Transparent mode badge reader: how it secures your access control

In an access control system, the link most exposed to physical and electronic attacks is often the reader installed outside. When an attacker removes a poorly protected reader, they can sometimes reach the local network or intercept identification data. To eliminate this vulnerability, the transparent mode architecture is now establishing itself as the high-security standard.

What is a transparent mode reader?

A transparent mode reader is an access control device that does not process, decrypt or store any identification data. It acts as a simple passive relay (pass-through): it captures the RFID signal from the badge and forwards the encrypted data streams directly to the access control controller, which alone holds the encryption keys and decides whether to open the door.

This article explains how transparent mode works compared with storing keys locally (PRESET / CUSTOM modes), its role in meeting ANSSI and NIS2 requirements, and how access control solutions address these challenges.

The access control triad: how does a system work?

To understand the impact of transparent mode on security, it helps to go back to the fundamentals of a physical access control architecture. It relies on three inseparable components:

1. The secure badge: carried by the user, it contains an RFID chip and an antenna. It holds the credentials required to grant or deny access.
2. The badge reader: installed next to the access point (door, barrier, turnstile), it emits an electromagnetic field to power the badge chip, read its data and send the identifier to the system.
3. The controller: this is the brain of the system. Located in a closed, secure area (technical room or network cabinet), the controller checks the access rights linked to the identifier and drives the locking or unlocking of the door.

To assess the security level of a system, two layers need to be distinguished:

• Badge ↔ reader dialogue: either a simple serial number read (CSN mode, not secure), or a secure mode with mutual authentication using an encryption key (preset (PRESET) or custom (CUSTOM) modes).
• Location of the encryption keys: in secure mode, the keys can be stored either locally in the reader’s secure component (Secure Element), or fully centralised in the controller; this is what is known as transparent mode.

Keys stored in the reader vs transparent mode: technical comparison

To make the right choice when deploying access control, it is worth comparing the two secure mode architectures (PRESET & CUSTOM): storing keys locally in the reader versus centralising them in transparent mode.

Keys stored in the reader in PRESET / CUSTOM mode

In this traditional secure set-up, the reader and the badge authenticate each other using encryption keys stored locally in the reader’s secure component (Secure Element).

• How it works: the reader decrypts the credentials received from the badge before forwarding them to the controller.
• Limitations: although far more secure than CSN (Card Serial Number) mode, which simply reads the serial number in clear text without any security key, this mode keeps sensitive keys in a physical device installed in an uncontrolled area (e.g. street, reception hall). If the reader is ripped off the wall or subjected to an advanced physical attack, the keys may be exposed.

Transparent mode: keys moved to the controller

In transparent mode, the reader contains no encryption keys at all. It captures the encrypted data sent by the badge and forwards it to the controller through encrypted communication frames.

• How it works: the controller, which knows the encryption key used by the secure badge’s tag (e.g. MIFARE DESFire chip), decodes the frames sent by the reader and retrieves the information needed for access control.
• Benefits: if an attacker removes or vandalises the reader, they will find no encryption key or sensitive data in the reader hardware.

Keys in the reader (PRESET / CUSTOM) vs Transparent mode

Secure communication protocols (SSCP and OSDP)

Securing the dialogue between the badge and the reader is no longer enough: the wired link between the reader and the controller must also be fully protected. Historically, the Wiegand protocol was the most widespread. However, it is a one-way, unencrypted protocol that is particularly vulnerable to man-in-the-middle attacks (MITM: eavesdropping or credential replay).

To ensure end-to-end security, the transparent mode reader relies on a modern, encrypted communication protocol.

SSCP protocol (Smart & Secure Communication Protocol)

Adopted by leading players in public and private security, the SSCP protocol establishes a two-way, highly secure communication channel between the reader and the controller (access control panel).

• It guarantees the integrity of exchanges through symmetric encryption (AES).
• It enables centralised key management and allows readers to be updated remotely without any site visit.

OSDP protocol (Open Supervised Device Protocol)

An international standard maintained by the SIA (Security Industry Association), OSDP v2 (with the Secure Channel specification) offers an open alternative, also based on AES-128 encryption. It is gradually replacing Wiegand and adds continuous monitoring of the reader’s status.

Thanks to indexed keys and compartmentalised distribution, the access control system ensures that each session between the controller and the badge via the reader is unique, dynamic and protected against any replay attempt.

Security and ANSSI / NIS2 compliance

The French National Cybersecurity Agency (ANSSI) issues strict recommendations on physical access control architectures.

Alignment with ANSSI recommendations

ANSSI recommends a clear separation between the signal capture function (handled by the reader) and the decision/decryption function (performed by the controller).

• By prohibiting any encryption key in equipment installed in uncontrolled areas (e.g. street, reception hall), transparent mode fully complies with this isolation principle.
• For CSPN certification (First-Level Security Certification), the assessment covers the entire chain: from the badge to the controller, including the SSCP or OSDP protocols. Transparent mode makes it easier to maintain the security of this chain over time.

Impact of the European NIS2 directive

The NIS2 directive significantly extends cybersecurity obligations to thousands of private and public organisations across Europe. It requires a comprehensive approach to the cyber value chain. As physical access control is an integral part of an organisation’s attack surface, choosing a transparent mo

Use cases and the LiNEGUARD solution

Which environments is it suited to?

The transparent mode architecture is particularly recommended for:

• Critical infrastructure, industrial sites and the defence sector,
• Office buildings holding sensitive data (data centres, head offices),
• Public buildings, hospitals and local authorities,
• All readers installed outdoors or in isolated areas exposed to vandalism.

The LiNEGUARD answer for stronger access control

LiNEGUARD badge readers integrate seamlessly into existing access control architectures. By adopting transparent mode, the readers deliver an optimal level of security while simplifying day-to-day management:

1. Universal integration: LiNEGUARD readers connect easily to the main controllers on the market that support the SSCP or OSDP protocols.
2. Physical hardware resistance: beyond cryptography, the physical components of access control (readers, badges, controllers) are designed to withstand mechanical attacks and harsh weather (IP65 / IK10 ratings).

Selection criteria for transparent mode readers

Choosing transparent mode is a major step forward in protecting infrastructure. Moving the intelligence and the storage of keys to the controller, located in a physically secure area, ensures that the risk of compromise linked to the misuse of a badge reader is eliminated.

FAQ