Walk In, You've Been Recognized: The Evolution of Identification Technologies in Modern Access Control Systems

PERCo has expanded its PERCo-Web access control system with new BLE-enabled readers, companion mobile apps, and a joint facial recognition solution developed with the CRТ group. The update provides an opportunity to examine how identification methods in physical access control have developed without any single technology fully displacing the others. Traditional proximity and MIFARE cards remain the foundation, while QR codes, NFC, BLE, and biometrics each occupy specific niches based on convenience, security, and regulatory requirements. Russian Federal Law 572-FZ has fundamentally changed facial biometrics deployment by mandating use of the Unified Biometric System (EBS) or accredited commercial systems (KBS) for authentication. The article explains the technical workflow from reader to controller, the cryptographic protections of modern cards, the contactless advantages of BLE, and the privacy and compliance considerations that now make facial recognition a 'technology of trust' rather than simple convenience.

HabrTranslated from Russian

Read at source

PERCo has released a new line of readers supporting Bluetooth Low Energy (BLE), accompanying mobile applications, and a joint facial identification solution developed with the CRТ group. These additions to the PERCo-Web access control platform offer a timely occasion to review how identification technologies in physical access control systems (СКУД) have evolved over recent years.

Access control systems have always followed the same core principle: a person possesses an identifier, presents it, and the system decides whether to grant entry. Earlier, this identifier was a paper pass checked by a guard who could also perform verification by comparing the visitor’s face with a photograph. Modern systems distribute this work across readers, controllers, and actuators while preserving the same logical sequence.

Proximity and MIFARE Cards as the Enduring Foundation

The first truly mass-market contactless cards operated at 125 kHz (proximity cards). Their simplicity and low cost turned access control from a specialized solution into a mainstream product used in offices, business centers, and educational institutions. The next generation, MIFARE smart cards, introduced protected memory and cryptographic authentication mechanisms originally developed for public transport. Today, cards are divided into two classes: those carrying only a factory identifier and those with cryptographically protected memory. Multi-format readers allow organizations to migrate gradually from legacy cards to protected ones without replacing the entire infrastructure at once.

QR Codes: Convenience for Temporary Access

QR codes gained popularity with the spread of smartphones because the phone’s camera and screen can serve as both reader and transmitter. They excel at issuing temporary passes for visitors, contractors, or parking lots without requiring physical cards or installed applications. Their main limitation is easy duplication, making them unsuitable for scenarios demanding strict identification.

NFC and BLE: Expanding Contactless Capabilities

NFC works well with existing MIFARE infrastructure, allowing NFC-enabled phones and bank cards to function as identifiers. However, platform restrictions on iOS and uneven NFC hardware support on low-cost Android devices have limited its universal adoption. BLE overcomes many of these constraints. It operates over several meters, supports “hands-free” passage, and lets installers adjust detection range via signal threshold settings. BLE also enables wireless configuration, firmware updates, and diagnostics of readers without physical connections.

Biometrics and Regulatory Transformation

Biometric methods—fingerprints, palm vein patterns, and face—offer the advantage that credentials cannot be transferred. Facial recognition, however, now operates under strict Russian regulation. Federal Law 572-FZ requires that facial biometric processing use either the state Unified Biometric System (EBS) or accredited commercial biometric systems (KBS). These platforms perform liveness detection and authentication before returning a standard digital identifier to the access controller. As a result, facial biometrics has shifted from a convenience feature to a regulated “technology of trust” primarily justified by compliance needs, such as construction site access in Moscow or critical infrastructure protection. Alternative identification methods must remain available for individuals who have not consented to biometric processing.

The overarching conclusion is that the oldest and simplest technology—identification by access card—continues to serve as the reliable foundation of most systems, while newer methods occupy specialized roles shaped by security, usability, and regulatory demands.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Policy & Regulation

Russian Minister Proposes Blocking All SIM Cards Linked to Fraudsters Banned in MAX Messenger
Russia Ready to Disclose Source Code of Social Networks, Messengers and AI Models
Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi