🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Data Center Technician › Physical Security for Data Centers › Lesson 2
TEC-DATA82-09 · Lesson 2 · 14 clock hours · demo

Access Control Systems: Cards, Credentials, and Biometrics

Objective. Students will identify the components and signal flow of a proximity-card access-control system and explain how multi-factor authentication is achieved by combining card, PIN, and biometric readers.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

What Is an Access Control System?

A physical access control system (PACS) is the combination of hardware and software that decides who may enter a secured space and when. In a data center, PACS protects server rooms, network closets, and loading docks from unauthorized entry. Every system shares the same basic chain: a credential is presented to a reader, the reader sends data to an access control panel (controller), the controller checks the credential against its database, and the controller either releases a door strike or magnetic lock or denies entry and logs the event.

Credential Types and Their Frequencies

125 kHz Proximity Cards (EM Format)

These are the oldest and most common low-frequency cards. When you hold the card near a reader, the reader's antenna coil energizes the card through radio-frequency induction; the card returns a fixed ID number. Read range is typically up to a few inches. Because the card broadcasts the same number every time and the ID is stored in plain format, 125 kHz cards carry a high cloning risk — inexpensive handheld devices can capture and duplicate the credential silently.

13.56 MHz Smart Cards (MIFARE and Similar)

High-frequency smart cards contain a small microprocessor and encrypted memory. The reader and card perform a mutual-authentication handshake before any data is exchanged, which makes cloning significantly harder. Read range is similar to 125 kHz cards, but the security profile is much stronger. MIFARE Classic is an older standard with known vulnerabilities; MIFARE DESFire and similar modern variants use AES encryption.

Mobile Credentials

A mobile credential is a digital key stored in a smartphone app, transmitted over Bluetooth Low Energy (BLE) or Near-Field Communication (NFC) to a reader equipped to receive it. Security depends on the app's encryption and the phone's lock-screen protection. Mobile credentials are easy to revoke remotely, which is an operational advantage in a large data center with high staff turnover.

Inside a Wiegand-Protocol Reader

The Wiegand protocol is the industry-standard electrical interface between a card reader and an access control panel. Despite its age, it remains the dominant wiring standard in commercial installations.

A proximity card reader contains three main internal parts:

1. Antenna coil — a loop of wire tuned to the card's operating frequency; it both powers passive cards and receives the returned signal.

2. Controller board — decodes the card signal and converts it to Wiegand digital pulses.

3. LED and buzzer indicators — provide the user with visual (green/red) and audible feedback on grant or deny.

The reader connects to the access control panel on a small bundle of wires: power (commonly 12 V DC), ground, Data0, and Data1. The Wiegand 26-bit format sends bits as pulses on these two data lines — a low pulse on Data0 represents a binary 0, and a low pulse on Data1 represents a binary 1. The 26-bit message includes a facility code and a card number, bracketed by parity bits. The panel decodes the pulse stream and looks up the credential in its database.

Multi-Factor Authentication (MFA) in Physical Access

Security professionals classify credentials into three factors:

Using only one factor (a card alone) is single-factor authentication. Requiring a card and a PIN is two-factor authentication (2FA). Adding a fingerprint reader creates three-factor authentication. Data centers handling sensitive government, financial, or healthcare workloads commonly require at least two factors on high-security doors.

A typical data center MFA sequence: the employee taps a MIFARE card → enters a 4–6 digit PIN on an integrated keypad → places a finger on a biometric reader → the panel validates all three factors before energizing the door strike.

Biometric Readers: Enrollment and Error Rates

A fingerprint reader must first enroll a user — it captures a reference template during a controlled process. Operational accuracy depends on enrollment quality. A dry finger scans differently than a damp finger on the same reader, which can produce false rejects (the reader fails to recognize a legitimate user). Conversely, a poorly implemented system can produce false accepts (granting access to the wrong person). Calibration, multiple-scan enrollment, and reader maintenance reduce both error types.

Safety Notes

Access control panels connect to low-voltage DC power supplies, but the power supply itself connects to building AC power. Follow your facility's lockout/tagout (LOTO) procedure before opening any panel enclosure or touching wiring. Verify the circuit is de-energized with a multimeter set to AC voltage before you touch terminals. Wear safety glasses when working inside enclosures where capacitors may be present. Never bypass or defeat a door-locking mechanism — a failing-safe magnetic lock can release unexpectedly when power is cut, and a failing-secure electric strike will remain locked; know which type is installed before you work on it.

Key terms10

Wiegand protocolAn electrical communication standard that transmits card data from a reader to an access control panel using two data wires (Data0 and Data1); the dominant reader-to-panel interface in commercial access control.
26-bit Wiegand formatThe most common Wiegand data structure, encoding a facility code and card number in 26 bits with leading and trailing parity bits, sent as timed pulses on the Data0 and Data1 lines.
Proximity card (125 kHz)A passive low-frequency credential card that returns a fixed ID number when energized by a reader's antenna field; susceptible to cloning because no encryption is used.
MIFARE smart cardA 13.56 MHz high-frequency credential that uses a microprocessor and encrypted memory to perform mutual authentication with a reader, providing stronger cloning resistance than 125 kHz cards.
Multi-factor authentication (MFA)Requiring two or more independent credential factors — something you have, something you know, or something you are — before granting physical access.
False reject (false negative)An error in which a biometric reader fails to recognize a legitimate enrolled user and denies access.
False accept (false positive)An error in which a biometric reader incorrectly recognizes an unauthorized person as a legitimate user and grants access.
EnrollmentThe process of capturing and storing a reference biometric template for a specific user so the reader can compare future scans against it.
Door strike / magnetic lockElectromechanical hardware that physically holds a door closed; released by the access control panel when a valid credential is presented.
Mobile credentialA digital access key stored in a smartphone app and transmitted to a compatible reader via BLE or NFC, offering remote revocation and encrypted communication.
In class: Instructor-led teardown and bench demonstration of a Wiegand-protocol proximity card reader: identify antenna coil, controller board, and LED/buzzer indicators; trace the data wire path to a panel and explain the Wiegand 26-bit data format at a conceptual level. · Students handle and compare three credential types: 125 kHz EM-format proximity card, 13.56 MHz MIFARE smart card, and a mobile-credential app on a demo phone; discuss frequency, read range, and cloning risk for each. · Observe instructor enroll a fingerprint on a standalone biometric reader, then test false-reject by enrolling with dry versus damp fingers; record observations in a structured lab notebook entry following the template provided.
Materials: Bench access-control training kit (reader, controller, power supply), Wiegand 26-bit reference card, 125 kHz and 13.56 MHz sample cards, standalone fingerprint reader (enrollment-capable demo unit), multimeter, lab notebook template
Check: Exit ticket: students draw and label a signal-flow diagram from credential presentation through reader to controller to door strike, and answer five multiple-choice questions covering credential types and MFA concepts. Pass = diagram contains all five required elements and four of five questions answered correctly.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Physical Security / Access Control
1. In a Wiegand-protocol system, which pair of wires carries the actual card data from the reader to the access control panel?
Physical Security / Credential Management
2. A technician notices that a 125 kHz proximity card system is being used on a data center's most sensitive server room. What is the primary security concern with this credential type?
Security Fundamentals
3. A data center requires employees to tap a smart card AND enter a PIN before the door opens. This access method is best described as:
Physical Security / Biometrics
4. During fingerprint enrollment testing, students found that enrolling with a dry finger caused frequent false rejects when the same user later presented a damp finger. What does a false reject mean?
Physical Security / Credential Types
5. Which of the following credential types uses mutual authentication and AES encryption to protect against cloning?
Workplace Safety / OSHA 10
6. Before opening an access control panel enclosure to inspect wiring, which safety step must a technician complete first?
Physical Security / Credential Management
7. A mobile credential transmitted via Bluetooth Low Energy (BLE) offers which operational advantage over a physical proximity card in a large data center?
Physical Security / Access Control Systems
8. In the standard signal-flow path for a card-reader access control system, what is the correct order of components from credential presentation to door release?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →