Well, use fingerprint scanner + password:) I'm not joking - saw some good implementation of scanners, that give DO signal on output. As you have PLC you can use one of DIs in combination with password that should be enough.
Of course you can use any alternative solution like token with AES crypto algo, but a bit harder to implement....