Axis: Use QR Codes Instead of Access Cards

By: Brian Rhodes, Published on Sep 12, 2017

Innovation in access may be hard to find, but Axis recently suggested an idea for credentials few have considered. Rather than using plastic cards, Axis suggested a different approach: Use QR Codes instead.

Furthermore, Axis explained how to implement the idea using their own equipment.

Is this a good idea?

Inside we take a deeper look, and examine using QR Codes as credentials, including its negatives and positives.

Axis *****: ** ***** ******* / ******* **** *****

*************, **** ** ********** that ******* ** *********** cards, **********, ** ****, users ****** ***** **** QR *****, * **** of ******** *******. **** QR **** ** **** to ***** ******** *********** about ***** *** *** commonly **** ** ******** for ******-***** ******** ******, product ************** *** '**** info' *****, ** ** mail ******** ********* ** track ********.

**** ****** ** ***** for ****** ***** ** a **** ********* *********** to *****, ****** ***** by '****** ***** ** purchasing, ********, ********, ************ and ********* ** ******** cards', *** ******* * 'huge ******** ****** ** the *********** *** ****** emissions'.

Axis ****** *** **** ** *****

** ** ****,**** *************** ****** **********, ***** IP ******* ****** **** a **** ******* ***, ******:

*** ** **** ******** example **** **** ********** a ** ***** ******** onboard *** ** ******* and/or ***** **** ******** in *********** **** *** AXIS ***** ******* **** Controller.

*******, *** ******** **** describes *** ***** **** and *********** **********, ********* that ** ****** ** installed *** *** ******* major *********** ****.

******* *********

******* *** ******** ********, using ** ***** ******* of *****, **********, ** PINs **** *********** ********:

** ***** **** ** ******
** **** ********* ********
****** *********** ********
*** ****** *** *** Locations
** **** ***** ******* Critical

** ******* **** ** these ****** ** ********* sections.

Hard ** ******

*** **** *********** ******* is ********** ** **** credentials ** **** ****** be ****** ** ****** are **** ********* **** other *****, * ***** Axis ******:

***** ** ***** ** credential ** **** ******** when ******* *** *** user *********** *** ********** outweigh ***** *** ********. So **** ** *** meet ******* *** **** security ************.

**** ******* ********* **** point:

**** ***** **** ** don't *** ** ***** as * *********** ** traditional ******* ************** *****, encrypted *********** ** **********. Rather, **** ***** * convenient, ********* *** ****-********* means ** ******** *********** for **** ******** *** regular *********. **** ******** of ******** ******** ******* for ** ***** ** a ********** ***** ******* hotels, ****** *********, ***** and ****** ******.

******* ** ***** *** be ****** **** ********* no **** ************* **** cameraphones, **** ****** **** are *** ******** ** mainstream ************ ** *********** cards, *** ****** ******** and ******* *********** ***** applications.

QR **** ****** ******* ********

***** **** **** ******* equipped **** ** ***, QR **** ******* *** doors *** *** ******** available.

** **** *****, *** actual ** **** ****** is * *** ****** that **** ** ******** fitted *** *** ** kiosks *** *********.

** **** ******* ******** for ****** ******* *** are *** ********* **** typical ****** *******, *** a ***** ** ******** security ************ ****** ** dedicated ******* *** ****, significantly ********* ******** ******* of *** *********** ****-******* approach.

Use **** **** ******* *** ********** **********

** ***** *** ******** point **** **** *********** ** selling (****) ******* ** QR *******. *******, ** does ******* **** ********** due ** *** **** of ***** ******* *** logistical ************** ** ******** cameras *** ********* ******* drops ** **** ***** point.

******* ********* *** ******* outside *** ****** ***** proximity ** *****, ** defined ** ********** **** **** ***, ******* ** ** camera ** * ***** it *** ** **** by *** *****, ********** those *** *** ********, may *** ** * reasonable *******.

QR **** ***** ******* *********

****** ***** ***********, ***** images ** ** ***** are *********, ********** **** cameras *** **** ** readers. **** ******* ***** density ************ *** ******* QR ***** ** "***/** (or ~*** ***)", * PPF *********** **** **** a *** * ******* of *.*' **** **** a ****.

**** ******* ********* ***** quality ************:

*** ** **** ****** be ******* ******** ** the ***** ******* *** distortions, *********** ** ********. Unlike **** *****-***** ******* readers, ***** ** ** guidance ** *** ** hold *** ** **** or ***** ** **** the **** ***** **** shows *** ** ****. But ** ***’* **** difficult **** ***** * QR **** ** *** phone *** *** *****-** at ** *******.

**** **** ******** *** PPF *** *** * problem, *** ******* ** the ** ****, ******* power ** * ********* displaying **, ** *** user *********** ** *** code ** * *****/******* raises operational ************.

Custom *********** ********

***** *****, * ****** reader ********** *** ******* or **** *** ** run ******** **** *** reader ** * **********, but **** ** *** the **** **** **** cameras-as-QR *******.

******* ********** ***** ***** ********** is * *** **** of *** ***********, **** clarified ** **** ****:

*** **** ***** ******* Door ********** *** ** integration *** ** **** readers

******, *** *** **** be **** ** ****** the **********, * ******* the **** ***** *** **** Barcode ******* ********* ** ******. **** explained:

*** ****** *** **** controller ********** ** ** application ******* ** *** camera **** ******** *** powerful *** ** *** AXIS ***** ******* **** Controller ** **** *** QR ********** **** *** network. *** **** ********* also ******* ** *** are ***** *** ******* or **** ********* *** credential **************

*******, **** ************* *********** how ****** ******* **** readers *** ** ******** connected ** * ********** in * '**** & play' ******, ***** ** Code ******* *** ******* cannot.

At **** ***** ************

******* ** ***** ***********, we *** **** ******** primarily ***** **** ** niche ************, ***** ******** is *** * *********** concern.

Visitor ********** *****

*** **** **** ******** the *********** ***** ** a **** *** ** for '*********' ****** ******* and ************** ** ********, an *********** ** ***** in *** ******* ********** ******* ******** ****.

******* **** ******** *** case ***** ******** ***** visits ** *****, *** days, *** ********* *** provisioned ****** ******** ****** (eg: ******** ** **********). Visitors *** ********* **** supervised ** ******* *********, so **** ** *** QR **** ******** ***** are **********.

*** ******* **********, *** convenience ** ******* *** inexpensively ******** ** **** paper ******* ****** ** a ******* **** ******* and ******** ******* '*******' passes. ********** ******* ** doors ** ** ********** expense, *** *** *********** would ****** ** ******* to ******** ******** ** nonsensitive *** ****** *****, creating ***** '******* ******' for ******** **********. *** added ****** ****** ********* could **** ** ********** used ** ****** ***** of ****** **** ******, and **** ****** * solid ***** ***** ** a *****.

*** ******* **********, ****** traditional ******** *** ***** surveillance *******, ********* *** two ************ ** **** describes *** ******** *** operational ******** ** ****.

Comments (27)

Phil Shanahan

09/12/17 05:01pm

We recently installed these on some speedlanes, they have a wiegand output and seem to work quite well.

QscanT QR Code reader

Brian Rhodes

IPVMU Certified | In reply to Phil Shanahan | 09/12/17 05:06pm

Outstanding info, thanks for sharing. Do you have a rough idea of price?

Undisclosed #1

In reply to Phil Shanahan | 09/12/17 08:49pm

We use those all of the time for temporary employees / short term badges. Price is around $1200 MSRP (I believe) for this model. We see the vendor price but not MSRP so I may be off as I am backing into the number.

Adam Messina

ThinkReps | 09/12/17 08:55pm

FST Biometrics offers an option to issue a QR code for guest access. The code is displayed to, and read by, a camera on the system to grant access.

John Honovich

IPVM | In reply to Adam Messina | 09/12/17 09:02pm

FST Biometrics

If FST Biometrics are so great, why don't they just use face recognition with a picture of the person?

Adam Messina

ThinkReps | In reply to John Honovich | 09/13/17 12:04am

FST requires enrollment. So a guest would have to be enrolled in the system, for which the process is no different than your typical visitor system. The use of QR codes is a secondary access measure which does not require your guest to stop and be enrolled. Also, FST is designed to specifically not allow an image to be used as a fraud detection measure. The point of my post was not to promote FST's QR code capability but to point out that other manufacturers have found value in the use of QR for access.

John Honovich

IPVM | In reply to Adam Messina | 09/13/17 12:07am

to point out that other manufacturers have found value in the use of QR for access.

What value has FST found? In your initial comment, you explain that you supported the feature. I am just curious how many deployments and how valuable did those deployments find QR codes?

Adam Messina

ThinkReps | In reply to John Honovich | 09/13/17 05:06pm

I discuss the QR Code guest option in most presentations. I am unsure how many end users had this as a high priority, but I do know that trying to streamline the visitor management process is a concern of a majority of clients. For FST it works quite well in a few of our residential complexes in NYC. It is not a feature we lead with obviously as facial biometrics is the lead, but it often comes up. Within the QR code you can also define the time period and date the code will work, so if you grant a guest access from 7p to 9p on 9/13, the code will not work before or after that time. I do not know enough about the Axis solution, and again my initial post was to say that it is possible that QR codes could be finding a useful home. When a company as big as Axis gets behind a technology there is usually some merit. More deployments will find more benefits and more issues. Time will determine if it is viable solution, but I applaud any companies that are trying new methods to improve the systems we all either sell or use.

Campbell Chang

09/13/17 05:41am

If you're going down the path of credentials issued to your phone then surely HIDs Mobile Access is a much more efficient way of going about it?

Brian Rhodes

IPVMU Certified | In reply to Campbell Chang | 09/13/17 02:38pm

If 'efficient' qualifies the ease of provisioning token or codes to mobile users, then I would agree with that.

However, from a cost point of view, the operational cost of creating and sending QR Codes is free - a large number of no cost websites or apps exist - while HID's Mobile Access portal costs more than $5 per credential to use.

Undisclosed #2

09/13/17 03:45pm

Not very innovative, KEYKING is offering it for more than 2 years worldwide. Due to very low security, it can be copied and faked very easily, it is in use usually in it's parking and speedgate POS solutions and not access control.

Axis, as a CCTV manufacturer, see everything via the camera lens rather than access control security.

Alberto Alonso

09/13/17 04:58pm

Good to see that the discussion is open about the use of QR codes for access control. Of course not new nor an invention of Axis of course but we introduced this more than one year ago as an added value for our camera portfolio and especially for the video doorstations.

The benefit of using QR codes is about the ease of credential distribution to an ocasional visitor. Of course we know about the limitations in security of a QR code and how easy it can be to replicate/copy. However, if the code is sent to a personal smartphone, then you rely on the phone owner and his mobile security to prevent the fraud. If you think of that, then you'll realize that it is not as vulnerable as innitially expected. Anyway the solution is intended for temporary credential in low security access, as it has been pointed out.

As for the integration or usability, of course it is an Axis solution and is developed to increase Axis camera sales as well as to add another feature to our access control solutions. However there are up to thre ways to use the functionality delivered by the camera embedded app. It has been mentioned the integration with the Axis Entry Manager software included in the Axis A1001 controller. For that, the communication is of course an IP network communication, by the way more standard and flexible than Wiegand or OSDP and at least can be as secure as the last one. That includes wireless connectivity or WAN capabilities.

The second option is to deliver HTTP communication with a third party server that can be local or cloud based. This allows a flexible way to integrate with other access control systems and credential management, of course not as easy as plug&play.

The third one is just stand alone in the camera (most likely the video doorstation) which is able to handle a list of QR codes with valid time period (expiration date). Then no need for integration or communication with any third party, just an added feature for the Axis video doorstation (for free).

Regarding the image quality requirements, yes, it is not as performant as a QR scanner, but we do not think of 200 people in a short time accessing the doorway, like it could be in a plane boarding gate. Basically it requires a capture code of around 40x40 pixels and we use it with the doorstations which have 1MP or 2MP cameras. If you don`t get it read at first, just move it in front of the camera until it opens the door, 10 to 30 cms in front of the doorstation is ok and it works fine. I suggest you to try it, if you have an Axis doorstation..

Tim Pickles

Mitie Fire & Security Systems
09/19/17 08:59am

I've read the article and every comment and I feel like I must be a 2 year old for not getting this. What is the point of this? Isn't it about as secure as an elastic band on your front door? So, you take a photo of any-ones QR code (ID badge, card T shirt!! etc), and show it to your reader - you're in??

I looked at something similar for a museum that wanted visitors to print out their own QR code at home and use it to gain admittance. We looked at Telepen and the IBC kit - which all ticked the box for convenience.

I'm sure it has it's uses - but security sure as hell isn't one of them!

To liken it to the CCTV debate - it would be the same as printing the username and password in plain English on an id card.

If you want security and convenience - facial recognition would be the way to go.

Alberto Alonso

In reply to Tim Pickles | 09/19/17 07:08pm

I understand the concerns about the security level of using a QR code that can be easily copied just taking a photo. However, the reality is not that bad. Actually nobody is printing out a QR code (if you use that argument you are surely much older than 2 years). The fact is that QR codes are sent to personal mobile devices, those so personal that nobody is moviong along without them. So to get the QR you must have the permission or collaboration of the device's owner. If you have that collaboration you also can copy a proxcard or magstripe. Yes, with some more technology but not so difficult. Rememeber as well that to get the access granted, you must show the QR code to a camera that can record also who is presenting that code. So you can track unauthorized use later.

On the other hand the use of the codes is intended for temporary access to non critical areas, those areas where the organization may have low risk and / or additional security / control staff. However it brings a big advantage since the credential can be sent out to the person at any moment prior to the accces and without his presence at a desk or attended point. Whererver you have a door intercom or video door station you always need staff to attend calls from visitors. If you can skip already authorized visitors the workload for the staff will be dramatically reduced. We've seen this being used like that in some large customers with providers and outsourced maintenance teams.

Chris Hammond

09/22/17 04:15pm

Traditional bar codes have been around for a while in the access control market with many of the same pros and cons. Is this really just the same thing with the modern QR code? My understanding of the benefit of QR codes is they can hold more data than just a number. For temporary access control solutions like visitors, do you need more than a number to unlock a door?

Brian Rhodes

IPVMU Certified | In reply to Chris Hammond | 09/22/17 04:24pm

For temporary access control solutions like visitors, do you need more than a number to unlock a door?

Good question/point. I would answer 'no' to your question, too.

The size and 'error correction' within the code (redundant pixels) influence max capacity. For a QR Code about 200 X 200 pixels:

QR Code = bucket that hold 30 KB worth of data

Visitor Access Credential = about 2 KB worth of data

Undisclosed Integrator #3

12/17/17 11:56am

Hello, interesting article and clever comments. Where can I download this Barcode and QR reader ACAP? I’d not find it in Axis web page,,,

Brian Rhodes

IPVMU Certified | 12/17/17 08:57pm

I believe it requires the camera have firmware v5.8 and it is listed in the Axis partner portal. Are you a registered partner able to login to: https://www.axis.com/us/en/my-axis/login

Alberto Alonso

12/18/17 10:48am

Hi, Brian is totally right, it works from firmware version 5.80

There are actually up to four apps (ACAP applications):

a) Barcode Reader - Just to read the barcodes/QR codes

b) Barcode Authenticator - To integrate QR credentials (Read by Barcode Reader) with Axis A1001 door controller

c) Barcode Easy Access - To make it work in standalone mode inside an Axis Door Station

d) Barcode Reader Webservice- to send credentials to a web service in LAN or WAN. A way to integrate with third party systems.

If you can't find what you need in the Axis Partner's Portal, get in contact with your Axis representative.

Undisclosed Manufacturer #4

10/29/19 06:17pm

There is always the theoretical to carefully consider... but it seems to me if real-world security and usability of QR codes was so bad, they wouldn't be allowed for use on airplane boarding passes millions of times a day. For most people, the security access level of their home or office doesn't hold a candle to what it takes just to get them in a seat on a public airplane...

John Honovich

IPVM | In reply to Undisclosed Manufacturer #4 | 10/29/19 06:21pm

they wouldn't be allowed for use on airplane boarding passes millions of times a day

Interesting point. I am not sure but in the airport use case, every person has already been personally screened. The only risk is someone going on the wrong flight not that the person has bypassed security generally, yes/no?

Brian Rhodes

IPVMU Certified | In reply to Undisclosed Manufacturer #4 | 10/29/19 06:37pm

With airplane boarding passes, QR Codes are a '1 time only' credential and the risk of duplication/misuse is quite limited due to time.

However, with general building access, credentials can be issued for many years. Not only does this increase the time/opportunity for duplication, but it also requires system maintenance and increasing overhead cost to issue new codes, invalidate old ones, update user records, and so on.

John Honovich

IPVM | 12/13/19 12:13pm

Update: Axis has made QR Codes for Access its 'topic of the month' for December 2019:

That cites a November 2019 Axis blog post promoting this - QR codes for smart, cost-effective access control - Secure Insights

Brian Rhodes

IPVMU Certified | In reply to John Honovich | 12/13/19 04:15pm

Cost-effective? Maybe, but probably not. Unless if you are using Axis access control and have Axis cameras at the close distances needed to read the codes at openings.

Secure? No. Anyone who takes a picture of the code can mimic whomever the code was initially issued.

Derek Ward

IPVM | In reply to Brian Rhodes | 12/13/19 04:31pm

Secure? No. Anyone who takes a picture of the code can mimic whomever the code was initially issued.

That right there is the nail in the coffin for many. It seems easy to abuse, mimic, and I can imagine the inconvenience some (if not many) end-users of the system would have.

When I was an integrator, people would bitch about fumbling around for an access card in their wallet/purse. I don't think many would take too well to having to whip out their phone in the rain or having to put a phone call on hold to open a door.

Michael Miller

In reply to Brian Rhodes | 12/13/19 04:55pm

I could see this working for situations where you want to give a guest access without having to send them a card/fob or setup a temp code.

Phil Shanahan

In reply to Michael Miller | 12/13/19 05:04pm

I agree, short term general visitor access is an example that springs to mind. Its clearly not for use in place of a proper credential for higher security areas.

Read this IPVM report for free.

This article is part of IPVM's 6,538 reports, 881 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.