Bracelet as a key: RFID from locker to analytics

The technology from this article is most likely already in your facility. The silicone bracelet opens the locker, lets you into the wet zone, keeps the bar on the post-payment and closes the visit at the terminal. That is, every guest leaves a sequence of marks with the exact time every day, and this sequence is exactly what the rest of the technologies in the series are chasing with anchors, cameras and radars.

The difference between an object that knows where a guest is going and an object that doesn't know is often not in the equipment. It's about whether someone is uploading an event log.

Therefore, it's worth starting from here: RFID is the cheapest movement analytics available, with a strict and honest restriction. It does not give a trajectory. She gives marks in the places where you put the reader, and knows nothing about the guest in between. All work with RFID as a data source is work with this limitation: where to put the reading points so that the marks form a meaningful route, and how not to be deceived where there is no mark.

Physics and Classes: what of this about people

RFID is not one technology, but four families with different physics. The choice between them for an object with guests is determined not by functions, but by water and body.

Family	Frequency	Range	What is usual	Water and body
LF	125-134 kHz	1-10 cm	Old passes, animal tags	Insensitive, but slow and unprotected
HF, NFC	13.56 MHz	1-10 cm	Bracelets, cards, locks, cash registers	Works well
UHF (RAIN)	860-960 MHz	1-10 m and more	Inventory, warehouse, portals	Sensitive to water and metal
Active tags	2.4 GHz, etc.	Tens of meters	Search for objects, zones	Depends on the design

Why the guest bracelet is almost always 13.56 MHz. HF works on inductive near-field coupling: the reader antenna and the tag antenna are connected by a magnetic field at a distance of centimeters. Such a connection is weakly dependent on the fact that there is water nearby — and this is a decisive argument for an object where the label is worn on a wet hand pressed against a wet body.

UHF works on radiation, and water absorbs it, and metal reflects and upsets the antenna of the tag. Therefore, the UHF tag, which is six meters long in the corridor, reads noticeably worse and unpredictably on a wet hand at the edge of the pool. This does not mean that UHF in a water park is impossible — it means that it requires on-site verification and is not suitable for operations where a reading failure breaks the service (open a locker, pay for a cocktail).

Hence the working scheme that the industry has come to: HF per guest, UHF per property. Bracelet — near field, reliable, with confirmation of attachment. Towels, bathrobes, fins, rent, carts — UHF, where range and mass reading are important, and not the guarantee of every reading.

Bracelet as a product

There are a few things you should know about a silicone bracelet for wet areas that are not visible in the specification.

The clasp is the main consumable. The bracelet is lost not because the silicone is torn, but because the latch is undone or broken. This determines both the losses and the cost of ownership: during the season, the object loses a noticeable part of the fleet of bracelets, and this should be budgeted immediately.

Disinfection against the resource. Bracelets are processed between guests, and the processing schedule affects the service life of the silicone and the tightness around the chip. Question to the supplier: what processing mode is acceptable and how many cycles are declared.

Color and printing. The color of the bracelet is a free visual tariff: a guest with a yellow bracelet in the steam room is visible to the administrator without any system. Printing a number is insurance in case of electronic failure, and also a way to quickly deal with a lost bracelet. To do this, a card and bracelet printer is needed at the facility, otherwise numbering turns into manual work with a marker.

Antenna and reading area. The bracelet is read in a small volume by the reader, and how confidently the guest gets into this volume depends on the location of the reader and on which hand the guest reaches for it. A reader installed inconveniently increases the proportion of repeated applications and spoils your data: double events appear in the log.

Security: Classic or DESFire is a matter of money

A technical detail that is usually not disclosed in commercial offers, but costs exactly as much as guests can carry on it.

The first fork is where the guest's balance lies.

The "wallet on the bracelet" option. The remainder is stored in the chip's memory, the terminals work autonomously, communication with the server is not critical. It is convenient and lives when the network is broken. And that's exactly why chip protection becomes cash register protection.

Option "only the number on the bracelet". The chip stores the ID, all the money and rights on the server. It requires a live network to every point, but cloning the bracelet gives the attacker not money, but a maximum of someone else's number, which is detected elementary.

The second fork is the chip type.

MIFARE Classic uses the Crypto-1 cipher, which has been cracked since 2008. Today this is not a theory: according to the descriptions of security experts, an inexpensive tool like Proxmark3 restores the sector keys of a standard card in seconds, and a smartphone with NFC is enough for some attacks. Let's assume Classic as a "guest number" in a system where all decisions are made by the server. As a carrier of money or access rights, he is unsuitable, and the dispute about this ended about fifteen years ago.

MIFARE DESFire (EV2, EV3) and MIFARE Plus use AES-128 and mutual authentication. There are no publicly known practical cloning attacks on correctly deployed DESFire systems — with a significant caveat: "correctly deployed". The system, where one factory key is stitched in all bracelets and all readers of the object, is protected exactly until the first reader, which someone took away.

What to ask the supplier:

• which chip and which key family is used;
• where is the balance stored and what happens when the connection is broken;
• are diversified keys used, that is, a different key for each bracelet;
• who owns the master keys of the system: you or the contractor;
• what happens when the reader or terminal is lost;
• how protection against simple copying of a number (UID) is implemented — whether cryptography is checked or a number match is enough.

The last point is the most practical. Systems that check only the UID get by with a simple emulator, and in this case it doesn't matter which chip is in the bracelet.

Event model: how marks make a session

Now to the point: what does RFID give as a data source.

The system writes events of the form "bracelet No. 1428, reader "wet zone entry", 19:42:11, access is allowed." A session is collected from such records, and it is not collected automatically: you need a data model that glues events by bracelet number and by the interval between issuance and return. This is the task of an add-on over the ACCESS Control System, and usually there is none.

A typical set of events that can be obtained without a single new sensor:

Event	From where	What of it counts
Issuing a bracelet	Cash register or terminal	Session start, pricing plan, sales channel
Passage of the entrance turnstile	Access Controller	Object loading by minute, bandwidth
Entering the wet zone	Wet zone turnstile	How many guests reached the main service
Opening the locker	The castle	Locker turnover, changing time
Buying from the bar	Sales register for a bracelet	Session-to-purchase conversion, average receipt, time to first purchase
Passage to the zone according to the tariff	Zone Reader	Actual demand for the zone, conflict with capacity
Closing a session	Additional payment terminal	Duration of the visit, share of overwork, surcharges

This is the funnel of the visit: so much has entered, so much has reached the wet zone, so much has entered the bar, so much has entered the premium zone, so much has been recycled. For the manager, this is already sufficient material: losses between stages are visible, hours and days are visible, tariff effects are visible, the difference between sales channels is visible.

Where this picture lies. Three systematic errors, each of which occurs in any object.

The first: no mark does not mean that there was no. A guest could have followed another guest into the zone while the turnstile was open, or an employee let him through manually. If the zone after the entrance is not physically controlled, the statistics on it are underestimated, and the looser the regulations, the stronger.

Second: double events. Repeated application, accidental reading of a nearby bracelet, triggered on return. Gluing events within a few seconds is a mandatory processing step, otherwise there will be more "passes" than people.

Third: a session without closing. The bracelet was not returned, the terminal did not work, the guest left through the service exit. The session remains open in the log, and the average session time creeps up. We need a procedure for closing such cases, otherwise the metric will degrade over time.

Density of reading points: how many to add to see the route

The main tool for managing the quality of data in RFID is not the chip or the reader, but their location. One or two new wall readers give more than changing the entire system.

The rule is simple: the reading point is needed where the meaning changes. Not "every twenty meters", but at the borders, after which the guest is in a different state.

A reasonable minimum for a thermal spa complex:

1. Checkout or pick—up terminal - the beginning of the session.
2. Entrance turnstile — perimeter intersection.
3. Entering the wet zone is the transition to the main service.
4. The locker — locks block is already writing events, it is enough to connect them to the big picture.
5. Bar and cafe — purchase with a bracelet.
6. Entry into premium and tariff zones — demand and loading.
7. Additional payment and exit terminal — closing of the session.

What is added the cheapest and gives the most:

• The reader is at the entrance to the steam room or to the hammam. Closes the most frequent operational task — where the queue is going and when a bath attendant is needed. And at the same time gives time control in the hot zone, that is, security.
• The reader is at the exit from the wet zone. Gives a closed interval, that is, an honest "time in the zone" instead of an estimate.
• The reader is on the stairs or at the entrance to the floor. The cheapest way to understand if a guest reaches the second level. If it turns out that one of the six comes, the question "why is there a recreation area" is solved without discussion.

What can not be done: put the reader in the locker room or shower room in the calculation "the guest will attach a bracelet." This is not prohibited, unlike cameras, but it is useless: a guest with wet hands and without motivation will not apply anything. The mark is needed where the guest has a reason to do it: open, pass, buy.

UHF: Property, portals and zonal positioning

The UHF family in the facility with guests is not responsible for people, but for everything else — and it is underestimated in vain.

Portals and gates. Antennas in the doorway read tags on passing objects en masse and without attachment: issuance and return of towels and bathrobes, rental of inventory, control of property removal, movement of laundry to the laundry and back. Here UHF is indispensable: one hundred towels passed on a trolley are read in one pass.

Zone positioning on UHF. There is a class of ceiling readers with a phased array antenna, which not only record the presence of a mark, but assess the direction to it. An example from the open specification is Zebra ATR7000: digital beamforming, the claimed localization accuracy is usually better than 0.6 m, one reader covers four or six reporting zones. These are vendor figures from the specification, independent measurements could not be found in open sources.

For objects with guests, this is interesting not for guests, but for expensive and mobile: rental equipment, tools, medical equipment, carts. An important practical detail: this model works in the band 902-928 MHz, that is, in the version for the USA and Canada, and in Russia the working band is different — see the section about the law. When purchasing, this is the first thing to check, otherwise the equipment will not be applicable.

Anti-collision and rush hour. The UHF reader polls tags using a collision resolution protocol, and the more tags in the field, the longer the cycle. In practice, this means that one hundred marks on the trolley are read quickly, and one hundred marks passing close in a metal container are partially. The acceptance rule is the same as in the methodical article: check in rush hour conditions, not on five labels.

Cases: how it works on objects

European thermal spa complexes. The practice of large facilities is a single carrier for all guest operations. Gantner describes a scheme in which a bracelet or card combines access control, locker management and non-cash payment, and the guest passes the entrance, locks things and pays without the participation of staff. Among the facilities are Therme București in Romania with an integrated access, payment and locker system and Silvretta Therme Ischgl in Austria; in the case of Rulantica, the stated goal is to host large flows of guests with a small staff. Solutions like GAT Chip Band, designed for sauna and steam room, are used for the bracelet.

Separately, it is worth noting the vendor figure that is walking around the market: the Gantner affiliate page refers to studies on the growth of guest spending up to 40% when switching to a non-cash bracelet. This is a vendor's statement without specifying the methodology, and you can't transfer it to your facility — but the effect itself (paying with a bracelet is easier than going to the locker for a wallet) is real, and you can measure it at your facility, as described in the article about metrics.

A resort with a hotel and a water park. The scheme in which one bracelet works both as a room key, and as a ticket to the water park, and as a locker key, and as a means of payment, is described by integrators using the example of Camelback Lodge and Aquatopia. This is a good reference point for facilities where a hotel is attached to the thermal baths: the bracelet becomes the only wearable item of the guest.

Asia. The market is massive and mainly supplier-based: Chinese manufacturers offer NFC silicone bracelets for water parks, swimming pools and campsites complete with locks and terminals. A useful caveat from their own materials: readability varies depending on the location of the reader, water and nearby metal, so you need to check on real readers before ordering a batch.

The ultimate case. Disney parks bracelets are often cited as an example of "the bracelet knows where the guest is." It's worth being precise here: Disney claims that the devices are not GPS-based and do not involve collecting a continuous location signal, but the company notes that it can determine the location of guests using the bracelet. According to the descriptions, we are talking about discrete marks on the readers, and not about a continuous track. That is, even in the most advanced park in the world, the bracelet remains an event technology, not a trajectory technology — just like yours.

What RFID doesn't do

An honest list of restrictions, without which the article would be an advertisement.

There is no trajectory. Between reading points, the guest is invisible. If there are seven readers, you get seven marks, not a route. Bypass: more reading points in critical places, or adding a continuous channel.

There is no real-time position. To the question "where is the guest with the 1428 bracelet now", RFID answers "the last time he was at the bar at 20:14." This is not enough to search for a lost child. Bypass: A Bluetooth tag in the same bracelet - this gives the zone in real time, and in the long run, the distance.

There is no accounting for those who did not attach. The passage behind another guest, the service entrance, the bracelet taken out. Bypass: comparison with impersonal counting at the entrance — the counter counts people, the bracelet counts the marks, the difference shows the quality of the regulations.

There is no data on what the guest was doing in the zone. The bracelet knows that the guest has entered the steam room. He doesn't know how long he's been lying there and if he's been ill. Bypass: presence sensors without an image, a separate article about them.

Power and range are not increased arbitrarily. "Let's put a reader that sees bracelets for ten meters" — rests on the physics of the near field and radio frequency regulation.

What is the law in Russia

Briefly, based on a separate legal article of the series.

Bracelet number as personal data. The number itself is an impersonal identifier. But as soon as it is connected in the accounting system with a contract, full name, phone number or subscription, the entire history of movements of this bracelet becomes personal data with a full set of operator responsibilities: the basis of processing, notification of Roskomnadzor, policy, retention periods, rights of the subject. This is not a reason to abandon analytics — it is a reason to consciously choose a mode.

A practical mode for analytics: store events with the bracelet number, and keep the "number — guest" connection separately and tear it up after the deadline required for calculations and claims. Then the analytical contour works with impersonal sessions, and personal data lives exactly as long as it is required for accounting.

Frequencies. For 13.56 MHz, there is a mode of short—range devices that does not require individual permissions - this is one of the reasons for the massive HF. For UHF in Russia, the working band is 866-868 MHz, and the conditions in it depend on the power: according to the decision of the State Broadcasting Committee 07-20-03-001, up to 100 MW is allowed in the band 866.6–867.4 MHz without frequency assignment when using the "listen before transmission" mode, and more powerful readers require assignment in the prescribed manner. The current version and the validity period of the decision should be checked before purchasing: there are discrepancies in details in open sources.

Hence the main warning on the purchase of UHF: the equipment in the version for the USA and Canada operates in the band 902-928 MHz and is not applicable in Russia. We need an ETSI version under 865-868 MHz, and with confirmation of compliance with the requirements of the EAEU.

Checklist for talking to the supplier

1. Which chip is in the bracelet, which family of keys, who owns the master keys?
2. Where is the guest's balance stored — on the bracelet or on the server?
3. Is the cryptography verified or just the number (UID)?
4. What happens to the cash register and lockers when the connection is broken?
5. What bracelet resource is declared and under what disinfection mode?
6. Is there a printing of the number and own printing of bracelets on the object?
7. Where are events written, what is the depth of the log, is there any unloading of raw events via the API?
8. Is it possible to get locker lock events on the same system?
9. How does the system glue double readings and close "abandoned" sessions?
10. For UHF: under which band is the equipment supplied and are there any compliance documents for Russia?
11. How many labels are read at the same time in the opening and what happens during rush hour?
12. Is it possible to add a reading point later and how much does it cost?
13. Is depersonalized analytics mode supported?

Sources

Sources

• Crypto-1 — the status of the MIFARE Classic cipher
• Zebra ATR7000, specification — zone positioning on UHF (manufacturer's data)
• Gantner, solutions for attractions and thermal spa complexes and partner page multiPASS-iD — a single carrier of the guest, vendor estimates of the effect
• GKRCH decision 07-20-03-001 — conditions for the use of bands for short-range devices (check the current edition)
• Xinyetong, recommendations for bracelets for water parks — practical reservations on reading by water and metal (supplier data)
• Disney, about the location of guests and MagicBand — an overview of the company's statements