An access control project using badges is not just about choosing between MIFARE Classic and DESFire. The reliability of the system primarily depends on the communication architecture between readers, controllers, and management software, and then on the policy for managing identifiers. Here, we detail the technical points that general guides tend to overlook.
RFID Protocol Vulnerabilities and Anti-Cloning Protection for Badges
MIFARE Classic badges use a proprietary encryption (Crypto-1) that has been broken for over a decade. A consumer device like the Flipper Zero can read, copy, and replay a Classic identifier in a matter of seconds. Deploying this type of badge is akin to installing a lock whose key can be duplicated in a parking lot.
MIFARE DESFire EV2 or EV3 with AES 128-bit encryption is the minimum foundation for a professional site. The reader and the badge establish mutual authentication before any data exchange, which blocks replay and passive cloning. Some integrators also offer badges with a diversified identifier by site, making a copied badge unusable in another area.
Before implementing badge access control, we recommend verifying that the chosen reader supports full cryptographic validation and not just UID reading, as some low-end models only read the unencrypted serial number of the badge, nullifying all DESFire security.
Physical Badge or Mobile Identifier: Technical Arbitration for Your Premises
According to HID data published in 2024, 39% of organizations are already using mobile identities. The access identifier becomes a digital token stored in Google Wallet or the iOS wallet, with direct consequences for operational management.
Concrete Advantages of the Mobile Badge
- Instant remote revocation, without needing to retrieve a physical badge when an employee leaves. The token is removed from the wallet in seconds from the administration console.
- Temporary access delegation via link or QR code, useful for visitors and contractors. No stock of visitor badges to manage or deposits to hold.
- Elimination of the risk of hardware cloning, as the identifier relies on a secure element (Secure Element) of the smartphone, which is not readable by a third-party reader.
Constraints to Evaluate
The mobile badge assumes that each user has an NFC or BLE compatible smartphone. In an industrial or logistics environment, this assumption does not always hold. The coexistence of DESFire physical badges and mobile identifiers on the same readers is possible, but it requires multi-protocol readers and management software capable of handling both types of identifiers in a single repository.
The cost of licenses per mobile identifier varies by vendor. On a site with several hundred users, the total cost difference may make the physical badge more relevant if turnover remains low.
Network Architecture and NIS2 Compliance of the Access Control System
The NIS2 directive, whose transposition into French law has been delayed, imposes enhanced requirements on the entities concerned regarding the security of information systems, including physical access control systems connected to the IT network. An access controller connected to the company’s LAN becomes a potential attack vector if not segmented.
We observe that the majority of installations in SMEs still place controllers on the same VLAN as office workstations. Isolating access controllers in a dedicated VLAN with strict filtering limits the attack surface. The flow between the management software and the controllers must transit in TLS, and the default passwords of the controllers must be changed upon commissioning.
Cloud or On-Premise Supervision
Cloud solutions simplify maintenance and security updates, but they introduce a dependency on the Internet connection. In the event of an outage, the controller must operate in standalone mode with its local rights database. Check the controller’s embedded storage capacity and the synchronization policy upon reconnection.
An on-premise architecture retains total control over traceability data. It remains preferred in sectors subject to strong regulatory constraints (defense, health, Seveso sites).
Sizing and Choice of Locking by Zone
The type of locking mechanism determines reliability as much as the badge itself. An electric strike suitable for a lightweight interior door releases the latch in the event of a power outage, which poses a safety issue on an exit leading outside.
- Electromagnetic lock (holding force from 300 to 600 kg depending on the model) for fire doors and exterior access. It operates in “fail-safe” mode: the door unlocks in case of power failure, in accordance with fire evacuation requirements.
- Electric strike with break for technical rooms where the door must remain locked even without power (“fail-secure”).
- Motorized lock for high-traffic doors requiring multi-point locking, especially main access points of tertiary buildings.
Each access point must be treated individually based on its exposure, fire classification, and traffic volume. A zoning table crossing these criteria with the type of locking prevents sizing errors.
Traceability of passages, fine management of time slots by user profile, and the ability to revoke an identifier in real-time form the functional triptych of a reliable system. A well-encrypted badge on a poorly configured controller remains a vulnerability. The robustness of access control depends as much on network configuration and administration policy as on the choice of badge technology.
