Identity & Access Management

We enable organizations to manage digital identities and
control user access to critical corporate information alongside a
secure user authentication process for both on-premises and
working-from-home enviroments

Pain points

The business environment is changing rapidly, causing many companies to modify their work environment and procedures. With remote work and the use of personal mobile devices as access cards, obtaining and sharing information has become easier than ever. At the same time, however, the open network environment opens up businesses to significant risks in privacy protection.


Insufficient access management

RF cards at risk of loss, theft, and duplication

A total of 90% of the access control market is dominated by RF cards that
communicate on frequency. However, because of the risk of duplication and
loss, its security is questionable. The card’s security needs to be bolstered
to avoid duplication or usage when lost or stolen. Recently, the replacement of
smartphones with a simple mobile ID (App) is also gaining attention.

ID/PW theft because
of weak remote work /
network separation environment

Because of the COVID-19 crisis, remote workers became susceptible to the
negative effects of social engineering methods. In particular, 91.5% of related
cyber threats are from email phishing. A separate security control means
access to the internal network of the company is the most important aspect
of remote work. The use of a VPN to provide end-to-end encryption is
recommended. However, using a VPN without a secondary authentication can
expose the authentication to theft.

Information centralized 
to smartphones

Personal ID and payments are now all available on smartphones. As a
result, people rely more and more on their mobile device. If a person is
unable to use a smartphone to access facilities such as public offices, military
bases, power plants, etc. that have a commanding security environment, which
prevents photography, transmission of information, etc., other IDs and tools
for access control will be required.

The solution

swIDch’s OTAC provides control to users in mobile and remote work environments or grants a certain level of authority to access corporate resources and networks. It also offers more efficient control by providing a safe and simple authentication process when physical access to a certain space is required. OTAC can be provided both as software and hardware to upgrade individual or corporate access management.


> Read our SE Asia E-Stamp case study here

OTAC for Identity & Access Management

OTAC is a revolutionary authentication technology enabling enterprises to secure and protect data and people. Users can generate dynamic one-time access codes from their own mobile devices in an off-the-network environment with which users have access to corporate resources and networks. OTAC can also be easily integrated with the existing IAM solution and the user experience is never compromised.

IAM_image1 IAM_image1
IAM_image2 IAM_image2


OTAC for integrated management including access/payment/ID

Enterprises issue and manage at least 3.5 cards per each employee for payment, identification, and access purposes such as employee ID card, corporate credit/debit card, and corporate OTP for online payment. To spare themselves the hassle of going through all necessary steps, people tend to rely on their mobiles more for integrated functions, which unfortunately, raises other issues such as excessive reliance on a single device resulting in quick battery-drain. In addition, restrictions on smartphone use in certain areas such as government offices, military bases, power plants, and closed network environments can be an issue. With OTAC embedded-IC Chip (dual interface chip, NFC supported) card and minimal use of smartphones or access devices, many of the above-mentioned issues can be resolved. You can enjoy diverse functions with the card including payment, access management, system login, and identity authentication (KYC).

IAM_image3 IAM_image3

OTAC access management products

Click learn more to download our access management brochure for more details
  • IC card type: Combi card (ISO 7816)
  • OTAC code generation through NFC card tapping (mobile phone and access gate)
  • Various functions from gate/door access to system login and OTP function
  • Expandable to payment card through partnership with finance service firms
  • Fingerprint sensor and display option available
  • System log in and gate/door access control all available
Learn more
  • Using energy-harvesting technology (No Battery)
  • OTAC code generation through fingerprint recognition
  • Can utilize non-network environment
  • E-ink Display option available (QR Code applicable)
  • System log in and gate/door access control all available

Learn more
image (5)
  • OTAC log in code generation through card tapping,
    on mobile device, etc.
  • Using fingerprint recognition or ID card
  • Using mobile-generated code or QR code
  • Can utilize non-network environment
  • Additional functions can be linked (App functions)
  • System log in and gate/door access control all available
Learn more

OTAC access management service

Click learn more to download our access management brochure for more details


A user’s ID and password are a typical fixed-value authentication method, and even the most complex passwords can easily be hacked. Multifactor authentication (MFA), PIN and password, biometrics, etc. have been proposed to address this issue, but a simpler and more efficient authentication technology is required as the number of complex access environments and processes continue to rise. OTAC logs its users using mobile app–based biometrics, and its security is bolstered by single-use dynamic codes that never recur.
Access Management 1 v.2

Physical access control

The security hole of radio-frequency identification (RFID) cards is as a result of using static key values. If stolen, all other cards can become exposed. Access control cardsusing OTAC, on the other hand, generate dynamic codes in regular intervals through a mobile app, allowing safer access control by copying these in a near-field communication (NFC) card. Dynamic codes used in authentication are only available for a certain period, preventing their misuse when duplicated or lost.
Access Management 2 v.2

OTAC for enterprise

With OTAC, users can generate dynamic one-time access codes from their own mobile devices. This works in an off-the-network environment. As a result, enterprises can reduce network traffic and enable secure, reliable access management as there is no surface for hackers to attack.

Furthermore, employees and their devices can be identified with the code alone. Therefore, employees no longer have to deal with certain IDs, passwords and tokens. Also, there is no need to force employees to change their password regularly because OTAC itself is a dynamic code that changes every time!

Why swIDch

OTAC, developed by swIDch, is the original technology
that provides all of the following features, tested and substantiated
by the University of Surrey technical report
Why swIDch
Sufficient to IDENTIFY user
DYNAMIC Authentication code
that does NOT duplicate
Uni-directional authentication
in off-the-network environment

OTAC is a dynamic code, which means the code keeps changing. As a result, you don’t need to worry about any leak of your personal information, such as
your card details, because the codes must have already been changed when others try to use them.

The network connection is NOT necessary at all for generating OTAC.

Reducing an authentication stage that requires the network connection directly means there are fewer gateways forthe hackers to access our personal information.

Moreover, this feature enables usersto authenticate even when they arein networkless environments, suchas on the plane, underground, rural or foreign areas.

swIDch can guarantee that the code never duplicates with anyone
at any given moment.

There is NO chance of someone else having the same code.

The users or their devices can be identified with the code alone.

Once OTAC has been generated, providing OTAC alone is already fully sufficient to identify the user as the code is unique.

It means, you can forget about the bundles of static information including IDs and passwords.