Definition
In online mode, the reader connects in real-time to the central controller or cloud platform to complete authentication, anti-tampering logging, and linked video recording, requiring low latency and high availability of the link. In offline mode, when the link is interrupted, it relies on locally cached credentials, validity periods, and blacklists, which need regular secure synchronization and tamper protection; cellular networks often serve as tunnel backups or independent uplinks, forming redundancy with the wired main link.
Technical Features
Commonly, RS485/Wiegand and IP readers are mixed; TLS, certificate rotation, and incremental synchronization after large-scale card issuance need to be managed, and peak synchronization should be load-tested. Inconsistent clocks and central policies can lead to misjudgment of credential windows, so NTP sources should be unified and drift monitored.
Use Cases
Suitable for headquarters with multiple campuses, data center facilities, key hospital departments, and school dormitories; often linked with visitor systems, elevator control, and security video. Offline release policies and audit requirements must be clearly defined in case of weak network or dedicated line failure.
Key points for cooperation with IoT SIM cards
Cellular backhaul needs to be included in the security review of enterprise and campus boundaries (firewall whitelist, TLS, DNS) and be consistent with the asset ledger and O&M alarm closed loop.
- Divide card pools by building or area, and fix the outbound IP if necessary to facilitate ACL and mutual trust with the peer.
- Configure roaming policies, device-card binding, and remote logout to reduce the risk of misuse after reader or gateway theft.
- Private APN / directional data can reduce public network exposure; regress card traffic with peak passage times to set alarms for abnormal traffic and silent cards.
- Bind ICCID to gateway serial number and installation location, facilitating fault location and cost allocation.
Credentials and the pass boundary after online checks stop
Online and offline on an access reader describe where the credential decision is made, not whether the cellular icon is lit. Online, the reader or door controller sends a card number, a face-template index, or a QR code to the center. The center applies expiry, anti-passback, interlock, and the block list, then returns pass or refuse and writes the passage record. Offline, the door only compares credentials, time windows, and a short block list already stored locally. The IoT SIM here is usually not one card per door. It is the building gateway’s backup uplink: the leased line carries traffic when it is up, and cellular carries authentication requests and passage logs when the leased line fails or the riser cannot be cabled. The two modes do not share one timeout.
Before cellular backup is enabled, write the pass policy for a lost link. A hospital department, a data hall, or a finance room often requires “refuse by default offline, and keep only a short window for internal staff already cached.” A dormitory or an ordinary office door may allow “pass offline against the local allow list, but refuse visitor codes.” That policy has to be designed apart from fire egress and elevator interlock. A communications failure must not lock an escape door. The door clock is what makes offline decisions correct: credential expiry and the anti-passback window follow that clock. A door that cannot sync time for a long period will accept a credential that is not yet valid, or reject one that still is. Certificates and incremental lists need a version. When the gateway comes back, complete the list before returning to online decisions, so an old block list does not stay in force. Bind the SIM to the gateway serial number and the install point. If a reader or gateway is stolen, it can be stopped remotely, not only marked lost as a person’s card on the platform.
A common mistake is to treat cellular signal strength as proof that authentication works. Signal only means the radio has attached. If the firewall does not allow the address, DNS points the wrong way, or the certificate has expired, the reader still falls offline. Another mistake is to sync lists during the morning arrival peak. Many readers pull the list at once, crowd out alarms and live checks, and the floor sees “the occasional slow badge.” A third is to treat the offline cache as a permanent grant. A person leaves, the card is revoked at the center, the door stays disconnected for a week, and the old card still opens it. Acceptance should pull the wired link, throttle cellular, and skew the clock, then check that pass, refuse, and the audit record match the policy that was written down. The building-control boundary is described under BAS. A vehicle lane does not share a pedestrian reader’s offline timing; see barrier gate.
List delivery needs a window of its own, away from the passage peak, and each door should keep the version of its last successful sync. If a departure, a lost card, or a visitor-window change happens while the door is offline, the first job on recovery is to align the local decision with the center’s version, then return to online mode. Do not pass people first and sync slowly afterward. Anti-passback needs entry and exit as a pair. If offline storage kept the entry and missed the exit, a normal re-entry after recovery can look like tailgating. A fire-release command should win at the door itself. It should not wait for cellular to fetch “egress allowed” from the center. When a reader is replaced, clear the credential cache on the old device and bind the new device to the gateway and the SIM again, so two caches do not give opposite answers for the same card. The audit record should show whether the decision was online or local. A later review should not write a communications outage down as a policy pass.
After the door controller restarts, it should load the last confirmed list version before it tries the center. The other order leaves a gap with neither a local list nor an online decision. Badge results in that gap should be recorded on their own and not counted as normal passes. If the backup SIM’s monthly usage suddenly sits near zero, check whether someone unplugged the backup path before assuming the primary leased line is the whole story.