Best Access Control Systems

Access control systems are a security feature or a technique that regulates or controls the communication between users and systems. Access Control Systems restricts the entry of unauthorized individuals into restricted areas to protect people and assets. Access control systems are physical and logical. Physical access controls regulate access to locations or assets, such as campuses, buildings, rooms, and physical IT assets. Logical access uses software solutions and management systems to regulate connections to computer networks, system files, and data.

Top 10 Access Control Systems Companies

1. Assa Abloy
2. Johnson Controls
3. Dormakaba Holding
4. Honeywell Security
5. Allegion
6. HID-Global
7. IDEMIA
8. Safran Group
9. NEC Corporation
10. Identiv

Assa Abloy offers a system that enables administrators to manage access control to protect areas during physical, logical, electronic, and other spaces. The solution is ideal for small and midsized business. The company is one of the leading providers of these solutions… Read more

Johnson Controls provides high performing access control solutions. Its solutions provides features like electronic access control, physical access control, managed access control, hosted access control, and Biometrics access control… Read more

Dormakaba Access offers broad solutions. Range is door hardware, entrance systems, electronic access & data, interior glass system, safe locks, lodging systems, multihousing solutions and other wireless access control solutions… Read more

Honeywell Commercial Security’s access control security integrates with the enhanced security technologies with trending networking capabilities. The solution is designed for all sizes of businesses. This solution delivers sophisticated security solutions to users… Read more

Allegion offers commercial safety and security solutions. Its product range comprises commercial locks, door closer and exit devices along with other access control and workforce productivity systems. Its access control solution comes with reader module and real time integration with all the third party solutions… Read more

HID Global offers contactless card readers for trending access control solutions. The company offers open architecture, IP-enabled platform to its users which helps them in deployment of the solution… Read more

IDEMIA offers secure access control to a variety of premises. It delivers frictionless access across all the premises. The vendor also provides visionpass that enables ultimate facial recognition access control. The solution can also be centralized at a single place with user database and biometric terminal management… Read more

Safran Group offers identity and security management system. The company recently launched an innovative access control solution that secures and controls access of valuable properties. By providing most advanced access control solution, Safran has become one of the leading player in this market… Read more

NEC Corporation is one of the leading players in proving biometric access control solutions. The company provides security solutions for businesses that can be customized and provides enhanced multi-biometrics solutions. Its access control uses facial recognition and provides added security for opening and closing doors… Read more

Identiv is global provider of access control systems. The company offers high level security at an affordable cost. It comes with frictionless access that can be managed from any premise. Its logical access provides all the features right from remote authentication to embedded applications and keeps the data safe and secure… Read more

Market Overview

Access control systems provide secure access to physical resources by validating user credentials. Systems may include credentials such as proximity cards, smart cards, fingerprint readers, iris scanners, face recognition readers, hand geometry readers, electronic locks, control panels or controllers, and security management software. Every vertical has specific security requirements—from excluding intruders and limiting access to dangerous or sensitive areas to protecting valuable assets and equipment or ensuring the safety of solitary areas.

The access control systems market was valued at USD 6.94 billion in 2017 and is likely to reach USD 12.12 billion by 2024, at a CAGR of 8.24% from 2018 to 2024.  access control systems find applications in various verticals, such as commercial, residential, healthcare, manufacturing and industrial, government, military and defense, education, and transportation. Infrastructure development in these verticals would boost the demand for advanced biometric solutions and smart locks.

Factors such as the adoption of access control as a service (ACaaS); implementation of mobile-based access control; and increasing urbanization in emerging countries are expected to provide huge growth opportunities to players in the access control market. Mobile-based access control makes the identity management process easier by integrating multilayered physical access control (PAC) and IT security into one system. Smartphones can be used as secure credentials for accessing buildings, doors, IT systems. Emerging nations are witnessing rapid urbanization with the development of smart cities. In emerging nations, the concentration of industrial development in cities leads to a growing demand for infrastructure. This infrastructure development would boost the demand for advanced biometric solutions and smart locks.

By component, the access control systems market has been segmented into card-based readers, biometrics readers, multi-technology readers, electronic locks, controllers, and others. By service, the market has been segmented into installation and integration and support; and maintenance services. By vertical, the access control market has been segmented into commercial, military and defense, government, residential, educational, healthcare, manufacturing and industrial, and transportation.

Vendor evaluations are based on two broad categories: product offering and business strategy. Each category carries various criteria, based on which vendors have been evaluated. The evaluation criteria considered under product offerings include the breadth of offering, delivery (based on industries that the vendors cater to, deployment models, and subscriptions), features/functionality, delivery, product quality and reliability, and product differentiation. The evaluation criteria considered under business strategy include geographic footprint (on the basis of geographic presence), channel strategy and fit, vision alignment, and effectiveness of growth (on the basis of innovations, partnerships, collaborations, and acquisitions).

Visionary leaders are the leading market players that have robust product portfolios, strong market presence, and effective business strategies. These players’ broad product portfolios enable them to serve most of the regions across the world. Visionary leaders primarily focus on acquiring leading market positions through their strong financial capabilities and well-established brand equity. ASSA ABLOY (Sweden), Johnson Controls (Ireland), dormakaba Holding (Switzerland), Allegion (Ireland), Honeywell Security (US), Identiv (US), Nedap (Netherlands), Suprema HQ (South Korea), NEC Corporation (Japan), IDEMIA (France), and Salto Systems (Spain) are the major visionary leaders in the access control systems.

Dynamic differentiators are well-established players with effective business strategies. However, they have weak product portfolios. They generally focus on a specific type of technology or product. Bosch Security (US), Gemalto (Netherlands), Axis Communications (Sweden), Lenel Systems International (US), and Time and Data Systems International (UK) are the major dynamic differentiators in the access control systems.

The need for innovative technologies to modernize access control offerings has resulted in innovations in the access control market. Innovators demonstrate substantial product innovations compared with their competitors. These players have wide product portfolios. However, they lack effective growth strategies for their overall business. Some of the prominent innovators in the access control systems market are Vanderbilt Industries (US), Adman Technologies (India), and Brivo, Inc. (US).

Emerging players offer niche products and have gradually started gaining traction in the market. They lack effective business strategies, unlike other established players. These players are mostly the new entrants and require more time to gain market visibility. Some of the emerging players in the access control systems market are AMAG Technology (US), Gunnebo (Sweden), Gallagher Group (New Zealand), Napco security Technologies (US), Kisi Inc. (US), and Cansec Systems (Canada).

Product Evaluation

Major Drivers

High adoption of access control due to the increase in crime rates
access control systems enable prompt and effective real-time response during terrorist attacks and other criminal activities. The use of smart cards, biometric devices, and electronic devices for advanced security and authentication provides security to commercial, government, industrial, and residential verticals. Access control systems are also installed in highly restricted areas, nuclear plants, and organizations to enhance the security of personnel and assets.

Technological enhancement and implementation of wireless technology in safety systems
Access control and security systems are growing highly due to the automation. Access control systems have shifted from being static architecture to exclusive secure and open access control architecture. The evolution of biometrics is also playing a vital role as it increases the level of authentication to make systems more secure. Biometrics is gaining traction as it includes authentication through facial recognition, iris, fingerprints, and gestures. The use of multi-technology readers is increasing owing to the transition from proximity card technology to smart card technology and biometrics.

Adopting IoT in safety system in cloud platforms
IoT has enhanced the quality and efficiency of automation systems by linking smart objects to the Internet and allowing them to exchange data securely. Connected security systems communicate with devices through the cloud; it helps in remote monitoring of areas.

Opportunities in access control systems market

Adoption of ACaaS
Access control systems manage readers, door sensors, locks, access rights, and other kinds of centralized access to facilities. These access controls are connected to the Internet, which gives companies centralized access to all facilities. ACaaS is affordable and offers flexibility comparatively considering other options like VPNs and other access control solutions. A typical power and utility company has a large mobile workforce of linemen and technicians who need to access remote facilities; ACaaS enables centralized access control to remote facilities. For instance, if a worker is fired, one just needs to log in to the administrative account of the concerned worker and revoke all his permissions.

Implementation of mobile-based access control
Vendors are innovating their products to meet the changing demands of organizations, who nowadays are constantly looking for advanced security solutions. The logical and network-based access control capabilities include basic policy engine, third-party interoperability, authentication, network enforcement, guest networking, visualization, and reporting. However, mobile-based access control system software makes the secure identity management process easier by integrating multilayered physical access control (PAC) and IT security into one system. Using phones for securing information to access building, door, and IT system, delivers a high experience to businesses and offers the growing opportunity to mobile vendors in security.

Access control system - By component

The access control market, based on components, has been segmented into hardware and software. Systems are authenticated using cards, biometric readers, controllers, and access control solutions management software. 

Card-Based Readers
Cards are used as credentials to authenticate user identity and determine access grant/denial (also the appropriate level of access). Access control readers can be magnetic stripe, proximity, or smart card readers. Types of Card-based readers are as below:

1. Magnetic stripe readers-

A magnetic stripe card is a plastic card with a magnetic stripe that stores the data. A magnetic stripe reader reads the information stored on the magnetic stripe of a card and transmits it to an access control unit. However, the information can be easily stolen and duplicated. Magnetic stripe readers have minimal security as the data written on a magnetic stripe card can be easily read. 

2. Proximity card readers-

A proximity card reader is a contactless card that contains programmed data and operates on RFID technology at the frequency of 125 kHz. Such a card consists of a coiled antenna and chips and holds specific numerical programming. The card carries a set of binary numbers that are converted by a reader into a protocol and transmitted to access control panel for authentication.

3. Smart card readers

Access to infrastructure can be electronically controlled by smart cards, which are used in combination with smart card readers. Smart cards are embedded with microprocessors and memory and are classified as contact and contactless smart cards. Contact smart cards have 8 contact points and are inserted into a smart card reader for authentication. These smart cards are used for physical access control in applications wherein the speed of transaction is not important—for example, parking. Contactless smart cards have embedded antennas that enable communication with readers without any physical contact; these cards use radio-based technology to transfer the data. Typically, smart card readers do not make access decisions but send card data to access control panels that verify the data against access lists.

Smart card readers operate at a frequency of 13.56 MHz and follow the ISO 14443 standard. These cards securely manage, store, and provide access to data. The data or information stored in a smart card is read by a reader that is typically a part of a computer system. Smart cards provide better convenience and transaction security than magnetic stripes and proximity cards. Smart cards, also known as integrated circuit cards or chip cards, are supported by embedded integrated circuit chips that can be used for data storage, authentication, identification, and application processing. Readers can process data imprinted on smart cards either through direct contact (contact smart cards) or without contact (contactless smart cards) through near field communication (NFC) systems. Smart cards have several application areas, including identification, health cards, public transit, ATM cards, credit cards, fuel cards, and security token.

1. Contact Smart Cards: Contact smart cards can operate without a battery; the power is supplied through the card reader. Contact smart cards are required to make physical contact with the card reader. While inserting the contact smart card through the reader, electronic contact is made between the card and reader, and the data is fetched and processed. Contact smart cards can be used for single function or multiple functions. Contact smart cards find applications in credit and debit cards, fuel cards, health cards, and direct to home (DTH) smart cards among many others.
2. Contactless smart cards: Contactless smart cards operate without any direct physical contact with card readers; the data is exchanged between the card and reader via electromagnetic or magnetic fields. An antenna is embedded inside a contactless smart card, which enables the communication between the card and reader. Contactless smart cards are increasingly used in the retail industry for faster payments and automatic access applications as they require lesser processing time than contact smart cards.

Biometric Readers
Biometric technologies are used to measure different physiological parameters for identification and authentication purposes in access control systems. Authentication by biometric verification has become increasingly popular in a wide range of applications. Biometric devices consist of a reader and software that convert the scanned information into digital format, and a database that stores the biometric data for comparison. Each person has a unique overall pattern, which cannot be duplicated. This makes biometrics a popular method of authentication. Biometrics is one of the fastest-growing technologies used to secure perimeters. Biometrics enables identifying a person’s physical characteristics to provide controlled physical access to an infrastructure. This technology is being increasingly adopted in government facilities, manufacturing units, power stations, defense establishments, and enterprises.

1. Fingerprint recognition-

Fingerprint recognition is an effective and simple method for identifying and authenticating individuals. Every person has unique fingerprints, which are a series of minutiae points, furrows, and ridges. There are two categories of fingerprint matching: minutiae-based and pattern-based. Minutiae points are important for finding and calculating the matching points with the fingerprint of a person. Pattern-based algorithms compare the basic fingerprint patterns (arch, whorl, and loop) of a person with stored templates. Fingerprint recognition is also used in police investigations, defense-related purposes, and immigration.

Fingerprint scanners are widely used in organizations as a method of employee identification. These scanners are also installed on mobile phones and laptops as a method for user authentication. The increasing adoption of automated fingerprint identification system (AFIS) is expected to fuel the growth of fingerprint recognition solutions. Three types of fingerprint scanners—capacitive, sweep, and optical—are used in access control solutions. Optical scanners are preferred for no-contact and hygienic applications.

2. Palm Recognition-

Palm recognition technology-based biometric products measure hand geometry—size of palm, length and width of fingers, distance between knuckles—to authenticate security systems. All biometric techniques differ based on the security level, user acceptance, cost, and performance. Palm print matching techniques are of 3 types: minutiae-, correlation-, and ridge-based.

Minutiae-based palm print matching is similar to fingerprint matching—it relies on the minutiae points. Correlation-based matching involves superimposing palm images and comparing the ridges. Ridge-based matching relies on ridge pattern landmark features, such as sweat pores, spatial attributes, and geometric characteristics, or local texture analysis. This method overcomes some of the difficulties associated with extracting minutiae from low-quality images. Palm recognition-based biometric screening is considered to provide a medium level of security compared to other techniques.

3. Iris recognition-

Iris biometrics records the unique patterns in the colored circle of a person’s eye to verify and authenticate identity. Iris recognition technology is one of the most accurate and fastest technologies; it can operate on long distances. In this recognition method, an “iris code” is generated on the basis of iris texture, and this code is unique for every individual. Iris scanners use the mathematical pattern-recognition technique from the video image of one or both the irises of an individual’s eyes. Irises have complex patterns, and they are unique and stable. Iris recognition algorithm identifies more than 200 identification points, including rings, furrows, and freckles within an iris. Irises are more detail oriented, thereby providing a high level of security.

4. Facial recognition-

Face recognition is a software application that can identify an individual by comparing and analyzing patterns in a digital image. It is used for surveillance and security purposes. Facial recognition systems use numeric codes called face prints. These systems identify and use nodal points on a human face to measure variables such as the width of the nose, eyes, and cheekbones. To achieve more accuracy, 3D recognition systems are being used. 3D face readers use 3D sensors to capture information, which is then used for recognizing distinctive facial features such as the contour of eye sockets, nose, and chin.

There are different matching modes available through facial recognition readers, such as one-to-many or “identification” (1:N), one-to-one or “verification” (1:1), and 1:few segmented “identification” (1:Few). Most access control solutions use 1:1 matching. 1:1 biometric “verification” matching authenticates an individual’s identity by comparing a captured biometric template with a biometric template pre-stored in a database. Face recognition readers read the global, local, individual data point-based features to recognize an individual.

5. Voice recognition-

Voice recognition is a non-contact, nonintrusive, and easy-to-use biometrics technology. It is the method of identification and authentication of an individual’s vocal modalities. This technology uses audio capturing devices to record voice data at the time of enrolment and then extracts unique features from the data to create a template for future identification and verification. Voice recognition technology is the only solution that can provide remote authentication. It is ideal for situations where distant verification is required, such as telephone-based transactions. Voice recognition applications include account access for financial services, customer authentication for service calls, monitoring offenders under house arrest by making random calls, and voice mining surveillance in intercepted phone calls.

Multi-Technology Readers

Multi-technology readers employ both card and biometrics. Multi-technology readers provide a multi-protocol, multi-frequency solution; they can read multiple 13.56 MHz smart cards, MIFARE-encrypted sectors, and 125 kHz proximity cards. Multi-technology readers provide a way to transition from proximity cards or magnetic stripes to smart cards.

Electronic Locks

An electronic lock is a locking device that operates on electricity. It can be stand-alone or integrated with access control. The major advantages of electronic locks include the key control, addition of keys without altering the lock cylinder, ease of access control, transaction logging, and remote operation. There are 3 types of electronic locks—electromagnetic locks, electric strikes, and wireless locks.

Electronic locks provide better security compared to mechanical locks. Electronic mechanisms and access methods provide additional security as these systems cannot be tampered. Electronic locks can be combined with biometric authentication systems, such as fingerprint scanning. The rapid adoption of the electronic access control system is a key factor for the growth of electronic locks subsegment.

1. Electromagnetic locks- Electromagnetic locks include large electromagnets mounted on door frames and attached armature mounted on doors. Magnetic locks are simple to install and are attack-resistant. These locks are engaged by powering them with electricity; they require a constant supply of electricity to remain locked.
2. Electric strike locks- Electric strikes, also known as electric latches, replace standard strikes mounted on door frames. Electric strikes can be the simplest to install when they are designed for one-for-one drop-in replacement of a standard strike, but for some electric strike designs, the door frame needs to be heavily modified.
3. Smart locks- Wireless locks or smart locks are electromechanical locking systems that can be operated through authorized connected devices such as smartphones and tablets. Smart locks perform the function of locking and unlocking after receiving instruction from authorized devices through a wireless communications protocol. The wireless communications protocol is a digital description, which sets the rule for transfer of data between devices. Wireless locks are inbuilt with any of the following wireless technologies: Bluetooth, Zigbee, and Zwave. The benefits of smart locks over traditional locks include connectivity, higher security, convenience, and full access controls. These lock systems allow users to go keyless and lock or unlock their assets with smartphones, tablets, or similar devices. However, the batteries of these devices need regular monitoring and timely replacement to avoid dysfunctioning.

Controllers

Wireless locks or smart locks are electromechanical locking systems that can be operated through authorized connected devices such as smartphones and tablets. Smart locks perform the function of locking and unlocking after receiving instruction from authorized devices through a wireless communications protocol. The wireless communications protocol is a digital description, which sets the rule for transfer of data between devices. Wireless locks are inbuilt with any of the following wireless technologies: Bluetooth, Zigbee, and Zwave. The benefits of smart locks over traditional locks include connectivity, higher security, convenience, and full access controls. These lock systems allow users to go keyless and lock or unlock their assets with smartphones, tablets, or similar devices. However, the batteries of these devices need regular monitoring and timely replacement to avoid dysfunctioning.

Others

Others mainly include RFID tags, keypads, door sets, and servers. The server is used as a storage and communication device for access control readers and entrance systems such as turnstiles or door contacts. The access control server serves as the central database and file manager for recording system activity and distributing information to and from access controllers. Access control keypads are devices which are used in place of card readers. This device has numeric keys for entering codes. When access control keypads are used in conjunction with card readers, a valid card and correct code are required for access grant. RFID tags include key fobs, wristbands, ISO cards, clamshell cards, and vehicle mount tags. These tags are widely used for secure access, people tracking, and vehicle access applications.

Access control systems types

Discretionary Access Control (DAC)
DAC is the model in which owners or administrators of protected systems, data, or resources set the policies defining who or what is authorized to access a system, data, or resource. This model enables administrators to limit the propagation of access rights. A common criticism of DAC is the lack of centralized control. A typical example of this model is the Access Control system Lists (ACLs).

Mandatory Access Control (MAC)
The MAC model is a security model in which access rights are regulated by a central authority based on multiple levels of security. MAC is commonly utilized in applications that require a strong emphasis on confidentiality and data classification. Often used in government and military environments, classifications in MAC are assigned to system resources and the operating system or security kernel, which grant or deny users or devices access to resource objects based on information security clearance.

Role-Based Access Control (RBAC)
The RBAC model creates a family (list of users) in which permissions are associated with a subject’s role in an organization and users are made members of appropriate roles. Permissions are not assigned to users directly. Typically, employees receive privileges as per the limitations of their job responsibilities. This enables good use of the RBAC model. When selecting a certain kind of access control system, one needs to anticipate a host of factors such as the nature of a business, the number of system users, and the security procedures followed in an organization. When business applications are small and basic, less-complicated access control systems are suitable. This model relies on a complex structure of role assignments, role authorizations, and role permissions developed via role engineering to regulate employee access to systems. RBAC models can be used to enforce MAC and DAC frameworks.

Physical Access Control
Physical access control determines where, when, and who should be allowed to enter or exit an authorized area. Generally, this access control solutions includes keys and locks. Mechanical locks and keys can restrict the entry of unauthorized-key holders, but cannot provide insights on the number of times a key has been used on a given door. These are some additional drawbacks of physical access control. In place of physical access control, electronic access control uses computers to solve the limitations of mechanical locks and keys by replacing mechanical keys with credentials.

Electronic Access Control
Electronic access control systems provide smart methods to manage access to commercial and industrial facilities. These systems integrate a range of electronic access control devices, locks, and systems with management tools to control access to offices, facilities, and operations. Also, these systems record data pertaining to the time and date of an access-attempt (both granted and denied) for future reference. The electronic access control system grants access based on credentials. When the access is granted, the door is unlocked for a predetermined time, and the transaction is recorded. When the access is refused, the door remains locked, and the attempted access is recorded. For instance, DOM Sicherheitstechnik (Germany) is one of the world's leading manufacturers of innovative locking technology and electronic access systems. The company is one of the security hardware manufacturers with a strong network of group subsidiaries and partners.

Logical Access Control
Logical access control solutions control user access to information, systems, programs, processes, networks, and environments. Controls can be entrenched within operating systems, applications, add-on security packages, and databases, as well as telecommunications management systems. Moreover, logical access controls may be present in specialized components that regulate communications between computers and networks. Businesses and government organizations use a wide range of logical access controls to protect hardware from unauthorized remote access. The logical access control system used in a given facility or hardware infrastructure partially depends on the nature of the entity that owns and administrates the hardware.

Network Access Control
The network access control solutions comprises one or more access control readers that are individually controlled and connected to a central host or server. The transfer of information about a door access transaction is recorded in real-time and monitored from a centralized location. In a network access control, there may be a combination of various sensing, reading, and monitoring products placed around or integrated into the latching and locking mechanism to detect, deter, and delay an intruder and flag breaches.

Mobile Access Control
Mobile access control refers to using a smartphone to identify a person and granting/denying access to an entrance. In the past, physical access control solutions, such as keys, magnetic stripe cards, proximity cards, were generally used to enable access to a building. Now, credential technology has been developed using near-field communication (NFC) and Bluetooth technologies. Mobile access control is a standard method that supports a growing number of products and technology platforms. Various access control offer application-based mobile integration that allows users to install and use apps in their smartphones to interact with access control systems. However, sometimes these apps are designed with limited features and capabilities. For instance, Avigilon Corporation (Canada) provides Access Control Manager, a browser-based access control system with full manageability that connects to any smartphone or tablet. This application allows multiple operators to connect and operate it simultaneously. ACM is a browser-based system, which means a user can access it from anywhere. Also, HID Global (US) is one of the worldwide leaders of identity solutions. Millions of people in healthcare, education, financial, government, and state institutions around the world use HID products and services. HID Global has seen a rapid increase in the number of new products based on the Seos platform, including readers and cards. The company focuses on providing advanced technology platform-based mobile access control solutions. For instance, in January 2018, HID Global released the new version of its Credential Management System (CMS) that digitizes smart card technology and expands the use of digital certificates as credentials. The new ActivID CMS 5.0 makes it possible for people to be authenticated for digital access without using a physical smart card.

Challenges in Access control systems market

Security issues in regards to unapproved access
In most industries, physical and logical security are separate departments as their requirements and approaches are different. Thus, an access control system is always prone to threats from anyone with an intention to breach either physical or logical security. Even in the case of integrated IT and security systems, cyber-attacks are common. Security systems are being developed to overcome and block these threats; however, a system that gives complete security—physical and logical—has not yet been developed or implemented. Moreover, ACaaS being a completely cloud-based solution is prone to data breaches and cyber-attacks. Any security concern, such as data breach and unauthorized access to resources, can lead to significant monetary and reputational losses. Low-level security and improper use of access approvals are the main causes of data breaches. The centralization of identity and access management is considered to be the best way to trace the source of disruption or attack.

The increasing interconnectivity of IoT-enabled devices for sharing and collecting data increases the number of vulnerabilities within a system significantly. Also, government agencies, data collectors, and hackers may get unauthorized access to critical information while it is in transit. This might compromise not only the privacy of an individual but also pose a security threat. If personal information is passed to a non-intended recipient, it may be misused and lead to a security breach. Thus, the risk of cyber-attack through smart devices or IoT-enabled devices poses a major challenge for the growth of this market. Therefore, the threat of attacks on physical and logical assets persists. Companies need to overcome these challenges to build an access control system that is more agile and secure.

What is Access Control as a Service and what are its types?

Cloud computing has become the focus of attention in all industries; several enterprises and organizations today outsource their operational services and workflows to cloud-based platform under various service models, such as Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). ACaaS applies the principles of Software as a Service to access control systems. These services are built on an open-source platform. It removes the need to purchase expensive software and provides freedom to pay based on consumption. ACaaS enables the small and medium-sized business (SMB) customers to pay for specific features according to their requirements.

Hosted ACaaS
In hosted services, the servers holding access control data are placed at third-party locations. A user receives complete control over the access rights but is exempted from maintaining the infrastructure. A hosted ACaaS is enabled with online management for remote access and control. With a hosted service, multiple facilities can be networked. As the solution is web-based, it does not require any client software for supporting access control systems and is nearly maintenance-free.

Managed ACaaS
In managed ACaaS, a user pays a third party to administer the access control platform. The third party manages the services, including adding/deleting access rights, changing/assigning schedules, printing badges and credentials, and door ajar/propped monitoring. All the above third-party services are managed by the servers located at the third-party location.

Hybrid ACaaS
Hybrid ACaaS is a combination of both hosted and managed access control solution services. In this type of access control, a certain part of the access control system is handled by the user, while remaining functions are outsourced to a third party. In this model, the permissions are not associated directly to the attributes or the roles. These attributes are adopted for dynamically assigning and authenticating user roles.