13.3 Electronic Access Control Systems, Mantraps, Anti-Tailgating, and Biometric Authentication

13.3 Electronic Access Control Systems, Mantraps, Anti-Tailgating, and Biometric Authentication

The internal defense layers of a data center—encompassing Level 3 (Facility Interior), Level 4 (Computer Room / Whitespace), and Level 5 (Cabinet / Cage)—rely on sophisticated Electronic Access Control Systems (EACS) to govern, monitor, and audit human movement. While physical perimeter barriers retard vehicular and brute-force penetration, internal access controls must defend against social engineering, credential counterfeiting, credential theft, and unauthorized human tailgating.

A robust internal security architecture synthesizes high-assurance cryptographic smart cards, multi-factor biometric authentication, interlocking security vestibules (mantraps), and intelligent anti-tailgating optical sensors. At the same time, the access control system must seamlessly harmonize with statutory life safety mandates (NFPA 101 Life Safety Code), ensuring that high-security locking mechanisms never compromise immediate, unimpeded emergency egress for human occupants during a fire or life-threatening event.

---

Credential Technologies: Legacy Proximity vs. Modern Smart Cards

An access control credential is a physical or digital token that asserts an identity claim to an electronic card reader. In mission-critical data center design, selecting the credential architecture is a critical security decision.

+---------------------------------------------------------------------------------------------------------+
|                                 ACCESS CONTROL CREDENTIAL COMPARISON                                    |
+-----------------------+-------------------+--------------------+----------------------------------------+
| CREDENTIAL TECHNOLOGY | OPERATING FREQ.   | ENCRYPTION / CIPHER| VULNERABILITIES & SECURITY ASSESSMENT  |
+-----------------------+-------------------+--------------------+----------------------------------------+
| Legacy Proximity      | 125 kHz           | None               | CRITICAL VULNERABILITY. Facility code  |
| (HID Prox, EM4100)    | (Low Frequency)   | (Cleartext)        | and Card ID broadcast unencrypted.     |
|                       |                   |                    | Cloned in seconds via handheld tools.  |
+-----------------------+-------------------+--------------------+----------------------------------------+
| MIFARE Classic        | 13.56 MHz         | Proprietary        | COMPROMISED. Crypto-1 cipher reverse-  |
|                       | (High Frequency)  | (Crypto-1, 48-bit) | engineered in 2008. Keys crackable in  |
|                       |                   |                    | seconds using offline nested attacks.  |
+-----------------------+-------------------+--------------------+----------------------------------------+
| MIFARE DESFire        | 13.56 MHz         | Open Algorithms    | HIGH ASSURANCE. Hardware-accelerated   |
| EV2 / EV3             | (High Frequency)  | (AES-128 / 3DES)   | mutual 3-pass authentication; virtual  |
|                       |                   |                    | card architecture; CMAC data integrity.|
+-----------------------+-------------------+--------------------+----------------------------------------+
| HID iCLASS SE / Seos  | 13.56 MHz         | Secure Identity    | HIGH ASSURANCE. Independent of physical|
|                       | (High Frequency)  | Object (AES-128)   | media layer; supports mobile PKI digital|
|                       |                   |                    | identities via NFC/BLE smartphones.    |
+-----------------------+-------------------+--------------------+----------------------------------------+
| PKI Smart Cards       | Contact /         | Asymmetric RSA     | MAXIMUM ASSURANCE. Tamper-resistant    |
| (FIPS 201 PIV / CAC)  | Contactless       | (2048-bit) / ECC   | element on card chip; private key      |
|                       | (Dual Interface)  | (P-256)            | never exported; digital signature auth.|
+-----------------------+-------------------+--------------------+----------------------------------------+

The Inherent Flaws of 125 kHz Proximity Cards

Legacy 125 kHz proximity cards (e.g., standard HID Prox) operate without cryptographic processing. When exposed to an electromagnetic field from a reader, the passive transponder energizes and broadcasts its unencrypted facility code and card serial number in plain radio cleartext.

Using low-cost, commercially available radio frequency devices (such as a Proxmark or handheld cloner), an adversary can capture the credentials of an authorized employee standing in an elevator or coffee shop from several inches away. The captured data is instantly written onto a $2 blank card, creating an exact, untraceable clone that the data center ACS accepts as legitimate. Specifying 125 kHz proximity cards for a modern data center's secure areas is poor practice.

Reader-to-Controller Communications: Wiegand vs. OSDP

Securing the credential is futile if the physical communications link between the card reader and the field access controller is vulnerable.

1. The Legacy Wiegand Protocol: Developed in the 1980s, the Wiegand interface transmits raw card data as unencrypted electrical pulses over a three-wire interface (Data 0, Data 1, and Ground). Any physical tap placed across the Wiegand wires (easily concealed inside a wall cavity behind the reader) can log card numbers in cleartext or inject unauthorized credential bits to force the controller to energize the lock relay. Wiegand is strictly unencrypted and unmonitored (no supervision).
2. Open Supervised Device Protocol (OSDP v2.2): Developed by the Security Industry Association (SIA) and published internationally as IEC 60839-11-5, OSDP replaces Wiegand with a bi-directional, supervised RS-485 serial communications bus. Under OSDP Secure Channel Protocol (SCP), all communications between the reader and controller are encrypted using AES-128. Furthermore, OSDP continuously polls the reader; if an attacker cuts or tampers with the communication cable, the controller immediately generates a "reader offline / line tamper" alarm at the SOC.

---

Biometric Authentication Systems & Performance Metrics

Biometrics eliminates reliance on physical tokens alone by verifying unique physiological characteristics. In mission-critical data center operations, biometrics serves as the foundational secondary or tertiary factor for Level 4 whitespace access.

Biometric Modalities in Mission-Critical Facilities

• Fingerprint Recognition: Analyzes epidermal friction ridge patterns, focusing on minutiae points (ridge endings and bifurcations). While widely deployed, standard optical fingerprint scanners are vulnerable to surface contamination (dust, oils), skin moisture changes, and silicone replica spoofing unless equipped with multispectral imaging that detects subdermal vascular blood flow (liveness detection).
• Vascular Pattern Recognition (Finger Vein / Palm Vein): Transmits near-infrared light ($760\text{–}850\text{ nm}$) through the finger or palm. Deoxygenated hemoglobin in the veins absorbs near-infrared rays, casting a dark vascular shadow pattern captured by an infrared sensor. Because veins are internal to the body, vascular patterns cannot be lifted from touched surfaces or easily photographed, and capture depends on blood in the veins, giving strong built-in resistance to spoofing.
• 3D Facial Recognition: Projects thousands of invisible infrared dots (structured light or vertical-cavity surface-emitting laser, VCSEL) onto the subject's face to map three-dimensional facial contour depth in real time. Unlike legacy 2D facial recognition, 3D facial mapping resists 2D photograph and screen-replay attacks and works in darkness because it uses its own infrared illumination.
• Iris Scanning: Captures high-resolution infrared images of the complex, randomized trabecular meshwork patterns of the iris. Iris codes carry roughly 240 to 250 statistical degrees of freedom (compared with the few dozen minutiae typically matched in a fingerprint), and iris texture is largely stable through adult life. Iris recognition is among the most accurate commercial biometric modalities.

Biometric Error Rates: FRR, FAR, and CER

Every biometric algorithm operates by comparing a live biometric sample against an enrolled digital template, calculating a mathematical similarity score ($S$). If $S$ exceeds a predefined calibration threshold ($\theta$), access is granted; if $S < \theta$, access is denied.

   Error Rate (%)
        |
   High | \                                             /  False Rejection Rate (FRR)
        |  \                                           /   (Type I Error / Alpha)
        |   \                                         /    [Authorized user rejected]
        |    \                                       /
        |     \                                     /
        |      \               CER / EER           /
        |       \                  |              /
        |        \                 v             /
        |         \               ***           /
        |          \             *   *         /
        |           \           *     *       /
        |            \         *       *     /
        |             \       *         *   /
        |              \     *           * /
        | False         \   *             *
        | Acceptance     \ *             / \
        | Rate (FAR)      *             /   \
    Low | (Type II Error)              /     \
        +-----------------------------+-------+----------------------->
        Loose / Permissive       Threshold Theta*     Strict / Secure
        (Low FRR / High FAR)                          (High FRR / Low FAR)

1. False Rejection Rate (FRR / Type I Error / $\alpha$): The statistical probability that an authorized, legitimate user is incorrectly rejected by the system. A high FRR results in employee frustration, operational transit delays, and excessive help-desk escalation.
2. False Acceptance Rate (FAR / Type II Error / $\beta$): The statistical probability that an unauthorized impostor is incorrectly verified and granted access. FAR represents a critical breach of physical security.
3. Crossover Error Rate (CER / Equal Error Rate - EER): The operational sensitivity point where the False Rejection Rate exactly equals the False Acceptance Rate: $FRR(\theta^*) = FAR(\theta^*) = CER$ The lower the Crossover Error Rate, the more accurate and discriminatory the biometric system. When comparing competing biometric hardware for data center procurement, the system with the lowest CER, ideally from independent testing, is the more accurate.

+---------------------------------------------------------------------------------------------------------+
|           BIOMETRIC MODALITY PERFORMANCE MATRIX (ILLUSTRATIVE; RESULTS VARY BY PRODUCT AND TEST)        |
+-----------------------+-------------------+-------------------+--------------------+--------------------+
| BIOMETRIC MODALITY    | TYPICAL FRR       | TYPICAL FAR       | CROSSOVER ERROR    | SENSITIVITY TO     |
|                       | (TYPE I ERROR)    | (TYPE II ERROR)   | RATE (CER / EER)   | ENVIRONMENT        |
+-----------------------+-------------------+-------------------+--------------------+--------------------+
| Optical Fingerprint   | 1.0% to 3.0%      | 0.01% to 0.1%     | ~1.0%              | High (Dirt, cuts,  |
|                       | (High friction)   | (Moderate)        |                    | skin peeling)      |
+-----------------------+-------------------+-------------------+--------------------+--------------------+
| Multispectral Finger  | 0.5% to 1.0%      | 0.001% (1 in 100k)| ~0.1%              | Low (Reads sub-    |
| Print (with Liveness) |                   |                   |                    | dermal vascular)   |
+-----------------------+-------------------+-------------------+--------------------+--------------------+
| Palm / Finger Vein    | 0.1% to 0.5%      | 0.0001% (1 in 1M) | ~0.01%             | Very Low (Internal |
| Recognition           |                   |                   |                    | vascular blood)    |
+-----------------------+-------------------+-------------------+--------------------+--------------------+
| 3D Structured Light   | 0.5% to 1.5%      | 0.0001% (1 in 1M) | ~0.05%             | Low (Immune to     |
| Facial Recognition    |                   |                   |                    | ambient darkness)  |
+-----------------------+-------------------+-------------------+--------------------+--------------------+
| Iris Scanning         | 0.1% to 0.5%      | 0.00001%          | < 0.001%           | Very Low (Protected|
|                       |                   | (1 in 10M)        | (Highest accuracy) | internal organ)    |
+-----------------------+-------------------+-------------------+--------------------+--------------------+

---

Multi-Factor Authentication (MFA) at Critical Boundaries

True Multi-Factor Authentication requires presenting credentials from two or more fundamentally different authentication categories:

1. Something You Have: An encrypted physical smart card, mobile cryptographic token, or PKI credential.
2. Something You Know: A memorized PIN code or complex alphanumeric password.
3. Something You Are: An inherent biological physical characteristic verified by biometric sensors.

Exam Trap: Presenting two credentials from the same category—such as a smart card and a separate RFID key fob—is NOT multi-factor authentication; it is dual-token single-factor authentication. Similarly, entering a PIN and a password represents two instances of "something you know," not MFA.

Typical MFA Zoning by Security Level

The zoning below is common practice; the owner's security plan sets the actual requirements.

• Level 1 & Level 2 Boundaries: Single-factor authentication (smart card or automated license plate recognition + RFID) is standard for vehicular gates and exterior shell portals.
• Level 3 Buffer Zones: Single-factor smart card authentication for general interior corridors.
• Level 4 Whitespace Perimeters: Multi-Factor Authentication (MFA). Access control vestibules (mantraps) entering the computer room typically enforce at least two distinct factors (Card + Biometric or Card + PIN); the highest-security sites often use three factors (Card + PIN + Iris/Vein Biometric).
• Level 5 Cages & High-Security Racks: MFA, sometimes with dual-custody authorization (two independent authorized individuals authenticating within a short time window).

---

Security Vestibules (Mantraps) & Anti-Tailgating Architecture

A security vestibule (commonly referred to in data center engineering as a mantrap) is an access-controlled portal consisting of an enclosed architectural chamber with two or more interlocking doors. The fundamental operational principle is mutual door exclusion: Door 2 cannot be unlocked or opened until Door 1 has fully closed, latched, and secured.

+---------------------------------------------------------------------------------------------------------+
|                           TWO-DOOR INTERLOCKING MANTRAP LOGIC SEQUENCE                                  |
+---------------------------------------------------------------------------------------------------------+

    [ Exterior / Level 3 Corridor ]
                |
                v
    +-----------------------+
    |     DOOR 1 (OUTER)    | <--- Card Reader 1 (Factor 1: Card + PIN)
    +-----------------------+
                |
                v  [ Person enters vestibule; Door 1 closes and latches ]
    +-------------------------------------------------------------------+
    |                     INTERLOCKING VESTIBULE                        |
    |                                                                   |
    |   [ Overhead 3D Stereo Vision / Time-of-Flight (ToF) Sensors ]    | <--- Scans Volumetric Envelope
    |                                                                   |      Verifies EXACTLY 1 Person
    |   [ Dynamic Weight Sensing Floor Pressure Mat ]                   |
    |                                                                   |
    +-------------------------------------------------------------------+
                |  [ Single Occupancy Confirmed & Door 1 Latched ]
                v
    +-----------------------+
    |     DOOR 2 (INNER)    | <--- Biometric Reader 2 (Factor 2: Iris / Vein)
    +-----------------------+
                |
                v
    [ Interior / Level 4 Whitespace ]

Tailgating vs. Piggybacking

• Tailgating: An unauthorized individual slips through an open access-controlled door immediately behind an authorized person without the authorized person's explicit consent.
• Piggybacking: An authorized individual colludes with an unauthorized person, intentionally holding the door open to allow them to enter together on a single credential validation.

Anti-Tailgating Sensory Technologies

1. Overhead 3D Stereo-Vision Optics: Dual-lens optical sensors mounted directly above the center of the vestibule. The system captures stereoscopic images (often with active infrared illumination) and uses algorithms to analyze human head and shoulder contours. The system reliably distinguishes a single person carrying a laptop bag or backpack from two individuals standing in close contact.
2. Time-of-Flight (ToF) Infrared Cameras: Emits modulated light pulses and calculates the precise round-trip travel time of photons reflected from objects in the chamber. Creates a real-time 3D depth point cloud mapping the volume of the chamber, detecting tailgaters attempting to hide behind an authorized user.
3. Precision Dynamic Floor Scales: The vestibule floor incorporates a continuous load cell scale. When a user authenticates at Door 1, their approximate weight profile is validated against expected human tolerances ($90\text{–}300\text{ lbs}$). If the scale detects gross mass exceeding single-occupancy limits (e.g., $380\text{ lbs}$, indicating two adults), Door 2 remains locked, an audible warning instructs occupants to exit, and Door 1 unlocks to allow evacuation back to the corridor.
4. Turnstiles and Revolving Portals: High-throughput whitespace entries utilize full-height automated security revolving portals. The quartered glass wings rotate forward only after credential authorization. If an optical sensor detects two occupants inside a single revolving quadrant, the portal instantly reverses rotation, sweeping both individuals back out to the non-secure side.

Anti-Passback (APB) Logic

To prevent an authorized user from swiping their badge, entering the computer room, and then passing their badge back through a door or window to an accomplice, the ACS must enforce Anti-Passback (APB):

• Soft Anti-Passback: If a badge is swiped twice sequentially for entry without an intervening exit swipe, the user is granted access, but a priority security notification is flagged on the SOC console for investigation.
• Hard Anti-Passback: If a badge is presented for entry without a recorded exit read, the system denies access, locks the door, and generates an audible alarm. The badge is administratively locked until cleared by security personnel. Hard anti-passback requires that every door portal possesses bidirectional readers (both ingress and egress card readers).

---

Life Safety Compliance and Emergency Egress (NFPA 101)

A critical responsibility of the Data Center Design Consultant is resolving the inherent conflict between security requirements (keeping intruders out) and life safety requirements (allowing occupants to escape during fires, gas discharges, or electrical arc blast events). Adopted building and fire codes, including NFPA 101 (Life Safety Code) and the International Building and Fire Codes, take precedence over physical security preferences.

Fail-Safe vs. Fail-Secure Locking Mechanisms

+---------------------------------------------------------------------------------------------------------+
|                              FAIL-SAFE VS. FAIL-SECURE LOCKING MECHANISMS                               |
+-----------------------+-----------------------------+---------------------------------------------------+
| OPERATIONAL MODE      | BEHAVIOR UPON LOSS OF POWER | APPLICATION IN DATA CENTERS                       |
+-----------------------+-----------------------------+---------------------------------------------------+
| Fail-Safe             | UNLOCKS automatically       | Required for maglocks and other electric locks    |
| (Power-to-Lock)       | when electrical power is cut| with no mechanical egress release on egress doors |
|                       |                             | (NFPA 101 7.2.1.6); not for doors that must latch |
+-----------------------+-----------------------------+---------------------------------------------------+
| Fail-Secure           | REMAINS LOCKED              | Common on perimeter and secure doors; allowed on  |
| (Power-to-Unlock)     | when electrical power is cut| egress doors only with mechanical free egress     |
|                       |                             | (lever or panic bar); keeps fire doors latched.   |
+-----------------------+-----------------------------+---------------------------------------------------+

1. Electromagnetic Shear Locks (Mag-Locks): Mag-locks operate on the fail-safe principle. An electromagnet mounted on the door frame energizes against an armature plate on the door, generating $1,200\text{ to }1,800\text{ lbs}$ of holding force. Cutting power de-energizes the coil, releasing the lock instantly. Mag-locks are common on interior mantrap doors, and on egress doors they must meet the NFPA 101 special locking rules below.
2. Electrified Mortise Locks & Electric Strikes: Electrified mortise locks can be ordered in either fail-safe or fail-secure configurations. For exterior Level 2 doors, fail-secure electrified mortise locks are commonly specified so perimeter doors stay locked during a power failure. To comply with NFPA 101, the egress side must still open mechanically in one motion, using a lever or, where the occupancy requires it, panic hardware that retracts the latch regardless of electrical lock status. Fail-secure hardware is also the usual choice for fire-rated doors, which must stay latched during a fire.

NFPA 101 Egress Release Requirements

NFPA 101 Section 7.2.1.6 (Special Locking Arrangements) permits an electromagnetic lock on an egress door only under one of its special arrangements. The sensor-release arrangement (7.2.1.6.2) requires all of the following; a door-hardware release arrangement (7.2.1.6.4) instead uses a switch in the door hardware that directly cuts lock power:

1. Fire Alarm and Sprinkler Release: Where a fire alarm, sprinkler, or detection system is provided, its activation must unlock the doors, which stay unlocked until the fire alarm is manually reset. NFPA 72 requires the release to come from the fire alarm system. Good practice wires a supervised fire alarm relay directly into the lock power circuit, so the release does not depend on access control software, servers, or the network.
2. Manual Release Device (Egress Push Button): A manual release device on the egress side, located $40\text{–}48\text{ inches}$ above the floor and within $60\text{ inches}$ of the door, readily accessible and clearly signed "PUSH TO EXIT." Operating it must directly interrupt power to the lock, independent of the locking system electronics, and the door must stay unlocked for at least 30 seconds. This allows egress even if the ACS controller and sensors have failed.
3. Egress-Side Sensor (Request-to-Exit): A sensor on the egress side, typically an overhead passive infrared (PIR) detector, detects approaching occupants and unlocks the door in the direction of egress.
4. Loss-of-Power Release: Loss of power to the locking system must automatically unlock the doors in the direction of egress. A separate arrangement, delayed-egress electrical locking (7.2.1.6.1), may be permitted where the occupancy chapter allows it and the building has complete automatic sprinkler or fire detection protection. When an occupant pushes the release, an alarm sounds and the door unlocks after $15\text{ seconds}$ (up to $30\text{ seconds}$ where approved by the AHJ), giving security time to respond. Fire alarm or sprinkler activation, or loss of power, releases the door immediately.

---

Practical Design Scenario: Whitespace Mantrap Throughput & Transit Cycle Analysis

Scenario Parameters

A newly engineered enterprise hyperscale white space hall houses 400 server racks. During peak shift changeover, 60 technicians and engineers must pass through the security vestibule (mantrap) within a 15-minute window ($900\text{ seconds}$).

The engineering specifications for the mantrap define the following transit timing parameters:

• User approaches Door 1, scans Smart Card + PIN: $t_{auth1} = 4.0\text{ seconds}$
• Door 1 unlocked; user pulls door open, enters, door self-closes and latches: $t_{door1} = 5.0\text{ seconds}$
• Anti-tailgating 3D optical scan confirms single occupancy: $t_{scan} = 2.0\text{ seconds}$
• User presents Iris Biometric authentication at Door 2: $t_{auth2} = 3.0\text{ seconds}$
• Door 2 unlocked; user pushes door open, exits into whitespace, door self-closes and latches: $t_{door2} = 5.0\text{ seconds}$

Mathematical Throughput Sizing Calculation

1. Calculate Total Transit Time Per User ($T_{transit}$): $T_{transit} = t_{auth1} + t_{door1} + t_{scan} + t_{auth2} + t_{door2}$ $T_{transit} = 4.0\text{ s} + 5.0\text{ s} + 2.0\text{ s} + 3.0\text{ s} + 5.0\text{ s} = 19.0\text{ seconds per person}$
2. Calculate Maximum Single-Portal Throughput Capacity in 15 Minutes: $\text{Total Window Time} = 15\text{ minutes} \times 60\text{ seconds} = 900\text{ seconds}$ $\text{Maximum Persons Processed} = \frac{900\text{ seconds}}{19.0\text{ seconds/person}} = 47.37 \approx 47\text{ persons}$
3. Evaluation Against Operational Demand:
   • Peak Demand: $60\text{ persons}$
   • Portal Capacity: $47\text{ persons}$
   • Deficit: $60 - 47 = 13\text{ persons stranded}$ (creating a massive queuing bottleneck, causing technicians to arrive late to shift briefings, and tempting staff to wedge doors open or bypass security protocols).
4. Engineering Design Remediation:
   • Sizing a single mantrap for this facility fails operational criteria.
   • The DCDC consultant should specify dual parallel security vestibules (Portal A and Portal B), or deploy fast power operators that cut each door cycle from $5.0\text{ s}$ to $2.5\text{ s}$ together with faster sensing and readers (scan $1.5\text{ s}$, iris $2.0\text{ s}$): $T_{transit\_optimized} = 4.0 + 2.5 + 1.5 + 2.0 + 2.5 = 12.5\text{ seconds}$ $\text{Optimized Single-Portal Throughput} = \frac{900\text{ s}}{12.5\text{ s/person}} = 72\text{ persons per 15-minute window}$
   • With the optimized automated door operators ($12.5\text{ s}$ cycle time), a single portal can process 72 persons, comfortably accommodating the 60-person shift change with a 20% safety margin.

---

Common Exam Traps & DCDC Pitfalls

• Software-Controlled Fire Alarm Release Trap: Relying on the Access Control System server software or an IP-based network command to release fail-safe magnetic locks during a fire emergency. NFPA 101 requires fire alarm or sprinkler activation to unlock the doors, NFPA 72 requires the release to come from the fire alarm system, and good practice uses a hardwired fire alarm relay in the lock power circuit. If the ACS server crashes, freezes, or loses network connectivity, the doors must still release.
• Fail-Secure Locks Without Free Egress: Specifying a fail-secure electrified lock on an egress door whose egress-side hardware cannot open it mechanically. If a fire cuts power, the door stays locked and traps occupants. Locks without mechanical egress release (such as maglocks) must be fail-safe and meet NFPA 101 7.2.1.6; fail-secure locks are acceptable only where the egress side always opens mechanically.
• Conflating Two Factors from One Category as MFA: Believing that requiring an employee to present an RFID smart card AND an RFID key fob satisfies Multi-Factor Authentication. Both belong to "Something You Have." True MFA requires combining at least two distinct categories (e.g., Card [Have] + PIN [Know], or Card [Have] + Iris [Are]).
• Misinterpreting Crossover Error Rate (CER): Forgetting that in biometric metrics, lower is better. A candidate who selects a biometric reader with a CER of 2.0% over one with a CER of 0.01% is selecting a reader that is 200 times less accurate.
• Unencrypted Wiegand in High-Security Zones: Specifying Wiegand card readers for Level 4 whitespace access. Wiegand lines are unencrypted and subject to physical eavesdropping and injection attacks. Current good practice specifies OSDP v2.2 with AES-128 Secure Channel Protocol.