Access Control Credential Hardware for Parking: Proximity Cards to Mobile Credentials
Access control readers in parking facilities authenticate the people and vehicles allowed to enter — employees, monthly parkers, permit holders, fleet vehicles. The credential technology in use today spans four decades of development, from 125 kHz proximity cards to Bluetooth and UHF mobile credentials. Many facilities operate multiple credential types simultaneously, creating credential management complexity that affects both operations and security.
This guide covers the hardware and credential technologies in current use, their security and operational tradeoffs, and the migration paths toward modern credential architectures.
125 kHz Proximity Cards: The Legacy Infrastructure
Proximity (prox) cards operating at 125 kHz — including HID’s EM4100-compatible formats and the widely deployed HID Prox — remain the most common credential type in legacy parking access control installations. The technology dates to the early 1990s and the installed base is enormous.
How They Work
125 kHz prox cards contain a simple LC (inductor-capacitor) circuit that resonates when energized by the reader’s RF field, transmitting a fixed facility code and card number. The card has no microprocessor, no encryption, and no ability to authenticate — it simply broadcasts its ID when in range of a compatible reader.
Security Limitations
The security limitations of 125 kHz prox cards are well-documented and serious. The data transmission is unencrypted and not authenticated. With inexpensive off-the-shelf hardware (RFID readers available from electronics suppliers for under $100), an attacker can capture a card’s transmission from several feet away without the cardholder’s knowledge, then clone the credential onto a blank card.
For parking applications where access control protects employee parking, executive parking levels, or facility equipment rooms, 125 kHz credentials represent an unacceptable security posture by modern standards. The Physical Security Interoperability Alliance (PSIA) and ASIS International both recommend migration away from 125 kHz technologies.
13.56 MHz Smart Cards: The Security Baseline
13.56 MHz smart card technologies — including MIFARE Classic, MIFARE DESFire, HID iCLASS, HID Seos, and others — provide substantially better security than 125 kHz prox cards.
MIFARE Classic
MIFARE Classic (NXP Semiconductors) was the dominant upgrade path from 125 kHz prox throughout the 2000s. It uses a proprietary Crypto-1 cipher for authentication and data encryption. However, the Crypto-1 algorithm was reverse-engineered in 2008 and is now considered cryptographically broken. MIFARE Classic cards can be cloned by a motivated attacker with publicly available tools.
MIFARE Classic is a significant improvement over 125 kHz prox but is not a sufficient security solution for high-security applications.
MIFARE DESFire EV2/EV3
MIFARE DESFire EV2 and the current EV3 variant use AES-128 encryption, provide mutual authentication between card and reader, and support application-level key diversification. These are currently considered cryptographically sound and appropriate for high-security parking access applications.
DESFire EV3 adds additional features including transaction MAC verification and a transaction timer that prevents replay attacks. For any new smart card deployment, DESFire EV3 is the current-generation specification.
HID iCLASS SE and Seos
HID Global’s iCLASS SE uses a proprietary high-security element with AES-based cryptography. Seos, HID’s current-generation credential technology, is designed to work equally well in physical form (card, fob) and digital form (smartphone). Seos is the credential technology underlying HID’s Mobile Access platform.
Long-Range UHF RFID for Vehicle Identification
For hands-free vehicle access — where the credential is read from a distance without requiring the driver to present a card to a reader — UHF RFID (860–960 MHz, typically ISO 18000-6C / EPC Gen 2) provides read ranges of 3–30 feet depending on antenna configuration and credential placement.
UHF transponders are typically windshield-mounted tags or vehicle-embedded transponders. At controlled entry lanes, a fixed UHF reader identifies the approaching vehicle and triggers gate operation without requiring the driver to stop or lower a window.
UHF vehicle credentials are common in gated communities, corporate campuses, and government facilities. In municipal and commercial parking, their use is growing as the operational benefit of hands-free access becomes more apparent.
Mobile Credentials: Bluetooth LE and NFC
Mobile credentials — delivered to a smartphone app and presented via Bluetooth LE or NFC — represent the current direction of access control credential technology.
NFC-Based Mobile Credentials
NFC (Near Field Communication, ISO/IEC 14443 / ISO/IEC 18092) operates at 13.56 MHz and requires the phone to be within approximately 4 centimeters of the reader. For parking applications, NFC interaction requires the driver to present their phone to a reader — functionally similar to a card tap but with smartphone-based credential management.
NFC is supported in all current-generation iOS (since iPhone 6) and Android devices. iOS NFC access control requires iOS 12+ and the credential app must be from a certified NFC reader provider.
Bluetooth LE Mobile Credentials
Bluetooth LE mobile credentials operate at ranges from touch (near-field) to approximately 30 feet, depending on reader and phone configuration. For parking applications, BLE enables hands-free access: the driver’s phone in their pocket is detected as they approach a controlled entry point.
The security model for BLE mobile credentials has matured significantly. Current implementations use credential-specific cryptographic tokens with rolling codes — the phone does not broadcast a static credential that could be captured and replayed. HID Mobile Access, ASSA ABLOY Mobile Keys, and similar enterprise-grade platforms implement end-to-end encryption from the credential management server to the reader.
Reader Hardware Requirements for Mobile Credentials
Existing 125 kHz or 13.56 MHz readers cannot read mobile credentials — the communication protocols are entirely different. Reader upgrades are required to support mobile credentials. Some manufacturers offer modular reader designs that support field-upgradeable radio modules; others require complete reader replacement.
OSDP (Open Supervised Device Protocol, IEC 60839-11-5) is the current standard for reader-to-controller communication and supports the richer data exchanges needed for modern credential types including mobile credentials. Readers that support only the legacy Wiegand protocol limit functionality and security options.
FAQ
Can 125 kHz and 13.56 MHz readers coexist during a credential migration? Yes — multi-technology readers support both 125 kHz and 13.56 MHz credentials simultaneously, enabling phased migrations where cardholders are reissued new credentials without requiring immediate cutover of all users. Multi-technology readers are the standard tool for credential migration projects.
What is OSDP and why does it matter for access control hardware? OSDP (Open Supervised Device Protocol) replaces the legacy Wiegand protocol for communication between card readers and access control panels. Unlike Wiegand (which is one-way, unencrypted, and provides no tamper detection), OSDP supports bidirectional communication, AES-128 encryption, and reader tamper detection. New reader deployments should specify OSDP v2 compliance.
How should parking facilities handle credential migration from legacy prox cards? A phased approach is standard: deploy multi-technology readers that accept both old and new credentials; issue new high-security credentials to cardholders as they renew or request access changes; set a sunset date for old credentials. The timeline is typically 12–24 months for complete migration in a medium-to-large facility.
Are there open standards for mobile credential interoperability? The Physical Security Interoperability Alliance (PSIA) and ASSA ABLOY have contributed to mobile credential interoperability frameworks. HID’s Seos and similar standards allow credential management across multiple access control platforms. Full interoperability across all mobile credential vendors does not yet exist — verify specific integrations before committing to a mobile credential platform.
