# Testing of Permeability of RFID Access Control System for the Needs of Security Management
## 1 Introduction
The standard recommends determining the level of risk by estimation based on the value of the asset to be protected, the determination of the attacker, and the method of attack. The risk levels are defined as follows [1] we can also see the experiences of the offenders for individual degrees in Table 1:  
* Level 1--Low risk: The attacker has no or minimal knowledge of access control systems. The value of the protected interest is low;
* Level 2--Low-to-medium risk: The attacker has little knowledge of access control systems and may use commonly available tools to defeat the system. The value of the protected interest has a higher value, and the attacker aborts the attack if he fears detection;
* Level 3--Medium-to-high risk: The attacker has knowledge of access control systems and has the appropriate technical equipment to overcome the system. The value of the protected interest is high. The attacker aborts the attack if he fears detection and identification;
* Level 4--High risk: The attacker has planned the attack in detail and has the equipment to overcome the system. The value of the protected interest is very high. The attacker aborts the attack if he fears detection and identification. EN 60839-11-1/AC2 defines four classes of environments in which access control systems can be operated [1; 17; 18]:  
* Class I: Indoor residential or office environment;
* Class II: General indoor environments--shops, stairwells, restaurants, etc. ;
* Class III: Outdoor environments that are protected from direct sunlight and rain, or indoors with severe climatic conditions;
* Class IV: General outdoor environment. To provide the listed functions, access control systems have several active and passive components [17]. A possible topology of an access control system is shown in Figure 1 (Figure 1) [18; 19; 20]. The access control system (Figure 1) is made up of electronic and mechanical elements that together allow access through the access point. The access point consists of [3; 20; 21] the following:  
* Monitoring/Management Center--This contains the database of a lot of information from authorized users, device configuration records, access control plans, etc. * Controller/Terminal--Control unit and the main device of access control systems, whose task is to make decisions and control one or more access points based on the data received from the access reader and from the monitoring center. The controller controls the individual access points by means of connected devices. * An access reader is a user interface device that receives data from users requesting to pass through an access point. Access readers can collect data in three ways: based on \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Level** & **1** & **2** & **3** & **4** \\ \hline Risk level & Low & Low-to-medium & Medium-to-high & High \\ \hline Use & Control of movement of people in the building; protection of low-value assets & Control of people in the building; protection of assets of medium value & Spatial protection; protection of assets & Spatial protection; protection of assets of very high value \\ \hline Knowledge of the attacker & Low knowledge; low financial resources to attack & Medium skill and knowledge; little financial resources to attack & Great skill and knowledge; knowledge; medium financial resources to attack & Very high skill and knowledge; knowledge; high financial resources to attack \\ \hline Typical application & Hotels & Offices; small businesses & Office premises; banks; industry & Critical infrastructure; military installations \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Classification of access control systems (Source: [1]). Figure 1: Access control system typical architecture [20]. the user's knowledge, from an identification element possessed by the user, or from the user's biometric characteristics. * Door sensors--These are most often magnetic contacts also used by alarm systems; their role is to notify the controller of the opening or closing status of the portal.