Walk In, You've Been Recognized: The Evolution of Identification Technologies in Modern Access Control Systems
PERCo has released a new line of readers supporting Bluetooth Low Energy (BLE), accompanying mobile applications, and a joint facial identification solution developed with the CRТ group. These additions to the PERCo-Web access control platform offer a timely occasion to review how identification technologies in physical access control systems (СКУД) have evolved over recent years.
Access control systems have always followed the same core principle: a person possesses an identifier, presents it, and the system decides whether to grant entry. Earlier, this identifier was a paper pass checked by a guard who could also perform verification by comparing the visitor’s face with a photograph. Modern systems distribute this work across readers, controllers, and actuators while preserving the same logical sequence.
Proximity and MIFARE Cards as the Enduring Foundation
The first truly mass-market contactless cards operated at 125 kHz (proximity cards). Their simplicity and low cost turned access control from a specialized solution into a mainstream product used in offices, business centers, and educational institutions. The next generation, MIFARE smart cards, introduced protected memory and cryptographic authentication mechanisms originally developed for public transport. Today, cards are divided into two classes: those carrying only a factory identifier and those with cryptographically protected memory. Multi-format readers allow organizations to migrate gradually from legacy cards to protected ones without replacing the entire infrastructure at once.
QR Codes: Convenience for Temporary Access
QR codes gained popularity with the spread of smartphones because the phone’s camera and screen can serve as both reader and transmitter. They excel at issuing temporary passes for visitors, contractors, or parking lots without requiring physical cards or installed applications. Their main limitation is easy duplication, making them unsuitable for scenarios demanding strict identification.
NFC and BLE: Expanding Contactless Capabilities
NFC works well with existing MIFARE infrastructure, allowing NFC-enabled phones and bank cards to function as identifiers. However, platform restrictions on iOS and uneven NFC hardware support on low-cost Android devices have limited its universal adoption. BLE overcomes many of these constraints. It operates over several meters, supports “hands-free” passage, and lets installers adjust detection range via signal threshold settings. BLE also enables wireless configuration, firmware updates, and diagnostics of readers without physical connections.
Biometrics and Regulatory Transformation
Biometric methods—fingerprints, palm vein patterns, and face—offer the advantage that credentials cannot be transferred. Facial recognition, however, now operates under strict Russian regulation. Federal Law 572-FZ requires that facial biometric processing use either the state Unified Biometric System (EBS) or accredited commercial biometric systems (KBS). These platforms perform liveness detection and authentication before returning a standard digital identifier to the access controller. As a result, facial biometrics has shifted from a convenience feature to a regulated “technology of trust” primarily justified by compliance needs, such as construction site access in Moscow or critical infrastructure protection. Alternative identification methods must remain available for individuals who have not consented to biometric processing.
The overarching conclusion is that the oldest and simplest technology—identification by access card—continues to serve as the reliable foundation of most systems, while newer methods occupy specialized roles shaped by security, usability, and regulatory demands.
Related articles
Costly Mistakes: How Russian Businesses Risk Millions in Fines for Personal Data Violations
A year after stricter Russian personal data protection fines took effect, many entrepreneurs continue to commit violations that could trigger multimillion-ruble penalties from Roskomnadzor. The article details ten common breaches, including the prohibited use of Google Forms for data collection, missing cookie banners, absent or invalid consent forms under forms, and failure to obtain separate consents for publishing reviews. Additional violations cover missing privacy policies, outdated notifications to Roskomnadzor, improper transfer of employee data to third parties without written consent, lack of data processing agreements, and absence of records for paper-based data storage locations. Each violation is explained with direct references to the Law on Personal Data, the Code of Administrative Offenses, and specific government orders, along with exact fine ranges for citizens, individual entrepreneurs, and legal entities. Practical remediation steps are provided, such as replacing foreign services with Yandex Forms, drafting compliant consent texts per Article 9, and submitting updated notifications under Order No. 180. The guidance emphasizes conducting a full site audit and implementing all required documents to avoid penalties throughout 2026.
Rethinking SSO: Centralized User Data Provision and Authorization Processing in Corporate Systems
The article examines Single Sign-On systems not merely as authentication gateways but as architectural hubs for delivering user attributes and executing additional authorization logic. It highlights how SSO can aggregate data from sources like Active Directory, HR systems, and IDM platforms, then deliver it via OIDC claims to downstream applications. The discussion covers the shift from fragmented integrations across dozens of apps to a single trusted enforcement point using standards such as aggregated and distributed claims. It also explores the authorization pipeline where SSO acts as a Policy Enforcement Point querying external Policy Decision Points via the AuthZEN Authorization API 1.0. Practical examples include electronic business cards, role assignment, access routing, and mandatory MFA checks before token issuance. The piece stresses maintaining data ownership with source systems while establishing SSO as the single point of trust for applications.
Bitrix24 Releases Fully On-Premise BI Constructor for Regulated Enterprises
Bitrix24 has introduced a new delivery model for its BI Constructor that allows complete deployment inside a customer's own infrastructure. The update eliminates any requirement for external servers, cloud APIs, or internet connectivity, ensuring that all corporate data remains within the organization's closed perimeter. Previously, even the boxed version of the platform needed access to external infrastructure for updates and auxiliary services, creating conflicts with internal security policies and regulatory demands in highly regulated sectors. The new on-premise variant performs all data processing and storage exclusively on customer servers, giving organizations full control over access rights, backups, updates, and integration with internal protection tools. The solution is compatible with the boxed edition of Bitrix24 running on PostgreSQL and does not connect to external CDNs or cloud services. Bitrix24 expects strong interest from large enterprises and organizations handling restricted-access data that must stay inside the corporate network. Pilot implementations have already been completed, with broader customer pilots planned in the coming months.
Russia's Data Leak Penalties: 2.6 Million Rubles in Fines Despite 1.58 Billion Records Exposed in 2025
Russia introduced turnover-based fines for personal data leaks through Federal Law 420-FZ in late 2024, fundamentally altering the economics of information security investments. Over the first 18 months, Roskomnadzor opened 52 administrative investigations and issued 40 protocols totaling just 2.6 million rubles in penalties, with zero turnover fines applied. This occurred against a backdrop of 1.58 billion compromised records in 2025 alone. Public data leaks dropped fourfold in the first half of 2026, yet trading activity on underground forums rose nearly 60 percent as operators shifted to private sales. The law now ties penalties directly to the number of affected individuals and adds a turnover component for repeat violations under Article 13.11 of the Code of Administrative Offenses. Analysts note that the mere threat of larger fines has prompted companies to reassess data retention policies and risk models even without actual enforcement precedents.