Architecture and Performance Evaluation of Real-Time Facial Recognition for Access Control ^†

Abstract

The current study presents the design, implementation, and evaluation of a real-time face recognition system for automated access control. The system uses Python libraries to build an accurate and secure identification platform that incorporates dedicated stages for facial data processing and recognition. During data preparation, 128-dimensional facial embedding vectors are generated for authorized users through a command-line interface and protected using authenticated encryption. In real-time operation, the system captures video frames, detects faces, and verifies identities by matching them against the encrypted database. Experimental results demonstrate high recognition accuracy, real-time throughput, and robust performance, highlighting the system’s suitability for GDPR-oriented deployment in small institutional environments.

1. Introduction

The advances in computer vision observed in recent years are largely due to convolutional neural networks (CNNs), which learn hierarchical visual representations from low-level edges to high-level semantic features directly from data. Deep learning was widely demonstrated by AlexNet’s groundbreaking results in the ImageNet challenge, which accelerated the adoption of deep learning in vision-related tasks [1,2,3] and enabled practical pipelines for face recognition [4]. Video capture is handled by OpenCV [5] while embedding extraction and matching are performed by the face_recognition/dlib pipeline. In this approach, facial appearance is represented as a compact 128-dimensional embedding vector, enabling similarity-based matching in an embedding space—an approach closely related to deep metric learning [4]. This paradigm was popularized by systems such as FaceNet, which introduced a unified embedding representation for face verification and clustering in a compact vector space.

Face recognition has shifted from traditional feature-based methods that rely on handcrafted descriptors and statistical models (e.g., HOG-style pipelines) [5,6,7] to deep learning approaches based on CNN representations. In modern systems, identity discrimination is commonly achieved through learned embedding spaces and metric learning, with FaceNet being a representative example.

Recent surveys have reported the robustness advantages of embedding-based approaches under real-world variability, such as pose, illumination change, and occlusions. In real-time systems, practical solutions typically balance reliability and computational complexity by mixing face detection and embedding representation extraction. This trade-off is particularly relevant in access control applications, where system latency and throughput directly impact usability.

GDPR classifies biometric data used for identification as special category data, requiring strict safeguards and lawful grounds for processing [8]. Key management guidelines such as NIST SP 800-57 emphasize security key storage and the need for a clear governance framework [9]. Moreover, 2D camera systems are vulnerable to presentation attacks, which motivates the integration of liveness detection mechanisms; for example, blink detection based on facial landmarks [10,11,12,13].

The paper investigates the design, implementation, and evaluation of a real-time face recognition system for school access control, including entrance control, attendance support, and zone-based access. We evaluate its recognition effectiveness and real-time performance, and discuss deployment limitations related to spoofing risks, GDPR-oriented governance requirements, and the management of registered identities.

It is also possible to consider the proposed system a supporting component of a secure learning environment where access control, biometric data processing, and trusted operation are closely related. The study is relevant to studying secure environments and interfaces for using secure and trusted data in educational settings, especially where sensitive personal information and controlled access policies must be managed together.

2. System Architecture and Implementation

The proposed system is designed as two phases: an encoding phase for creating a database of facial embeddings (database construction), and a real-time recognition phase (decision-making) for performing live recognition from a webcam or USB camera stream. This separation reduces computational overhead during live operation and enables administrators to update the enrolled identities only when needed. Conceptually, the system consists of four main modules: identity and dataset management, embedding database generation, secure storage and loading of embedding, and real-time recognition with policy-based authorization decisions.

2.1. Encoding Phase and Identity Management

The encoding phase is implemented in Python 3.10 scripts and follows an administrative-oriented workflow that combines identity management with the construction of an embedding database.

The developed tool provides a command-line interface (CLI) for listing the currently registered identities, registering a new identity while automatically creating the corresponding enrollment dataset directory, and deregistering an identity by identifier or by index list. In this way, the enrollment set can be updated in a controlled and consistent manner.

The encoding workflow is summarized in Algorithm 1 and illustrated in Figure 1.

Algorithm 1: Encoding phase

Input: RegistrationList: {(name, images)} Output: EncodingsFile (encrypted KnowledgeBase) 1. Initialize empty KnowledgeBase (Names, Encodings) 2. for each (name, images) in RegistrationList do 3.      for each image in images do 4.        embedding ← ComputeFaceEmbedding (image) 5.                 Store (name, embedding) in KnowledgeBase 6.        end for 7. end for 8. Encrypt KnowledgeBase using secret key 9. Save encrypted KnowledgeBase to EncodingsFile

Figure 1. Workflow of the encoding and identity-management phase.

After each registration update, the encoding procedure iterates over all registered identities and processes their registration images stored in an image store for each identity. For each image, the system performs face localization and computes a 128-dimensional embedding vector using the face_recognition/dlib pipeline. Processing multiple images for each identity improves robustness to intra-class variability caused by changes in pose and lighting. In-memory embedding databases are created, paired with identity labels, then serialized for efficient loading and querying during the online recognition stage.

2.2. Secure Storage of Facial Embeddings

The serialized embedding database is protected using authenticated encryption (Fernet), which provides confidentiality and integrity for stored biometric representations. An access control interface in this architecture should not be interpreted solely as an authentication mechanism, but also as a security layer for the interaction between users and the educational environment. By securing stored facial embedding data, controlling database loading, and utilizing explicit authorization logic, sensitive data can be protected and used more safely in operational educational settings. During loading integrity, verification is performed prior to use, and if authentication fails, the database is not loaded, reducing the risk of working with corrupted or tampered data.

2.3. Real-Time Recognition and Access Decision

The recognition stage is implemented as a continuous real-time loop that processes frames from a webcam stream. When the system starts, it decrypts and verifies the information stored in the databases and loads the authorization policy needed to make access authorization decisions. For each captured frame, the system performs face recognition, computes a 128-dimensional embedding for each detected face, and compares the resulting vector to the registered information in the databases using a distance-based matching rule. A match is confirmed when the embedding distance falls below a configurable tolerance threshold. The access decision is then derived by combining the recognition result (matching identity or unknown) with the authorization policy for the target zone.

In addition to visual feedback on the video stream, the system optionally renders bounding boxes and labels with color-coded results (e.g., authorized, known but not authorized, and unknown). As this visualization is not required for system operation, it can be disabled when running in headless mode.

The real-time recognition procedure is summarized in Algorithm 2 and illustrated in Figure 2.

Algorithm 2: Real-time recognition phase

Input: VideoStream, EncodingsFile, AuthorizationList Output: Access decision (Grant/Deny) for each detected face 1. Load and decrypt KnowledgeBase from Encodings 2. Initialize camera stream 3. while VideoStream is active do 4.    frame ← ComputeFrame () 5.      faces ← DetectFaces (frame) 6.      for each face in faces do 7.         embedding ← ComputeFaceEmbedding (face) 8.                  match ← CompareWithDatabase(embedding) 9.                  decision ← ApplyAuthorizationPolicy(match, AuthorizationList) 10.                Display result and log access event 11.            end for 12. end while

Figure 2. Workflow of the real-time recognition and access control phase.

3. Results

All experiments were conducted on an Ubuntu laptop equipped with an Intel Core i5-8265U processor, 32 GB RAM, and an NVIDIA MX110 GPU. Live video was acquired using the laptop’s built-in webcam at default capture settings.

The tool does not require fixed camera parameters; in these experiments, the integrated laptop webcam at 720 p was used. CNN-based face recognition was performed using the face_recognition/dlib pipeline with the library’s default embedding distance tolerance τ.

The registration dataset consisted of 15 enrolled identities, each represented by approximately 15 images captured under different lighting conditions and poses. The system was evaluated against both registered identities and unknown faces during live operation using the laptop webcam.

The recognition stage relies on embedding-based matching, where a 128-dimensional embedding is computed for each detected face and compared to the database records. A match is confirmed when the embedding distance is below a tolerance threshold τ, which is set by default (face_recognition/dlib). Performance is reported using accuracy as well as operational metrics related to access control. The study defines the false acceptance rate (FAR) as the proportion of unauthorized/unknown attempts that are incorrectly accepted as authorized, and the false rejection rate (FRR) as the proportion of authorized attempts that are incorrectly rejected. Precision and recall are also reported for the class of “authorized” solutions to provide additional information on false positives and false negatives at the selected work point.

The system’s real-time capabilities were evaluated by measuring the average frame rate (FPS) while running a live webcam on the specified laptop hardware. FPS was measured while running on the CPU alone and with GPU acceleration (NVIDIA MX110) enabled to quantify the effect of hardware resources on real-time performance.

In order to evaluate the access control behavior, the recognition results are compared to a binary decision regarding the “authorized” class. Each decision is categorized as True Positive (TP), False Positive (FP), False Negative (FN), or True Negative (TN) (Table 1).

Table 1. Confusion-matrix definitions for access control evaluation (frame-level; positive class: Access Granted).

Ground Truth Authorization	System Design	Outcome	Interpretation
Authorized	Grant	TP	Correct acceptance
Authorized	Deny	FN	False rejection
Not authorized (unauthorized or non-enrolled)	Grant	FP	False acceptance
Not authorized (unauthorized or non-enrolled)	Deny	TN	Correct rejection

Based on the outcomes in Table 1, the evaluation metrics are computed as follows: accuracy = (TP + TN)/(TP + FP + FN + TN), precision = TP/(TP + FP), and recall = TP/(TP+ FN). For access control evaluation, we additionally report FAR = FP/(FP + TN) and FRR = FN/(FN + TP).

In this study, TP, FP, FN, and TN are accumulated at the frame level, i.e., each processed video frame yields one access control decision in the real-time loop (Table 1). The system produces three outputs (Granted, Denied, Unknown); for the calculation of metrics, Granted is mapped to Grant, while Denied and Unknown are mapped to Deny, according to the access control operation. The present evaluation reports metrics at the frame level because the prototype generates one recognition and access control decision for each processed video frame. However, in practical access control scenarios, a single access attempt usually consists of a short sequence of frames rather than an isolated frame. Therefore, future evaluation will extend the current methodology with identity-level and session-level metrics, where a decision is aggregated over multiple constructive frames belonging to the same access attempt. Such an evaluation would provide a more realistic estimate of false rejection rates in operational conditions.

To analyze the impact of enrollment data quality, three enrollment conditions were defined: high quality: well-lit portrait images captured with a Fujifilm X-T5 camera; medium quality: well-lit portrait images captured with a Samsung A52s smartphone camera; and low quality: images with challenging illuminations (high contrast), suboptimal angles, and reduced facial recognition size within the frame captured with a Samsung A52s smartphone camera.

Recognition performance was evaluated with a dataset of 15 enrolled identities; each represented approximately 15 source images taken under varied illumination and pose conditions. To quantify the impact of enrollment data quality, three enrollment conditions were considered: high, medium, and low-quality datasets, using the CNN detector. Table 2 presents the identification accuracy observed under this condition. The system was then tested against both these registered individuals and other unknown individuals.

Table 2. Impact of dataset quality on accuracy.

Dataset Quality	Number of Frames	Correct Identifications	Identification Accuracy
High Quality	2000	1960	98%
Medium Quality	2000	1880	94%
Low Quality	2000	1720	86%

For each condition, N = 2000 frames were sampled from live webcam capture sessions, and metrics are reported at the frame level.

Table 2 compares identification accuracy across the three enrollment-quality conditions defined above, confirming the degradation in performance when embeddings are computed from lower-quality enrollment images.

Figure 3a,b provide qualitative examples under comparable test conditions. Figure 3a illustrates an incorrect case when low-quality enrollment images are used to compute embeddings, while Figure 3b shows improved recognition behavior when embeddings are derived from high-quality enrollment images. These examples align with the trend observed in Table 2 and highlight the role of enrollment consistency for embedding stability.

Figure 3. Effect of enrollment image quality on recognition results: (a) incorrect recognition when low-quality enrollment images are used to calculate embeddings; (b) improved recognition under comparable conditions using embeddings computed from high-quality enrollment recording images. All images were collected with informed consent for research.

Table 3 compares the accuracy of the implemented system with the published benchmark performance of the dlib model [12]. While the controlled evaluation achieves near-benchmark accuracy, a modest decrease is observed during live testing, which can be attributed to real-world acquisition factors such as motion blur, sensor noise, and the quality limitations of the 720 p integrated laptop webcam. In our tests, the presence or absence of eyeglasses did not produce a noticeable change in recognition accuracy.

Table 3. Accuracy comparison against published benchmark results.

Dataset Quality	Number of Frames	Correct Identifications
dlib Model (LFW Benchmark)	99.38%	Controlled benchmark dataset
Our System (Controlled)	98%	High-quality dataset, tested on static images
Our System (Live)	~96–97%	Live video was acquired using the laptop’s built-in webcam with a 720 p input stream.

The current proof-of-concept remains vulnerable to basic presentation attacks. During testing, displaying a facial image of an enrolled subject on a smartphone screen in front of the camera could lead to false acceptance in some cases. This confirms that recognition accuracy alone is insufficient for deployment in security-sensitive scenarios. A practical software-based mitigation is the integration of liveness detection, for example, using Eye Aspect Ratio (EAR) analysis from facial landmarks; however, the computational overhead of such checks must be evaluated in relation to the real-time of the system [10].

Real-time throughput was evaluated by measuring the average processing speed in frames per second (FPS). Although the system achieved high identification accuracy, CNN-based face detection and embedding extraction imposed substantial computational requirements. When executed on the Intel i5-8265U CPU alone, the system achieved approximately 1 FPS, which is insufficient for practical real-time access control. Enabling GPU acceleration on the entry-level NVIDIA MX110 increased the throughput to approximately 4 FPS. This demonstrates the benefit of GPU offloading, but the achieved rate remains below the level typically required for responsive multi-user access control scenarios. Therefore, the current configuration is suitable primarily for proof-of-concept demonstrations and low-traffic settings, while higher-throughput deployment would require the computational power of the GPU hardware or additional software optimization The system is connected to continuous video processing and can be integrated into a network environment. Previous studies have shown the impact of UDP and TCP DoS attacks on the performance of real-time multimedia streams [14,15].

From the perspective of secure implementation in educational environments, these results show that recognition accuracy alone is not enough. The applicability of the system is also dependent on its ability to provide robust, timely solutions without compromising the security of biometric data processing. For this reason, education-oriented interfaces should consider both throughput and security constraints when evaluating them in educational environments (Table 4).

Table 4. Real-Time processing speed on various levels of hardware.

Processor	Hardware Tier	Average FPS	Possible Use Cases
Intel i5-8265U	Low-end CPU	1 FPS	Not recommended
NVIDIA MX110	Low-end GPU	4 FPS	Proof-of-concept use
NVIDIA RTX 2070	Mid-range GPU	~30 FPS	Small-large scale use
NVIDIA RTX 4070	High-end GPU	>60 FPS	Large-scale use

FPS values for the Intel i5-8265U CPU and NVIDIA MX110 GPU were measured directly in this study. RTX series values are indicative estimates based on published performance scaling trends in real-time detection benchmarks (e.g., YOLOv4) and are included to illustrate expected scaling rather than to report experimentally validated measurements.

From a scalability perspective, the current prototype is appropriate for small institutional deployment with a limited number of enrolled users and low traffic. As the number of enrolled identities increases, the matching stage may become more computationally demanding because each detected face must be compared against a larger embedding database. For larger user populations, the system would require optimized nearest-neighbor search, database indexing, stronger GPU support, and a deployment architecture that separates enrollment management, encrypted template storage, recognition processing, and audit logging. These aspects should be addressed before extending the system to high-throughput environments.

Security and Data-Protection Considerations

The results demonstrate that the proposed tool achieves promising recognition performance, but practical deployment in educational environments requires explicit treatment of biometric security, computational constraints, and GDPR-oriented governance. Under the GDPR, biometric data processed for identification is considered a special category of personal data and therefore requires stricter safeguards and a clear lawful basis for processing.

The tool protects the serialized embedding database using authenticated encryption, ensuring the confidentiality and integrity of stored embeddings under the assumption that the secret key remains protected. As an implementation detail, Fernet combines symmetric encryption (AES-128) with message authentication (HMAC-SHA256); therefore, database integrity is verified before decryption and use [16,17].

However, the identity registry, authorization lists, and raw registration images may require additional protection, access control, and data minimization measures during application deployment.

The security of a protected database depends strongly on the handling of the secret key. If the key is stored locally, compromising the host device could allow decryption of embedded files. Deployment-level operations should therefore adopt stronger key-management mechanisms, such as hardware-backed storage, managed key vaults, and least-privilege access policies [18,19].

The prototype also remains vulnerable to basic presentation attacks, such as photos displayed on a smartphone. Mitigation requires liveness verification or multi-factor authentication. Blink-based liveness detection-based EAR is a feasible software option, but its computational cost must be evaluated in relation to the limited FPS observed on low-end hardware.

The system should also maintain tamper-proof logs for access decisions and administrative actions. Local clear-text logs can be modified by privileged users; therefore, append-only logs or remotely stored logs are recommended to support accountability. In the school context, biometric identification additionally requires transparency, retention, and deletion workflows, and, where applicable, a Data Protection Impact Assessment (DPIA). For this reason, the current prototype should be interpreted as a technical feasibility rather than as a complete GDPR-ready deployment.

4. Conclusions

This paper presented the architecture, implementation, and experimental evaluation of a real-time facial recognition tool for access control. The main architectural contribution is the separation of the system into two operational phases: an offline encoding phase for identity registration and encrypted embedding database generation, and an online recognition phase for live face detection, embedding comparison, and policy-based generation, and an online recognition phase for live face detection, embedding comparison, and policy-based access decisions. This separation reduces the computational burden during live operation and allows the enrollment database to be updated only when the set of registered users changes.

The implemented prototype combines CLI-supported identity management, embedding-based recognition, authentic encryption of biometric templates, and real-time access control feedback. The experimental results show enrollment image quality has a strong influence on recognition accuracy, with high-quality enrollment images producing the most stable results. Throughput evaluation further shows that CNN-based recognition is computationally demanding: the tested low-end CPU configuration is not suitable for real-time operation, while entry-level GPU acceleration improves performance but remains best suited for proof-of-concept or low-traffic scenarios.