← Back
Home › Systems › Security and identity

physical-access-control

badge and mobile-credential door access: OSDP readers, door I/O controllers, anti-passback, offline credential sync, visitor management, alarm/video integration

HID, Genetec, LenelS2, Verkada, Gallagher

SystemTechniques · 27Primitives · 89 physical-access-control Desired-state reconciliationdistributed · medium: Declare the target in a store; controllers repeatedly diff actual against desired from full state and apply idempotent fixes, so missed events only delay convergence.›Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Device shadow state syncdistributed · medium: Desired vs reported device state documents with versions and delta reconciliationIncremental sync cursorsdistributed · medium: The client keeps one opaque token; each pull returns only the changes after it plus the next token, so sync cost scales with what changed, not with the dataset.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›A/B partition updatesembedded · medium: Two bootable slots and a small atomic metadata block: write the new image to the idle slot, try it once, and fall back by itself unless it reports healthy.›Alarm managementembedded · medium: Turn raw process limits into a few actionable operator alarms with delay, deadband, acknowledge and shelving states, plus flood measurement.›X509 certificatessecurity · low: Certificate chains, path validation, SANs, revocation and short-lived issuanceAEAD (AES-GCM, ChaCha20-Poly1305)security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.›Hdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesEvent deduplication windowdistributed · low: Keep the ids of recently accepted events for a time window and drop repeats; memory stays bounded by rotating time buckets instead of per-entry timers.›Ble advertisingembedded · low: Bluetooth LE advertising packets, scanning and rotating identifiersOsdp reader protocolembedded · low: OSDP v2 secure channel between controller and reader over RS-485: polling, commands, key installProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›RTP and RTCPmedia · low: RTP stamps each media packet with sequence number, media-clock timestamp and source ID; RTCP reports loss, jitter, round trip and clock mapping within a bandwidth cap.›Video codecsmedia · low: H.264/HEVC/AV1 basics: frames, GOPs, hardware decode/encode APIs and latency settingsAnti passback statesecurity · low: Per-credential in/out zone state machine rejecting re-entry without exit, with timed and global-zone variantsApdu smart card protocolsecurity · low: ISO 7816 APDU command/response exchange with smart cards, eUICCs and secure elementsHKDF key derivation (extract-and-ex…security · low: HMAC-based two-step key derivation: extract a uniform pseudorandom key from any secret, then expand it into as many context-bound keys as you need.›Ldap directorysecurity · low: LDAP directory model, bind, search filters and group membership queries for enterprise identityMutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›Row-level security (multi-tenant is…security · low: Append a policy predicate to every query inside the database, so a forgotten WHERE tenant_id = ? in application code cannot leak another tenant's rows.›Graceful drainingsystems · low: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.›+ 20 more techniques+ 73 more primitives

Similar systems

Share the most building blocks with this one.

uem 38 %compliance-automation 33 %e-id 32 %esim-provisioning 30 %iga 29 %