The growing safety responsibility behind digital locks

By Anurag Vennavaram, product manager, UL Solutions

A key has always been physical. It’s carried around, handed off to others and often misplaced. Keys are used to control access, and people expect that access to be immediate and reliable every time they reach a door.

What’s changing is how access is delivered. Digital keys now replace physical keys in many cases, making it possible to grant, update or revoke access instantly without distributing anything by hand. For businesses, hotels, property owners and many more, this brings greater efficiency and control. For users, it simplifies the unlocking experience.

Simplicity, however, depends on something far more coordinated than it appears. A digital credential must move between devices, be recognized instantly as unique and trigger the correct response in real time. That interaction also must work across different devices, networks and real-world conditions.

As more locks go digital, the role these systems play becomes more critical. Access control governs entry into physical spaces such as homes, workplaces and other shared environments. Therefore, reliability and security are directly tied to safety.

This introduces a different way to think about digital locks. Accessibility now depends on how effectively these systems connect and protect information. System-level performance now determines whether digital access can be trusted and adopted at scale.

What digital keys are and why they are different

Physical keys make change difficult because access is tied to a single object, which means even small adjustments introduce delay and coordination. At the same time, access often needs to shift quickly, sometimes with little notice. For example, a guest may extend their hotel stay, an employee’s role may change or temporary access may be needed for a short period. In a physical system, each of these situations involves issuing new keys, collecting old ones and keeping track of who has access.

Digital access removes the friction of that process. Digital keys are secure, software-based credentials stored on personal devices such as smartphones or wearables. Because they are managed through software, access can be issued, updated or revoked without modifying the physical lock. This allows permissions to be adjusted in real time and supports shared access models across various locations.

Each use of a digital key depends on secure communication between systems. The credential must be authenticated, the device must be recognized and the data must be protected as it is transmitted. These steps rely on cryptographic protection and validation processes to ensure the credential is legitimate and has not been altered.

Thus, digital keys operate within a system that verifies access every time they are used. The outcome depends on how well that system handles identity, communication and validation, sometimes in critical settings or situations.

When access control becomes a cyber risk

Digital locks control entry to physical spaces, which gives them a direct role in safety. In a connected system, whether a lock opens or not depends on software, communication and how credentials are handled at each step. If any part of that process does not perform correctly, the outcome is immediate and access may be granted when it should not be or denied when it is needed.

What makes this different from traditional access systems is how many steps are involved before a door ever opens. Credentials are stored across devices, transmitted through communication channels and interpreted by systems that enforce permissions. As connected systems expand, interactions multiply along with the number of points where failures or cybersecurity risks can occur.

Connected devices rely on software and communication protocols, and weaknesses in those areas can be exploited if they are not properly addressed. Because these systems are connected, the impact of a single issue is not limited to one device. A single vulnerability can affect multiple doors, users and locations at once.

This becomes more apparent in environments where time-sensitivity is a priority. In hospitals, for example, staff rely on immediate entry to specific areas based on their role. If a credential cannot be recognized because of a system or communication issue, even a short delay can interrupt critical workflows at the moment they are needed most.

Why interoperability is critical to how digital access systems function

Digital access only works if different technologies can operate together predictably. A single interaction can involve a phone, its operating system permissions, an app, a lock and the cloud-based credential validation. All of which are often developed independently yet expected to function as a single system.

As these systems expand, the number of possible interactions increases significantly. Within connected environments, it becomes difficult to identify every potential issue in advance because the range of device combinations and use cases is too large to fully account for. This complexity means that problems often emerge after deployment, when systems are exposed to real-world conditions and a broader set of interactions.

Interoperability provides a way to manage that complexity. It focuses on validating that devices not only connect but perform as expected with other relevant technologies and platforms. This ensures that when a credential is presented, it can be recognized and processed consistently regardless of the device or system involved. Testing plays an important role in this process.

Standards and testing for safer digital access

As digital access systems become more complex, consistent performance should be defined through shared expectations and validated through structured evaluation. Standards and testing provide that foundation by establishing how devices should communicate, how credentials should be handled and how security should be maintained across different environments.

This is why industry efforts are increasingly focused on defining how access systems interact at a foundational level. The Aliro standard, for example, is a standardized credential and communication protocol that allows authenticated smartphone or wearable to securely communicate with a door lock or access control reader.

Standards alone, however, do not ensure performance. Systems must be evaluated and tested in conditions that reflect how they are actually used. Authorized testing laboratories like UL Solutions help enable consistency by outlining how digital keys are exchanged between smartphones, wearables and access control systems, with the goal of enabling secure, predictable behavior across devices and brands. This makes it possible to identify issues that would not be visible when evaluating individual components in isolation and resolve potential design flaws early in the process.

Security evaluation focuses on how credentials are protected throughout these interactions. This includes how systems authenticate users, how they safeguard data during transmission and how they address known vulnerabilities and common attack methodologies. Approaches such as the UL Verified IoT Security Rating provide a structured method for assessing these protections against common risks and established practices.

Independent certification adds consistency to this process by providing an objective verification that systems meet defined expectations. In practice, standards and testing establish a shared foundation for evaluating whether digital access systems can perform reliably and securely as they scale.

Digital locks as a preview of the connected future

Digital access systems bring together multiple layers across devices, software platforms and organizations that define how access is used. Each layer plays a role, but the experience is reduced to a single outcome and reflects how consistently the system performs under real conditions.

Each interaction is influenced by different devices and changing environments. When these elements align, the experience feels seamless. When they do not, the gap becomes immediately noticeable because there is little tolerance for variability at the door.

As digital access expands, trust will no longer be assumed; it will be measured by how consistently these systems perform in real-world conditions. In that sense, every successful door interaction is more than convenience; it is proof that the underlying system can be relied on when it matters most.

About the author

Anurag Reddy Vennavaram is a Product Manager at UL Solutions and an IoT ecosystem strategist focused on advancing trust, safety, and interoperability across connected technologies. With nearly a decade of experience in smart home protocols and global certification programs, he leads IoT strategy and customer engagement initiatives across North America, Europe, and Asia.

His work centers on enabling secure, reliable, and globally interoperable connected devices, supporting UL Solutions’ mission to create a safer, more secure, and sustainable world. Anurag brings deep expertise in certification driven ecosystem scale, bridging standards, certification, and market adoption.

A globally recognized Bluetooth Qualification Consultant by the Bluetooth SIG, a highly specialized designation held by a select group of professionals worldwide, Anurag holds a master’s degree in computer science and a bachelor’s degree in finance and commerce.

Article Topics

access control  |  biometrics  |  interoperability  |  IoT  |  UL