards. Simple, cheap, and widespread. These readers have no cryptographic capability - they simply read the static card number and send it to the controller.

Smart card readers (13.56MHz): Read HF smart cards with cryptographic authentication. These readers can perform mutual authentication with the card, establishing that both the reader and card have the correct keys before exchanging data.

Multi-technology readers: Support multiple credential types simultaneously (LF, HF, NFC, BLE, mobile). Essential for migration from legacy to modern credentials.

Biometric readers: Capture and process biometric data. May process the biometric locally (template-on-card matching) or send biometric data to the controller/server for matching.

Reader-Controller Communication

How the reader sends credential data to the controller is a critical security point. Two main protocols dominate:

Wiegand: The legacy standard, dating from the 1980s. Wiegand uses two data lines (DATA0 and DATA1) to transmit the credential number as a series of pulses. Wiegand has no encryption, no authentication, and no tamper detection. The credential number travels in the clear over physical wires. An attacker with access to the Wiegand wires (behind the reader or in the cable run) can eavesdrop on credential numbers, inject fake credentials, or replay captured credentials. Wiegand is fundamentally insecure, but it remains the dominant reader-controller protocol because of its massive installed base.

OSDP (Open Supervised Device Protocol): The modern replacement for Wiegand. OSDP uses RS-485 serial communication with optional AES-128 encryption (OSDP v2 Secure Channel). OSDP provides encrypted communication between reader and controller, bidirectional messaging, supervision (the controller can verify the reader is connected and operational), and tamper detection. The Security Industry Association (SIA) developed OSDP, and it is now an IEC standard (IEC 60839-11-5).

Controllers: The Decision Makers

The access controller (also called a panel) is the brain of the PACS. It receives credential data from readers, makes access decisions based on its programmed rules, and triggers the electric lock if access is granted.

How Controllers Work

A typical controller manages 2 to 8 doors. It contains a processor, memory, a database of authorized credentials and schedules, I/O connections for locks and sensors, and a network interface to the management server.

The controller's decision process for each badge read:

1. Receive credential data from the reader
2. Look up the credential in the local database
3. Check if the credential is authorized for this door at this time
4. Check additional rules (anti-passback, two-person rule, threat level)
5. If authorized, send a signal to the electric lock to release
6. Log the event (granted or denied, with timestamp)

Controllers typically cache the credential database locally so they can make access decisions even if the network connection to the management server is down. This distributed intelligence is important for reliability - a network outage should not lock everyone out of (or into) the building.

Physical Security of Controllers

Controllers are mounted on the secure side of the door (inside the protected space, typically in a wiring closet or above the ceiling). This is critical because the controller controls the lock. If a controller is accessible to an attacker, they can potentially bypass it entirely by shorting the lock relay.

Major controller manufacturers include HID (Mercury controllers), Lenel, Honeywell, Genetec, and many others. Many vendors use the same underlying Mercury controller hardware with different management software on top.

Management Software

The management software (sometimes called a head-end) provides the administrative interface for the entire PACS. Through the management software, administrators:

• Add and remove users and credentials
• Define access levels (which credentials can access which doors, at which times)
• Configure schedules and holidays
• Review audit trails and event logs
• Monitor door status in real time
• Generate reports for compliance
• Integrate with other security systems (video, intrusion, fire)

Management software ranges from simple (a desktop application managing one site with a few dozen doors) to enterprise (cloud-hosted platforms managing thousands of doors across multiple continents).

Major management software platforms include Genetec Security Center, Lenel OnGuard, CCURE 9000, Brivo, and Verkada. The trend is toward cloud-hosted and cloud-managed solutions, though many high-security environments still prefer on-premises servers for data control.

Communication Protocols

graph TD
    subgraph Legacy["Legacy Protocol Stack"]
        L_Card["Card"] -->|"RF (unencrypted)"| L_Reader["Reader"]
        L_Reader -->|"Wiegand (unencrypted)"| L_Controller["Controller"]
        L_Controller -->|"Proprietary serial"| L_Server["Server"]
    end
    subgraph Modern["Modern Protocol Stack"]
        M_Card["Card"] -->|"ISO 14443 + AES"| M_Reader["Reader"]
        M_Reader -->|"OSDP v2 + AES-128"| M_Controller["Controller"]
        M_Controller -->|"TLS/HTTPS over IP"| M_Server["Server"]
    end
    subgraph Vulnerabilities["Vulnerability Points"]
        V1["Legacy: Every link unencrypted"]
        V2["Modern: End-to-end encryption\nat every layer"]
    end
    Legacy --> V1
    Modern --> V2

Legacy vs modern PACS communication - the encryption gap at every layer

A PACS has three communication links, each with its own protocol:

Card to reader: The RF protocol between the credential and the reader. Can be unencrypted (125kHz proximity) or encrypted (DESFire, SEOS).

Reader to controller: Wiegand (unencrypted) or OSDP (optionally encrypted with AES-128).

Controller to server: Typically TCP/IP, often proprietary. Modern systems use TLS encryption. Older systems may use unencrypted proprietary protocols.

A system is only as secure as its weakest communication link. A DESFire EV3 card with AES encryption talking to a reader that sends the credential over Wiegand has negated the card's cryptographic security at the reader-controller boundary.

Attack Surfaces at Each Layer

Understanding the attack surface at each PACS layer is essential for both security assessment and system design:

Credential Layer Attacks

• Cloning: Copying the credential data to a blank card. Trivial for 125kHz cards, feasible for MIFARE Classic, currently not practical for DESFire EV3 or SEOS.
• Skimming: Reading the credential data wirelessly without the cardholder's knowledge. Possible with concealed readers.
• Relay: Extending the credential's range through a wireless relay. Defeats proximity-based security. See our NFC relay attacks article.
• Social engineering: Borrowing, stealing, or photographing credentials. No technology can prevent a user from lending their badge to a colleague.

Reader Layer Attacks

• Wiegand interception: Tapping the Wiegand wires between reader and controller to capture credential data. Requires physical access to the wiring but is straightforward with a device like a Wiegand interceptor or ESPKey.
• Wiegand injection: Sending fake credential data over the Wiegand wires. Can be done with the same hardware used for interception.
• Reader replacement: Removing the legitimate reader and installing a malicious one that captures credentials and replays them to the controller.
• Reader tamper: Physically accessing the reader's mounting screws (often exposed on the unsecured side of the door) to remove the reader and access the wires behind it.

Controller Layer Attacks

• Physical access: If an attacker can reach the controller, they can potentially short the lock relay, reset the controller, or modify its configuration.
• Network attacks: Controllers on IP networks may be vulnerable to network-based attacks - port scanning, default credentials, firmware exploits.
• Firmware attacks: Some controllers have been found to have firmware vulnerabilities that allow remote code execution or configuration changes.

Management Software Attacks

• Default credentials: Management servers and controllers often ship with default passwords that are not changed during installation.
• SQL injection: Some management software has been found to be vulnerable to SQL injection attacks against its database.
• API vulnerabilities: Modern cloud-based management platforms expose APIs that may have authentication or authorization flaws.
• Insider threat: An administrator with access to the management software can add unauthorized credentials, modify access levels, or delete audit logs.

Modern Trends

The PACS industry is evolving in several directions:

Cloud-managed access control: Platforms like Brivo, Verkada, and Genea manage controllers remotely through cloud services, reducing on-premises infrastructure and simplifying multi-site management.

Mobile credentials: Smartphones replacing physical cards, using NFC and BLE. Mobile credentials offer remote provisioning, biometric authentication, and the convenience of one less card to carry.

Open standards: OSDP for reader-controller communication, PSIA for software interoperability, and various efforts to reduce vendor lock-in.

Convergence with IT: Physical access control increasingly integrates with IT access management (Active Directory, identity providers) to provide unified identity governance across physical and logical access.

AI and analytics: Facial recognition, behavioral analysis, and anomaly detection being added to access control platforms, raising both capability and privacy questions.

Conclusion

Physical access control is a multi-layered system where security depends on every component working together. A weakness at any layer - a cloneable credential, an unencrypted Wiegand link, an accessible controller, or a poorly secured management server - can compromise the entire system.

For organizations evaluating or upgrading their PACS, the key priorities are: modern credentials with real cryptography (DESFire EV3 or SEOS), encrypted reader-controller communication (OSDP v2), physically secured controllers, and hardened management software with proper access controls and audit logging.

For security professionals assessing these systems, understanding all four layers and their interconnections reveals the full attack surface. The most secure credential in the world does not help if the reader sends its data in the clear over Wiegand.

The BLEShark Nano is a compact tool for exploring BLE and WiFi protocols - useful for understanding the wireless technologies increasingly used in modern access control.

Get the BLEShark Nano - $49.99

This article is for educational purposes. Always obtain proper authorization before assessing physical access control systems. Unauthorized testing may violate laws and regulations.