Older than the threat it faces
Card technologies still in daily use were broken years ago, and some readers only ever read a serial number anyone can copy.
Chapter 2 · Credentials
One identity, verified at every reader
The card, the phone and the key it replaces, all issued, exchanged and retired against the same record. 1 lifecycle for all of them.
Credential Management
Credential lifecycle management: card, mobile and wallet
Everyone moving to a newer badge runs into the same 4 problems, and usually postpones them. The card base is the part nobody wants to touch.
The problem
The one part nobody wants to touch
Everyone moving to a newer credential meets the same 4 problems, and usually postpones them.
A new access system exposes it
Replacing the access platform means replacing readers. The moment the readers change, every card has to change with them.
By hand it is a project of its own
Thousands of people, across sites and shifts, through a desk. Weeks of security and HR time, paid for in lost productivity.
The old badges never come back
Collection is voluntary. Part of the old card base stays live and unaccounted for, exactly what an auditor asks about.
What it does
In practice
Every credential on one person
Card, mobile or wallet, the technology it carries, when it was issued and when it stops working.
The card base, by technology
How much of the card base has moved, how much has not, and which population is still on the old credential.
Returned, or still out there
Every old badge recovered against a person, and a list of names for the ones still out there.
Both credentials at once
A dual-technology card carries the old credential and the new one together. Both keep working from day one and the migration has no cut-over weekend.
Any technology to any technology
Physical to mobile too, when you are ready. Wallet provisioning, issued against the same identity record.
Revoked in one place
The credential follows the person. When the identity closes, the credential closes with it, whatever form it takes.
Delivered
Already running
6,000badges swapped
A European financial institution
6,000 badges swapped at the machine in a few weeks.
The old badge collected, the new one printed, personalised and encoded to MIFARE DESFire EV3, without anybody at a desk.
4,000badges re-coded
A European institution
4,000 badges printed and coded to a new DESFire key while the site moved from one system to another.
Handheld scanners stayed in sync, and a badge could be checked anywhere during the change.
Named references are shared under a non-disclosure agreement.
Questions
Frequently asked questions
Can we migrate a card base without a re-badging campaign?
Yes. A dual-technology card carries both the old and the new credential. The population moves gradually while both systems keep working. People swap their badge at a self-service terminal or a desk encoder, with no queue at reception.
What happens to the old badges?
The terminal takes the old badge in, captures it and retires it against that identity with a record of the return. What is left is a list of names for the badges still out there, instead of a number nobody can pin down.
Do you support mobile and wallet credentials?
Yes, mobile credentials and wallet provisioning, issued against the same identity record that grants the access. It is 1 lifecycle, whatever people carry.
The first step
Start with 1 site and 1 population.
You judge something that runs on your own site. Your access systems and readers stay where they are. If it earns its place, we extend it site by site.
One siteOne populationYour readers stay