Axis: Use QR Codes Instead of Access Cards

By: Brian Rhodes, Published on Sep 12, 2017

Innovation in access may be hard to find, but Axis recently suggested an idea for credentials few have considered. Rather than using plastic cards, Axis suggested a different approach: Use QR Codes instead.

Furthermore, Axis explained how to implement the idea using their own equipment.

Is this a good idea?

Inside we take a deeper look, and examine using QR Codes as credentials, including its negatives and positives.

Axis *****: ** ***** ******* / ******* **** *****

*************, **** ** ********** that ******* ** *********** cards, **********, ** ****, users ****** ***** **** QR *****, * **** of ******** *******. **** QR **** ** **** to ***** ******** *********** about ***** *** *** commonly **** ** ******** for ******-***** ******** ******, product ************** *** '**** info' *****, ** ** mail ******** ********* ** track ********.

**** ****** ** ***** for ****** ***** ** a **** ********* *********** to *****, ****** ***** by '****** ***** ** purchasing, ********, ********, ************ and ********* ** ******** cards', *** ******* * 'huge ******** ****** ** the *********** *** ****** emissions'.

Axis ****** *** **** ** *****

** ** ****,**** *************** ****** **********, ***** IP ******* ****** **** **** ******* ***, ******:

*** ** **** ******** example **** **** ********** a ** ***** ******** onboard *** ** ******* and/or ***** **** ******** in *********** **** *** AXIS ***** ******* **** Controller.

*******, *** ******** **** describes *** ***** **** and *********** **********, ********* that ** ****** ** installed *** *** ******* major *********** ****.

******* *********

******* *** ******** ********, using ** ***** ******* of *****, **********, ** PINs **** *********** ********:

  • ** ***** **** ** ******
  • ** **** ********* ********
  • ****** *********** ********
  • *** ****** *** *** Locations
  • ** **** ***** ******* Critical

** ******* **** ** these ****** ** ********* sections.

Hard ** ******

*** **** *********** ******* is ********** ** **** credentials ** **** ****** be ****** ** ****** are **** ********* **** other *****, * ***** Axis ******:

***** ** ***** ** credential ** **** ******** when ******* *** *** user *********** *** ********** outweigh ***** *** ********. So **** ** *** meet ******* *** **** security ************.

**** ******* ********* **** point:

**** ***** **** ** don't *** ** ***** as * *********** ** traditional ******* ************** *****, encrypted *********** ** **********. Rather, **** ***** * convenient, ********* *** ****-********* means ** ******** *********** for **** ******** *** regular *********. **** ******** of ******** ******** ******* for ** ***** ** a ********** ***** ******* hotels, ****** *********, ***** and ****** ******.

******* ** ***** *** be ****** **** ********* no **** ************* **** cameraphones, **** ****** **** are *** ******** ** mainstream ************ ** *********** cards, *** ****** ******** and ******* *********** ***** applications.

QR **** ****** ******* ********

***** **** **** ******* equipped **** ** ***, QR **** ******* *** doors *** *** ******** available.

** **** *****, *** actual ** **** ****** is * *** ****** that **** ** ******** fitted *** *** ** kiosks *** *********.

** **** ******* ******** for ****** ******* *** are *** ********* **** typical ****** *******, *** a ***** ** ******** security ************ ****** ** dedicated ******* *** ****, significantly ********* ******** ******* of *** *********** ****-******* approach.  

Use **** **** ******* *** ********** **********

** ***** *** ******** point **** **** *********** ** selling (****) ******* ** QR *******. *******, ** does ******* **** ********** due ** *** **** of ***** ******* *** logistical ************** ** ******** cameras *** ********* ******* drops ** **** ***** point.

******* ********* *** ******* outside *** ****** ***** proximity ** *****, ** defined ** ********** **** **** ***, ******* ** ** camera ** * ***** it *** ** **** by *** *****, ********** those *** *** ********, may *** ** * reasonable *******. 

QR **** ***** ******* *********

****** ***** ***********, ***** images ** ** ***** are *********, ********** **** cameras *** **** ** readers. **** ******* ***** density ************ *** ******* QR ***** ** "***/** (or ~*** ***)", * PPF *********** **** **** a *** * ******* of *.*' **** **** a ****.

**** ******* ********* ***** quality ************:

*** ** **** ****** be ******* ******** ** the ***** ******* *** distortions, *********** ** ********. Unlike **** *****-***** ******* readers, ***** ** ** guidance ** *** ** hold *** ** **** or ***** ** **** the **** ***** **** shows *** ** ****. But ** ***’* **** difficult **** ***** * QR **** ** *** phone *** *** *****-** at ** *******.

**** **** ******** *** PPF *** *** * problem, *** ******* ** the ** ****, ******* power ** * ********* displaying **, ** *** user *********** ** *** code ** * *****/******* raises operational ************.

Custom *********** ********

***** *****, * ****** reader ********** *** ******* or **** *** ** run ******** **** *** reader ** * **********, but **** ** *** the **** **** **** cameras-as-QR *******.

******* ********** ***** ***** ********** is * *** **** of *** ***********, **** clarified ** **** ****:

*** **** ***** ******* Door ********** *** ** integration *** ** **** readers

******, *** *** **** be **** ** ****** the **********, * ******* the **** ***** *** **** Barcode ******* ********* ** ******. **** explained:

*** ****** *** **** controller ********** ** ** application ******* ** *** camera **** ******** *** powerful *** ** *** AXIS ***** ******* **** Controller ** **** *** QR ********** **** *** network. *** **** ********* also ******* ** *** are ***** *** ******* or **** ********* *** credential **************

*******, **** ************* *********** how ****** ******* **** readers *** ** ******** connected ** * ********** in * '**** & play' ******, ***** ** Code ******* *** ******* cannot.

At **** ***** ************

******* ** ***** ***********, we *** **** ******** primarily ***** **** ** niche ************, ***** ******** is *** * *********** concern.

Visitor ********** *****

*** **** **** ******** the *********** ***** ** a **** *** ** for '*********' ****** ******* and ************** ** ********, an *********** ** ***** in *** ******* ********** ******* ******** ****. 

******* **** ******** *** case ***** ******** ***** visits ** *****, *** days, *** ********* *** provisioned ****** ******** ****** (eg: ******** ** **********). Visitors *** ********* **** supervised ** ******* *********, so **** ** *** QR **** ******** ***** are **********.

*** ******* **********, *** convenience ** ******* *** inexpensively ******** ** **** paper ******* ****** ** a ******* **** ******* and ******** ******* '*******' passes. ********** ******* ** doors ** ** ********** expense, *** *** *********** would ****** ** ******* to ******** ******** ** nonsensitive *** ****** *****, creating ***** '******* ******' for ******** **********. *** added ****** ****** ********* could **** ** ********** used ** ****** ***** of ****** **** ******, and **** ****** * solid ***** ***** ** a *****.  

*** ******* **********, ****** traditional ******** *** ***** surveillance *******, ********* *** two ************ ** **** describes *** ******** *** operational ******** ** ****. 

Comments (27)

We recently installed these on some speedlanes, they have a wiegand output and seem to work quite well.

QscanT QR Code reader

 

 

Outstanding info, thanks for sharing.  Do you have a rough idea of price?

 

We use those all of the time for temporary employees / short term badges.  Price is around $1200 MSRP (I believe) for this model.  We see the vendor price but not MSRP so I may be off as I am backing into the number.

FST Biometrics offers an option to issue a QR code for guest access.  The code is displayed to, and read by, a camera on the system to grant access.

FST Biometrics

If FST Biometrics are so great, why don't they just use face recognition with a picture of the person?

FST requires enrollment.  So a guest would have to be enrolled in the system, for which the process is no different than your typical visitor system.  The use of QR codes is a secondary access measure which does not require your guest to stop and be enrolled.  Also, FST is designed to specifically not allow an image to be used as a fraud detection measure.  The point of my post was not to promote FST's QR code capability but to point out that other manufacturers have found value in the use of QR for access.

to point out that other manufacturers have found value in the use of QR for access.

What value has FST found? In your initial comment, you explain that you supported the feature. I am just curious how many deployments and how valuable did those deployments find QR codes?

I discuss the QR Code guest option in most presentations.  I am unsure how many end users had this as a high priority, but I do know that trying to streamline the visitor management process is a concern of a majority of clients.  For FST it works quite well in a few of our residential complexes in NYC.  It is not a feature we lead with obviously as facial biometrics is the lead, but it often comes up. Within the QR code you can also define the time period and date the code will work, so if you grant a guest access from 7p to 9p on 9/13, the code will not work before or after that time.  I do not know enough about the Axis solution, and again my initial post was to say that it is possible that QR codes could be finding a useful home.  When a company as big as Axis gets behind a technology there is usually some merit.  More deployments will find more benefits and more issues.  Time will determine if it is viable solution, but I applaud any companies that are trying new methods to improve the systems we all either sell or use.

If you're going down the path of credentials issued to your phone then surely HIDs Mobile Access is a much more efficient way of going about it?

If 'efficient' qualifies the ease of provisioning token or codes to mobile users, then I would agree with that.  

However, from a cost point of view, the operational cost of creating and sending QR Codes is free - a large number of no cost websites or apps exist - while HID's Mobile Access portal costs more than $5 per credential to use.

Not very innovative, KEYKING is offering it for more than 2 years worldwide. Due to very low security, it can be copied and faked very easily, it is in use usually in it's parking and speedgate POS solutions and not access control.

Axis, as a CCTV manufacturer, see everything via the camera lens rather than access control security.

Good to see that the discussion is open about the use of QR codes for access control. Of course not new nor an invention of Axis of course but we introduced this more than one year ago as an added value for our camera portfolio and especially for the video doorstations.

The benefit of using QR codes is about the ease of credential distribution to an ocasional visitor. Of course we know about the limitations in security of a QR code and how easy it can be to replicate/copy. However, if the code is sent to a personal smartphone, then you rely on the phone owner and his mobile security to prevent the fraud. If you think of that, then you'll realize that it is not as vulnerable as innitially expected. Anyway the solution is intended for temporary credential in low security access, as it has been pointed out.

As for the integration or usability, of course it is an Axis solution and is developed to increase Axis camera sales as well as to add another feature to our access control solutions. However there are up to thre ways to use the functionality delivered by the camera embedded app. It has been mentioned the integration with the Axis Entry Manager software included in the Axis A1001 controller. For that, the communication is of course an IP network communication, by the way more standard and flexible than Wiegand or OSDP and at least can be as secure as the last one. That includes wireless connectivity or WAN capabilities.

The second option is to deliver HTTP communication with a third party server that can be local or cloud based. This allows a flexible way to integrate with other access control systems and credential management, of course not as easy as plug&play.

The third one is just stand alone in the camera (most likely the video doorstation) which is able to handle a list of  QR codes with valid time period (expiration date). Then no need for integration or communication with any third party, just an added feature for the Axis video doorstation (for free).

Regarding the image quality requirements, yes, it is not as performant as a QR scanner, but we do not think of 200 people in a short time accessing the doorway, like it could be in a plane boarding gate. Basically it requires a capture code of around 40x40 pixels and we use it with the doorstations which have 1MP or 2MP cameras. If you don`t get it read at first, just move it in front of the camera until it opens the door, 10 to 30 cms in front of the doorstation is ok and it works fine. I suggest you to try it, if you have an Axis doorstation..

I've read the article and every comment and I feel like I must be a 2 year old for not getting this. What is the point of this? Isn't it about as secure as an elastic band on your front door? So, you take a photo of any-ones QR code (ID badge, card T shirt!! etc), and show it to your reader - you're in??

I looked at something similar for a museum that wanted visitors to print out their own QR code at home and use it to gain admittance. We looked at Telepen and the IBC kit - which all ticked the box for convenience.

I'm sure it has it's uses - but security sure as hell isn't one of them!

To liken it to the CCTV debate - it would be the same as printing the username and password in plain English on an id card.

If you want security and convenience - facial recognition would be the way to go.

 

 

I understand the concerns about the security level of using a QR code that can be easily copied just taking a photo. However, the reality is not that bad. Actually nobody is printing out a QR code (if you use that argument you are surely much older than 2 years). The fact is that QR codes are sent to personal mobile devices, those so personal that nobody is moviong along without them. So to get the QR you must have the permission or collaboration of the device's owner. If you have that collaboration you also can copy a proxcard or magstripe. Yes, with some more technology but not so difficult. Rememeber as well that to get the access granted, you must show the QR code to a camera that can record also who is presenting that code. So you can track unauthorized use later.

On the other hand the use of the codes is intended for temporary access to non critical areas, those areas where the organization may have low risk and / or additional security / control staff. However it brings a big advantage since the credential can be sent out to the person at any moment prior to the accces and without his presence at a desk or attended point.  Whererver you have a door intercom or video door station you always need staff to attend calls from visitors. If you can skip already authorized visitors the workload for the staff will be dramatically reduced. We've seen this being used like that in some large customers with providers and outsourced maintenance teams.

Traditional bar codes have been around for a while in the access control market with many of the same pros and cons. Is this really just the same thing with the modern QR code? My understanding of the benefit of QR codes is they can hold more data than just a number. For temporary access control solutions like visitors, do you need more than a number to unlock a door? 

For temporary access control solutions like visitors, do you need more than a number to unlock a door?

Good question/point.  I would answer 'no' to your question, too.  

The size and 'error correction' within the code (redundant pixels) influence max capacity. For a QR Code about 200 X 200 pixels:

QR Code = bucket that hold 30 KB worth of data

Visitor Access Credential = about 2 KB worth of data

Hello, interesting article and clever comments. Where can I download this Barcode and QR reader ACAP? I’d not find it in Axis web page,,,

I believe it requires the camera have firmware v5.8 and it is listed in the Axis partner portal.  Are you a registered partner able to login to: https://www.axis.com/us/en/my-axis/login

 

Hi, Brian is totally right, it works from firmware version 5.80

There are actually up to four apps (ACAP applications):

a) Barcode Reader - Just to read the barcodes/QR codes

b) Barcode Authenticator - To integrate QR credentials  (Read by Barcode Reader) with Axis A1001 door controller

c) Barcode Easy Access - To make it work in standalone mode inside an Axis Door Station

d) Barcode Reader Webservice- to send credentials to a web service in LAN or WAN. A way to integrate with third party systems.

If you can't find what you need in the Axis Partner's Portal, get in contact with your Axis representative.

 

 

 

There is always the theoretical to carefully consider... but it seems to me if real-world security and usability of QR codes was so bad, they wouldn't be allowed for use on airplane boarding passes millions of times a day. For most people, the security access level of their home or office doesn't hold a candle to what it takes just to get them in a seat on a public airplane...

they wouldn't be allowed for use on airplane boarding passes millions of times a day

Interesting point. I am not sure but in the airport use case, every person has already been personally screened. The only risk is someone going on the wrong flight not that the person has bypassed security generally, yes/no?

With airplane boarding passes, QR Codes are a '1 time only' credential and the risk of duplication/misuse is quite limited due to time.

However, with general building access, credentials can be issued for many years. Not only does this increase the time/opportunity for duplication, but it also requires system maintenance and increasing overhead cost to issue new codes, invalidate old ones, update user records, and so on.

Update: Axis has made QR Codes for Access its 'topic of the month' for December 2019:

That cites a November 2019 Axis blog post promoting this - QR codes for smart, cost-effective access control - Secure Insights

Cost-effective? Maybe, but probably not. Unless if you are using Axis access control and have Axis cameras at the close distances needed to read the codes at openings.

Secure? No. Anyone who takes a picture of the code can mimic whomever the code was initially issued.

Secure? No. Anyone who takes a picture of the code can mimic whomever the code was initially issued.

That right there is the nail in the coffin for many. It seems easy to abuse, mimic, and I can imagine the inconvenience some (if not many) end-users of the system would have.

When I was an integrator, people would bitch about fumbling around for an access card in their wallet/purse. I don't think many would take too well to having to whip out their phone in the rain or having to put a phone call on hold to open a door.

I could see this working for situations where you want to give a guest access without having to send them a card/fob or setup a temp code.

I agree, short term general visitor access is an example that springs to mind. Its clearly not for use in place of a proper credential for higher security areas.

Read this IPVM report for free.

This article is part of IPVM's 6,538 reports, 881 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now

Related Reports

Keypads For Access Control Tutorial on Jul 28, 2020
Keypad readers present huge risks to even the best access systems. If...
Exit Devices For Access Control Tutorial on Aug 25, 2020
Exit Devices, also called 'Panic Bars' or 'Crash Bars' are required by safety...
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
Favorite Access Control Credentials 2020 on Sep 15, 2020
Credential choice is more debated than ever, with hacking risk for 125kHz and...
Verkada Access Control Tested on Sep 09, 2020
Verkada raised $80 million earlier in 2020, expanding from video into access...
Axis License Plate Verifier Tested on Jul 21, 2020
Axis has historically left license plate verification to their partners, but...
HID Releases VertX Replacement Aero on Aug 10, 2020
HID is replacing two established and broadly supported types of access...
The Insecure Verkada Access Control System on Jun 25, 2020
While Verkada touts the security of its system and that how their new door...
Door Fundamentals For Access Control Guide on Aug 24, 2020
Doors vary greatly in how difficult and costly it is to add electronic access...
Risks Of Managing End User Passwords (Statistics) 2020 on Sep 11, 2020
Alarmingly, most integrators used spreadsheets to manage passwords, IPVM...
Access Visitor Management Systems Guide on Jul 22, 2020
"Who are you, and why are you here?" Facilities that implement Visitor...
Free Online NFPA, IBC, and ADA Codes and Standards 2020 on Sep 03, 2020
Finding applicable codes for security work can be a costly task, with printed...
Use Access Control Logs To Constrain Coronavirus on Apr 09, 2020
Access control users have included capabilities that are not commonly used...
Remote Network Access for Video Surveillance Guide on Jul 27, 2020
Remotely accessing surveillance systems is key in 2020, with more and more...
Face Masks Increase Face Recognition Errors Says NIST on Aug 04, 2020
COVID-19 has led to widespread facemask use, which as IPVM testing has shown...

Recent Reports

Hanwha AI Object Detection Tested on Sep 28, 2020
Hanwha has added detection and classification of people, cars, clothing...
Favorite Access Control Manufacturers 2020 on Sep 28, 2020
200+ Integrators told IPVM "What is your favorite access control management...
New Products Show Fall 2020 Starts Tomorrow! on Sep 27, 2020
Tomorrow, IPVM's sixth online show will feature New Products from over 25...
OnTech Smart Services Partners With Google and Amazon To Compete With Integrators on Sep 25, 2020
A pain point for many homeowners to use consumer security and surveillance is...
The Future of Metalens For Video Surveillance Cameras - MIT / UMass / Immervision on Sep 25, 2020
Panoramic cameras using 'fisheye' lens have become commonplace in video...
Hikvision Sues Over Brazilian Airport Loss on Sep 24, 2020
Hikvision was excluded from a Brazilian airport project because it is owned...
China General Chamber of Commerce Calls Out US Politics on Sep 24, 2020
While US-China relations are at an all-time low, optimism about relations...
Verkada Disruptive Embedded Live Help on Sep 24, 2020
Call up your integrator? Have someone come by the next day? Verkada is...
IP Networking Course Fall 2020 - Last Chance - Register Now on Sep 23, 2020
Today is the last chance to register for the only IP networking course...
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
Norway Council of Ethics Finds Hikvision Human Rights Abuses "Ongoing" on Sep 23, 2020
Hikvision's involvement in "serious human rights abuse" in Xinjiang is...
IPVM Camera Calculator User Manual / Guide on Sep 23, 2020
Learn how to use the IPVM Camera Calculator (updated for Version 3.1). The...
Installation Course Fall 2020 - Save $50 - Last Chance on Sep 22, 2020
This is a unique installation course in a market where little practical...
SimpliSafe Business Security Launched Examined on Sep 22, 2020
SimpliSafe has launched "SimpliSafe Business Security" that the company...
FLIR CEO: Many New Fever Entrants "Making Claims That The Science Just Won't Support" on Sep 22, 2020
FLIR's CEO joins a growing number calling out risks with fever / screening...