Platform and access
Identity, credentials, and policy in one operating model.
Cloud owns administration. Q-Air brings Accena readers online. Credentials — cards, wallets, mobile keys, FIDO2 NFC — are issued under policy and enforced at the door.
How access is administered.
The workspace covers the full path from enrolment to published policy.
Identity and Q-Air
People and groups enrol into a governed identity flow. Readers join the fleet with Q-Air — scan, claim, policy on the device.
Access policy
Grants, schedules, and least-privilege rules published as access policy — not ad-hoc door lists.
Accena reader fleet
Accena readers are first-class fleet devices: Q-Air claim, policy, signed OTA, encoding-station role, and the same trust path as Edge and IO.
Site hardware, one trust path.
Readers, Edge, IO modules, and cabinet handles. Signed firmware. Factory identity. One fleet.
Edge gateway
NG-Key-Edge orchestrates readers and IO on site. Policy is enforced locally. The cloud administers.
NG-IO modules
NG-IO in 4, 6, 8, 16, and 30 channel sizes, plus the compact Accena BLE IO pill. Relays, sensors, and door IO under the same policy — and the same signed OTA path.
Cabinet locks
Accena rack handles lock IT cabinets with the same credential stack as door readers. No second access system for the server room.
Signed OTA throughout
Readers, Edge, and IO take signed firmware from the same release authority. Updates are a fleet operation, not a site visit.
Route of trust
Factory certificates, signed firmware, and live hardware-trust checks on Edge, IO, and readers. Claim tokens and leftover MQTT passwords do not authorize a production device. A mismatch is visible. The device does not silently join the fleet.
From card structure to encoded, printed media.
Ausweis-Studio authors the chip. Ausweis-Designer lays out the face. The station encodes and prints. DESFire applications, LEGIC advant master tokens, and LEGIC neon Trusted Service VCPs stay separate paths in one lifecycle.
-
01
Ausweis-Studio
Ausweis-Studio authors the chip, separate from the printed face. The card is a tree: DESFire applications, each with its own AID, files, and AES roles, or a LEGIC structure. Advant segments and neon files stay on different branches and are not copied across. The path is Invent, Structure, Review, Activate — activation stays closed until the structure validates. Key bytes never appear on screen.
-
02
DESFire multi-application
One card, several applications — each with its own AID, files, and AES roles. Access, OSS-SO, and companion apps share the medium. No second credential store.
-
03
LEGIC advant and master tokens
LEGIC advant is Master-Token System-Control: segments, not DESFire files. Each segment carries a stamp from the operator’s master-token hierarchy, and the zone follows that token’s technology generation. Encoding binds physical master tokens from inventory — IAM and IAM+ to create or delete segments, a launch SAM so readers may read and write, and XAM where the hierarchy uses it. Those roles are bind-only. NG-Key does not generate their key material. Write-protected segment content still needs the matching launch SAM on the reader.
LEGIC neon and Trusted Service
LEGIC neon is not advant. Ausweis-Studio authors neon files for the offline credential — its own file set, not advant stamps, zones, or master-token bind. Keys travel in a LEGIC Orbit VCP, a Versatile Configuration Package encrypted from LEGIC Trusted Service to the reader. NG-Key keeps the structure, object fingerprints, and the encrypted VCP. The keys stay in the Trusted Service and never appear on screen.
Graphical card designer
Ausweis-Designer is a graphical CR80 canvas: front and back, duplex, bleed and safe area, printer profile. The same layout prints at the station or renders as a Wallet pass.
Windows and Mac station client
NG-Encoder is the desktop station client for Windows and macOS: queue, layout review, encode, then print. Workstation printer control — select printer, drivers, print after encode — runs on Windows. Accena USB encode is the Windows station path.
Wallet QR for visitors
Apple and Google Wallet QR passes for visitors, contractors, and employees. Visitors need no card — the signed pass is their media. The door verifies locally.
FIDO2 NFC — reader or Edge
A FIDO2 NFC key taps the Accena reader, or the same NFC session is bridged transparently through Edge. The door verifies locally.
Mobile keys
Bring your own device. Passkeys, Access QR, Wallet QR, and phone presentment — the same person, the same grants. The employee hub is mobile-only.
Security and trust
Enforcement and audit are part of the same security model.