VingCard Plus 4K Explained: Multi-Application AES Hotel Credential

VingCard Plus 4K is the high-security tier of VingCard's AES-secured 13.56 MHz guest credential, in the larger 4K memory size. "Plus" is the hardened credential ASSA ABLOY Global Solutions brought to its door-lock keys in 2024; the 4K size adds enough memory to hold multiple applications on one card — a guest room key plus, for example, cashless charging, spa or amenity access, parking, or loyalty data — each protected by the same AES cryptography.

VingCard has issued electronic hotel keys since the first recodable electronic keycard lock at the Westin Peachtree Plaza in Atlanta in 1978, and reintroduced Vingcard as its hospitality brand in 2024. Plus 4K is the multi-application, high-security member of that credential family, read by Signature RFID locks and managed by Visionline on-premise or Vostio in the cloud.

VingCard Plus 4K secures multiple applications by giving each one its own place in an AES-protected memory structure and authenticating with per-card diversified keys. The card and lock perform 128-bit AES mutual authentication before any application is accessed, and a cipher-based message authentication code (CMAC) protects every command and response so data cannot be silently altered in transit.

This per-application, per-card key separation is exactly why a multi-application card can be trusted: the loyalty or cashless application cannot be repurposed to forge the room-access application, because each is gated by different keys. A secure-messaging mode encrypts the exchange over the air, and an optional randomized ID stops the card from being tracked by a fixed serial. The underlying AES credential tier is certified to Common Criteria EAL3+.

The choice between VingCard Plus 4K and Plus 2K is about application capacity, not security level — both are high-security AES credentials on the same 13.56 MHz standard. Plus 4K earns its place when one card must do more than open a door.

VingCard introduced its AES high-security credential in May 2024 to move hotels off legacy access technologies and onto a modern cryptographic key. Richard Eastburn, Vingcard's Sr. Director and Head of Product Management, said the change lets "Vingcard lock solutions continue to represent ultimate guest peace of mind," and an industry executive framed it as "a more secure contactless way to transition away from legacy access technologies."

The reason is the weakness of the older credentials. Legacy 125 kHz proximity cards broadcast a fixed number with no encryption, and earlier 13.56 MHz guest cards were issued with "no sector crypto" — no per-sector encrypted authentication. For a property consolidating many services onto one credential, the AES protections of Plus 4K are what make putting cashless and loyalty data on the same card defensible.

VingCard Plus 4K is provisioned and revoked through the property's back end — Visionline on-premise or Vostio Access Management in the cloud. The multi-application layout is defined in software: the operator decides which applications live on the card, the encoder writes them under their AES keys, and Signature RFID locks validate the room-access application at the door while other systems read their own applications.

ASSA ABLOY's documented direction moves backend management from on-premise Visionline to cloud Vostio, which adds remote key issuance, property-management and third-party integrations that can populate the extra applications, and mobile keys over BLE and NFC on the same Signature readers. Plus 4K is the physical high-capacity credential inside that workflow.

A VingCard Plus 4K card holds each of its applications behind 128-bit AES mutual authentication with per-card diversified keys and a CMAC on every exchange, so the data is not exposed as a plain readable serial during a normal read. Reproducing the credential, or any single application on it, would require the site-specific diversified keys held inside the property's system.

The honest position for any hotel is that clone-resistance depends on key management rather than on the card blank. A Plus 4K credential run with properly managed site keys and current locks reflects the security model VingCard designed; the risk on a property lives wherever legacy, unencrypted guest cards are still in service. Consolidating services onto a hardened multi-application card only helps if the keys behind it are managed well.

VingCard Plus 4K sits alongside mobile keys on the same VingCard system rather than competing with them. The Signature RFID locks that read the Plus 4K card also support mobile access over BLE and NFC through Vostio, so a property can offer phone-based keys while issuing high-security multi-application cards to guests or staff who need the physical credential.

Because both the Plus 4K card and the mobile key are managed by the same Vostio back end, a property can mix them by use case: a phone key for a repeat guest who opted in, a Plus 4K card for a suite that also unlocks cashless spend and amenities. The multi-application capacity is a property of the physical card; mobile keys carry the room-access function on the same readers.