Card, mobile credential, payment and security
Auburn University is nearing the end of its second year with mobile credentials on campus, but the move to mobile wouldn’t have been possible without a number of partners offering their expertise. One of the most important players in the university’s move to mobile was access control solutions provider, Allegion, who helped Auburn to overhaul its campus reader infrastructure.
For context, Auburn’s quest for contactless dates as far back as November of 2014, when discussions first began about moving the campus credential away from mag stripe.
“We reviewed several different options that were available at that time, including NFC Mobile Credentials,” says Melanie Chambless, Manager, Information Technology Information Systems Support at Auburn University. “But we couldn’t come to a consensus on which would be best for our institution nor a timely and cost-efficient way to upgrade all the existing readers on campus.”
The next major inflection point for Auburn came in 2018 when Apple announced support for mobile credentials, for which one of the initial launch campuses was the University of Alabama.
“Within days of that announcement, Apple agreed to present the mobile credential to our Student Government Association, Student Affairs, and Tiger Card offices the following week,” recalls Chambless. “It was discovered that the support from Apple was only for Transact schools, so we were unable to proceed but were ensured by Apple that they would be working with CBORD on a solution to include mobile credentials in their system as well.”
Regardless of mobile credential provider, one thing was certain; Auburn needed to establish a new reader infrastructure that moved the campus away from mag stripe. The university turned to Allegion to help deliver.
“This was our first involvement in an installation where we had a main access control system – Auburn is Lenel – that was not from one of the one-card providers,” says Jeff Koziol, Business Development Manager, PACS Partners at Allegion. “CBORD had done it before at a few other campuses, but on a different credential platform.”
“That’s a takeaway that all campuses considering mobile should understand,” adds Koziol. “If you have a Lenel, Software House, Genetec, Avigilon, S2 or other third-party door access system, mobile is still very much an option for your campus.”
A takeaway for all campuses considering mobile is that if you have a Lenel, Software House, Genetec, Avigilon, S2 or other third-party door access system, mobile is still very much an option.
“We set out to expose all of our card touchpoints on campus in building out a use case document that became our guide to implementation,” says Kevin Watson, Director, Student Affairs Technology at Auburn University. “The entire project ran from Spring 2019 to launch in August of 2021.”
Watson goes on to explain that the process was elongated by the pandemic, a need to synchronize with a campus affinity card project and navigating questions around the campus’ significant jump from mag stripe to contactless.
“Allegion was a primary partner in this conversion, always helpful and available to us and rapid in response,” says Watson. “There were many times when we were overnighted configuration cards or other items that we needed for testing and deployment, and they continue to have frequent conversations with us to check in and guide us in new integrations.”
As for the role of the plastic credential, Auburn plans to continue issuing plastic en masse in 2023, but will increasingly phase out cards as the summer of 2024 approaches. “Plastic will have continued use over the coming years with visual badging and exceptional use cases, but we plan to use far less of it over time and phase it out as a default badge,” says Watson.
With regards to reader infrastructure, Auburn is now leveraging a variety of Schlage hardware from Allegion across various use cases on campus.
“We’re using Schlage MT20 readers for all use cases that are not physical access related, including campus dining, bookstores, and libraries,” says Rob Stanford, Senior Application Systems Analyst at Auburn University. “We have a variety of Schlage MTB11 and MTB15 models across campus for roughly 95% our physical access needs.”
The remaining 5% consist of Schlage AD300 locks for a specific set of residence halls and select locations at Auburn’s College of Veterinary Medicine, says Stanford.
“Our MT20’s are ideal for non-access control applications or financial transactions,” says Koziol. “And we do offer some ‘transition’ readers for those campuses still on mag stripe for door access who want to have a pathway to higher security smart cards and eventually mobile credentials.”
Stanford also explains that there are select locations where Auburn is using Schlage MTKB15 readers where PIN codes are required. “Also of note, we’re using Schlage MTB11 readers at student entry gates for a number of our athletic events, including football, basketball, baseball, softball, and gymnastics.”
Allegion’s Koziol says the ticketing application helped to chart new waters for the access control provider. “The student section ticketing use case for their home football games was a new one for us,” recalls Koziol. “And it works extremely well, limits human error, and increases throughput at the gate. It makes a difference for those students anxiously trying to get into the stadium and to their seats.”
After the primary student areas were completed in summer of 2021, we never quit upgrading and worked from a prioritized list that would make the largest impact on students.
From the physical access side, Stanford estimates the team are about 80% through upgrading campus. “After the primary student areas were completed in the summer of 2021, we never quit upgrading and worked from a prioritized list that would make the largest impact on students.”
“Since we were having to replace every single reader on campus from mag stripe to NFC, the project was bound to take a while,” he says. “We very much appreciate and value our partnership with Allegion as we continue to work with them to find new ways to leverage our credentials.”
As Stanford explains, the team at Auburn opted for a university-owned encryption key for its plastic cards, mobile credentials, and end-point devices. “Allegion was able to guide us through that process so that we could work with various vendors to implement the technology properly.”
In addition to new readers, Auburn also made the decision to upgrade its older wiring to OSDP for added security and capability. “Allegion worked with us to design a specific DESFire card with two mag stripes for use with campus needs as we transition away from mag stripe as well as for the affinity card,” says Stanford.
Open Supervised Device Protocol (OSDP) is an access control communications standard developed by the Security Industry Association (SIA) to improve interoperability among access control and security products. OSDP is used to link access control systems together, and supports the ability for two-way communication to send and receive information from the controller.
“The MTBs are great readers for anyone on the open, site specific encryption key path who eventually may want to move to mobile,” says Koziol. “They offer the industry standard Wiegand output but also support OSDP, which will start to become more commonplace in the door access world as more access control companies become OSDP compliant.”
Leaning heavily on Allegion's advice, we’ve been able to determine best practices for encrypting from point to point, upgrading wiring and devices, and potential new use cases for the future.
As with campuses across the country, Auburn also dealt with supply chain challenges. “Allegion bent over backwards for us to keep the readers coming in – even if at a trickle – so that we could keep our project of upgrading readers moving along,” says Stanford. “They found creative ways to get us new readers if they knew someone looking to unload some, or through other ‘magic’ ways.”
Upgrading a reader infrastructure across an entire campus is a serious undertaking for any institution, and having support from trusted partners can go a long way.
“Allegion was and is definitely a primary partner for our switch to mobile credential,” says Stanford. “Leaning heavily on their advice, we’ve been able to determine best practices for encrypting from point to point, upgrading existing wiring and devices, and potential new use cases for the future.”
