What Is IC Card Access Control
IC card access control refers to identification systems that use integrated circuit chips as information carriers, completing identity verification through radio frequency communication between card readers and cards. Unlike low-frequency ID cards that store only readable serial numbers, IC cards can store data internally and perform cryptographic operations, offering greater security scalability. Mainstream product lines include Hikvision access control readers (supporting multiple card protocols) and Dahua access control all-in-one units (compatible with Wiegand and RS485 protocols), both supporting IC cards and extended applications such as ID cards and residence permits.
How High Are the Replication Risks of IC Card Access Control
Replication Principles and Attack Vectors
IC card replication fundamentally involves "eavesdropping" and "replaying" communication data between the card and reader. Attackers use RFID read-write devices (such as Proxmark3, ACR122U, and other common equipment) to read card data without the legitimate cardholder's knowledge, then write the data to blank cards or phone NFC tags to achieve "cloning."
Replication difficulty varies significantly based on card encryption levels, showing clear stratification:
| Card Type | Encryption Mechanism | Replication Difficulty | Typical Scenario Risk |
|---|---|---|---|
| Low-frequency ID card (125kHz) | No encryption, serial number only | Extremely low; replicable via smartphone app | Legacy access control, parking lots |
| MIFARE Classic (M1) | Proprietary encryption, already cracked | Low; requires specialized equipment, approx. 15–30 minutes | Common in projects before 2015 |
| MIFARE Plus | AES encryption, backward compatible with M1 | Medium; requires key acquisition | Transitional solution |
| CPU card (Java Card) | Complete key system, computation inside card | High; brute-force attack not feasible | Finance, recommended for access control upgrades |
Criteria for Assessing Risk Levels
Procurement or operations staff can quickly evaluate the replication risk of existing access control systems by following these steps:
- Confirm card frequency: 13.56MHz indicates high-frequency IC cards; 125kHz indicates low-frequency ID cards, with the latter carrying higher risk.
- Identify card model: M1 cards typically display S50 or Fudan FM11RF08 on the surface; CPU cards have longer model markings without obvious "M1" designation.
- Test replication feasibility: Use smartphone NFC functionality (such as TagInfo or MIFARE Classic Tool) to attempt reading. If sector data can be read, encryption is insufficient.
- Check reader firmware: Readers supporting CPU cards or AES authentication can mandate higher security level communication.
As a case example from a Chinese-invested photovoltaic factory in Southeast Asia, the initial deployment used M1 card access control. After two years of operation, two incidents involving replicated cards gaining entry occurred. The system was subsequently upgraded to CPU card access control with reader firmware enforcing two-way authentication, eliminating replication attacks.
Differences Between Encrypted Cards
Limitations of M1 Cards (S50/FM11RF08)
M1 cards were introduced by NXP in 1994, and their CRYPTO1 encryption algorithm was publicly broken in 2007. Attackers can exploit timing gaps between reader and card communication to extract keys through side-channel analysis, or directly attempt sector access using leaked default keys (FFFFFFFFFFFF). The problem with M1 cards is not that they "work"—it is that they are "known to be insecure." Attack tools are open-source, and replication costs are extremely low.
Security Advantages of CPU Cards
CPU cards integrate independent microprocessors internally, with data encryption and identity verification completed within the card chip, independent of the reader's security level. Even if attackers intercept communication data, they cannot reverse-engineer the key, because each authentication can employ random number challenge-response mechanisms—identical cards produce different ciphertext for each communication session. Mainstream security manufacturers' access control readers (such as Hikvision DS-K1T804 series and Dahua access control reader series) already support CPU card authentication, with some models also supporting national encryption algorithms (SM1/SM4), meeting compliance requirements in China and certain Southeast Asian countries.
Card Selection Decision Matrix
| Assessment Dimension | M1 Card | CPU Card |
|---|---|---|
| Key storage location | Card sectors; readable externally | Chip secure zone; no external access |
| Authentication method | Reader one-way verification | Two-way challenge-response |
| Replication feasibility | Achievable with low-cost equipment | Requires chip-level attack |
| Applicable scenarios | Low-value areas, transitional period | Factory gates, warehouses, server rooms |
| Device cost increment | Baseline | Reader approx. 15–25% higher (subject to actual quotation) |
Upgrade Paths and Selection Recommendations
Option 1: Upgrade to CPU Card Access Control
Applicable scenarios: Existing access control system readers support firmware upgrades, or the access control platform supports CPU card protocols.
Steps:
- Inventory existing reader models: Confirm whether they support CPU cards (Hikvision readers require model suffix verification; some support "encrypted card" mode).
- Replace with CPU cards: Procure blank CPU cards from card suppliers (such as Hikvision or Dahua system suppliers), and issue cards according to the access control system authorization process.
- Update access control controller firmware: Ensure the controller supports CPU card two-way authentication protocol.
- Verify security level: Test with replication equipment to confirm cloned cards cannot pass verification.
This approach offers relatively controllable upgrade costs without changing user habits, though proper procedures for old card recovery and permission cleanup must be followed.
Option 2: Upgrade to Mobile NFC Virtual Cards
Applicable scenarios: High smartphone penetration among employees, and the access control system supports mobile virtual cards (such as through access control apps or NFC-SIM card solutions).
Steps:
- Confirm mobile NFC compatibility: iPhones (iPhone 7 and later) and mainstream Android devices support NFC.
- Deploy virtual card issuance platform: Some access control manufacturers (such as Hikvision) offer "mobile access control" functionality, allowing employees to apply for virtual cards through apps, with data encrypted and delivered to the phone's secure chip (SE or HCE).
- Retain physical cards as backup: Physical cards remain necessary for situations like phone power loss or malfunction.
Mobile virtual cards offer the advantage of "card travels with person," reducing loss risk. Virtual card data stored in the phone's secure chip has replication difficulty comparable to CPU cards.
Option 3: Introduce Biometric Multi-Factor Authentication
Applicable scenarios: High-security areas (warehouse core zones, hazardous chemical areas, server rooms) where card-only authentication is insufficient.
Steps:
- Identify high-value areas: Define biometric access control coverage based on asset protection levels.
- Select access control all-in-one units: Manufacturers such as Hikvision, Dahua, and Uniview offer access control all-in-one units supporting card + face/fingerprint (such as Hikvision DS-K1T671 series), configurable in "card + face" two-factor mode.
- Configure permission policies: High-security areas require simultaneous passage of card verification and biometric identification; single-factor failure prevents access.
Multi-factor authentication reduces the payoff from replication card attacks to zero, serving as the ultimate countermeasure against insider leaks or external intrusion.
Option 4: Zone-Based Tiered Management
Regardless of which card solution is adopted, zone-based tiered management is recommended according to area value:
- Low-risk zones (offices, canteens): M1 cards or mobile virtual cards are acceptable.
- Medium-risk zones (production lines, warehouses): Mandatory CPU cards or encrypted IC cards.
- High-risk zones (hazardous chemicals, server rooms, data centers): CPU cards + biometric multi-factor authentication.
This tiered strategy prioritizes core asset protection within limited budgets.
Southeast Asia Localization Considerations
Frequency and Protocol Compliance
Southeast Asian countries impose no special restrictions on 13.56MHz RF devices, though some countries (such as Thailand and Malaysia) have requirements for local storage of access control data. Selecting access control platforms supporting local deployment is recommended to avoid cross-border data compliance risks. Global SecurityExport provides Hikvision and Dahua model references for Southeast Asian compliance versions.
Local Suppliers and Response Speed
Southeast Asian local integrators can provide on-site surveys and installation commissioning, though card procurement through official manufacturer channels is advised to ensure encryption chip authenticity. Global SecurityExport provides China-Thailand dual-jurisdiction localized operations support, assisting campus clients through full-process delivery from solution design to operations response.
Cost Reference
CPU card access control upgrade costs per point (including reader replacement and card issuance authorization) typically exceed M1 card solutions, with the specific differential varying by brand, model, and procurement volume. Contact Global SecurityExport for Hikvision and Dahua official quotations and Southeast Asian project case references.
FAQ
Q1: Can M1 cards continue to be used?
A1: M1 cards themselves remain functional, but their security level is widely recognized as insufficient. For access control areas involving core factory workshops, warehouses, server rooms, and other asset protection zones, upgrading to CPU cards during the next card replacement cycle is recommended. For office areas with complete perimeter security measures, temporary retention with enhanced controls at other access points is acceptable.
Q2: How long does IC card replication take, and what are the costs?
A2: Using open-source tools (such as Proxmark3 with a computer), replicating one M1 card takes approximately 15–30 minutes, with equipment costs around RMB 200–500 (subject to actual market quotations). Due to their strong encryption, CPU card replication requires chip-level attacks, with costs and difficulty not comparable. Low attack barriers represent the greatest security vulnerability of M1 cards.
Q3: Can mobile NFC replicate IC cards?
A3: Mobile NFC can read data from some unencrypted or weakly encrypted IC cards, but cannot directly replicate the security authentication process of CPU cards. If the access control system uses standard CPU card two-way authentication, data read by mobile apps cannot be used for cloning. Using official virtual card channels provided by access control manufacturers rather than third-party replication tools is recommended.
Q4: Does upgrading to CPU cards require replacing the entire access control system?
A4: Not necessarily. If existing access control controllers and readers support CPU card protocols (verify product manuals or consult manufacturers), only cards need replacement and firmware updated. If reader hardware does not support CPU cards, reader replacement is necessary. Controllers typically can continue use, requiring only re-authorization of new card types on the platform side.
Q5: Is biometric access control more secure than IC cards?
A5: Biometrics solves the problem of "lost or stolen cards," but cannot solve risks from "coerced legitimate cardholders" or "insiders actively cooperating." Industry-recommended practice is using biometrics as a second verification factor combined with IC cards for multi-factor authentication, achieving balance between security and convenience.