An access badge relies on a radio frequency exchange between a passive chip and a reader connected to a controller. The apparent simplicity of the gesture (presenting, unlocking) conceals technical choices that determine the actual level of security, the maintainability of the system, and the regulatory compliance of the device.
Encryption and RFID Protocol: The Criterion That Specifications Underestimate
The operating frequency of the badge is not enough to qualify its level of protection. A 125 kHz badge without encryption transmits its identifier in clear text. Any commercial reader can copy it in a matter of seconds.
Mifare Classic badges, operating at 13.56 MHz, provide a first level of encryption, but their sector keys have been compromised for several years. We systematically recommend switching to the Mifare DESFire EV2 or EV3 format, which uses AES 128-bit encryption with mutual authentication between the badge and the reader.
This transition from Classic to DESFire is now considered the main security gain of an access control project, sometimes more decisive than adding new controlled doors. In practice, migrating to an encrypted protocol is cheaper than equipping an additional access point and neutralizes the cloning threat that renders any restriction policy obsolete.
To delve deeper into the operation of the badge system for door opening, it is necessary to distinguish three layers: radio communication, cryptographic authentication, and software management of rights. A weakness in any of these layers compromises the entire system.
IT Management and Identity Management: Who Really Administers the Badges
Badge access control is gradually migrating from security teams to IT teams. This shift is not cosmetic. It transforms the badge into a digital identifier linked to a corporate directory (Active Directory, Azure AD, LDAP).
The consequences are direct:
- The creation and revocation of a badge follow the user account lifecycle. A departure triggers automatic deactivation, without the site manager’s intervention.
- Access rights are assigned by role or group, rather than badge by badge, reducing assignment errors on multi-zone sites.
- Access logs feed into a SIEM or monitoring tool, allowing for correlation between physical access and logical access in case of an incident.
We observe that this integration imposes a prerequisite often overlooked: time synchronization between the access controller and the directory. A delay of a few minutes can lead to ghost access refusals or active badges after revocation.
Regulatory Constraints CNIL and NIS2 on Access Badges
The legal framework applicable to door badges has significantly evolved. Two texts now strictly govern deployments.
NIS2 Directive and Access Logging
The NIS2 directive, whose transposition into national law is expected by October 2024, imposes a traceable logging of physical access on entities in eighteen critical sectors. A simple badge without timestamped passage records no longer meets the requirements. The controller must retain logs for a duration defined by the organization’s security policy, and these logs must be protected against any alteration.
CNIL: Declared Purpose and Prohibition of Misuse
CNIL reminds us that an access badge to premises cannot be used for time control if this purpose was not declared from the outset, recorded in the processing register, and communicated to employees. Misuse of purpose exposes the employer to sanctions, even if the technical device allows it.
In practice, this means that the drafting of the GDPR register must occur before the purchase of the equipment, not after. The choice of the system (badge only, badge plus biometrics, badge plus mobile) stems from the legal basis selected and the principle of proportionality.
Physical Badge or Mobile Credential: Technical Arbitration
The NFC badge on smartphone is progressing rapidly. Recent platforms unify the management of physical and mobile identifiers on the same dashboard, eliminating double administration.
The mobile credential has a clear advantage in case of loss: revocation is instant from a web portal, without waiting for the physical return of the badge. However, it introduces a dependency on the phone (battery, NFC compatibility, BYOD policy) which can pose problems in industrial or hospital environments where smartphones are not always permitted.
We recommend a hybrid approach for sites with more than fifty users:
- Mobile credential as the primary identifier for employees equipped with compatible smartphones.
- Physical DESFire badge as a backup, encoded with the same rights profile, to cover outages and areas without network coverage.
- Unified revocation policy, with a maximum deactivation delay of less than fifteen minutes after reporting loss.
This dual modality avoids the classic scenario where a lost badge remains active for several days due to a lack of clear procedure.
Criteria for Choosing the Reader and Door Controller
The badge reader is the exposed link. It must resist vandalism (minimum IK08 rating outdoors), operate within a temperature range consistent with the installation, and above all not store any encryption keys in clear text in its memory. A transparent reader, which transmits the encrypted flow to the controller without decrypting it, limits the risk in case of tearing.
The controller, installed on the secure side of the door, manages the actuation of the electric strike or electromagnetic lock. Its memory capacity determines the number of badges manageable offline in case of network failure. A controller that retains only a few hundred identifiers becomes a bottleneck on a site with a large workforce.
The sizing of the system hinges on these two components. A high-end reader paired with an undersized controller degrades reliability as much as a encrypted badge read by an unsecured reader.