Comparing credential technologies

What you should be able to do

Compare common credential categories and identify the compatibility and management questions needed before choosing or testing them.

Teaching Narration

A credential presents information that an access system can evaluate. Its physical appearance does not establish how it communicates, what data it carries or whether a particular reader can use it. Two similar badges can use different technologies, and a card or fob may contain more than one technology.

The poster compares four representative categories. Low-frequency proximity includes familiar 125kHz access credentials. High-frequency contactless smart-card examples operate at 13.56MHz. Those frequencies identify broad communication categories, not universal interoperability or security levels. Match the actual credential technology and supported application.

For a smart-card deployment, verify the credential application, reader support and required provisioning or keys through the authorized process. Reading a card's serial number is not automatically equivalent to using its intended protected application. Do not claim a secure deployment solely from the words smart card, NFC or encrypted on a package.

Mobile credentials require a supported combination of credential service, reader, device and software. NFC and Bluetooth are communication methods used in supported products; they are not promises that every phone, wallet or app can open every reader. HID publishes device compatibility information, illustrating the need to check the exact deployment rather than rely on phone appearance.

A PIN is entered knowledge. Systems may use it alone or combine it with another credential according to supported configuration and policy. Axis documents card and PIN options in its access products. Protect individual codes and use the approved issuance, reset and revocation procedures. A shared code cannot provide the same individual attribution as uniquely assigned use.

End-To-End Comparison

Trace the chain from credential to reader to controller and access rules. Credential-reader compatibility is separate from the reader-controller interface. A change to that interface does not automatically make an unsupported card application readable. The next lesson addresses reader interfaces.

For each candidate, document the exact technology and product identifiers, supported reader configuration, credential data format, administrative provisioning requirements and intended authorization process. Verify the actual model and firmware support where relevant. Frequency alone is only one field in that record.

Also consider the user's operational needs: carrying a separate token, entering a private code, using a supported phone, and obtaining a replacement. The organization must have a process for lost devices, staff changes and revoked access. The learning task is to identify those requirements, not choose a universal winning technology.

Worked through

Two fictional cards are both marked as 13.56MHz products. The installed reader supports the intended application on Card A but not the application on Card B. A trainee assumes B will work because the frequency matches.

Correct the assumption by checking the credential and reader documentation. Record the exact supported application rather than writing simply compatible RFID. Do not attempt to copy a production credential or extract protected keys to make an unsupported card work.

In a second exercise, a mobile credential cannot be enrolled on a demonstration phone. Separate device or platform support from the user's door permissions. A person can have the correct access assignment while the phone setup remains unsupported or incomplete. Record the observed stage of failure before diagnosing the reader.

Security And Scope

No category in the poster is a blanket security rating. Security depends on the particular credential design, how the reader uses it, configuration, key management where applicable, the downstream system and administrative controls. Refer product-specific decisions to the authorized design and security requirements.

A credential being successfully read does not establish permission to enter. Assignment, validity and access rules remain separate. Likewise, deleting an app or collecting a physical badge is not evidence that every associated credential has been revoked in the system. Follow and verify the organization's authorized lifecycle process.

Supervised Practice

Use non-production test credentials and supplied documentation. Prepare one comparison record per category supported by the trainer. Identify which attributes are known, which are documented and which remain unverified. Observe only the authorized enrollment and presentation demonstrations.

For each demonstration, distinguish credential detection, recognized identity and access decision. Record failures at the observed stage. Do not include full credential numbers, PINs, keys or other sensitive data in a shared classroom worksheet.

Comparison Record

Credential category and exact product: Communication technology: Reader model and supported application: Required format / authorized provisioning reference: Controller and configuration reference: Issue / replacement / revocation process: Observed demonstration: Unverified compatibility or security requirement: Responsible reviewer:

Knowledge Check

Sources