Open Supervised Device Protocol (OSDP) – what you need to know about modern and future proof access control security?

Access control and management of trusted identities are the building blocks of security, safety, and site management policies for many businesses and organisations. The current pandemic has compounded this with the introduction of new policies and regulations, particularly around social distancing and contact tracing.

Most organisations will have some form of legacy access control in place, ranging from the most simplistic options, such as locks and keys, to technology-based systems. The issue with legacy systems of any type is that risks, just like technology, evolve. What was secure, convenient, and efficient a few years ago is often found wanting as the threat landscape changes.

The standards governing the development and testing of physical access control systems (PACS) have also evolved to improve security and product interoperability. An example is the Open Supervised Device Protocol (OSDP), introduced 10 years ago as an alternative to the antiquated and vulnerable Clock-and-Data and Wiegand protocols. However, when it comes to planning infrastructure upgrades or implementing new tools, businesses must carry out due diligence to ensure the solutions are future-proof and deliver the expected level of security.

Vulnerabilities and challenges

In the early 1980s, Clock-and-Data and Wiegand protocols were widely adopted as the de-facto standard for interoperability between access control readers and physical access controllers. Those de-facto standards were later formalised and adopted into industry standards by the Security Industry Association in the 1990s.

Wiegand is unencrypted and unable to protect from “man in the middle” attacks and vulnerabilities 

There were weaknesses, though, Wiegand is unencrypted and unable to protect from “man in the middle” attacks and vulnerabilities from the reader to the controller. Not only that, but Wiegand delivers limited range options and is operationally inefficient. It is also easy to target via its learnable language and a host of hacking devices available via online sources.

Furthermore, the retrofitting installation alongside a legacy system is complicated for integrators and expensive for organisations, as most readers require dedicated home-run wiring. Extensive wiring on a large-scale project, such as a school or corporate campus, results in considerable — often prohibitive — costs for the installation of a PACS.

Legacy access control protocol

Despite the well-publicised vulnerabilities and weaknesses, Wiegand is still one of the most common protocols in legacy access control, with estimates indicating it is used in more than 90 percent of installed systems.

This not only presents issues about physical security but also raises concerns relating to the protection of personal data. Access control systems not only contain information about who can and cannot use certain doors.

OSDP is a communication standard

Modern systems include a wide range of personal data, ranging from qualifications and certifications of individuals, home contact details, and even medical conditions or HR and employment information. With the potential fines associated with GDPR breaches, companies need to take this concern seriously.

These weaknesses pushed the security industry to adopt a new protocol: Open Supervised Device Protocol (OSDP). This access control communications standard was developed by Mercury Security (now part of HID Global) and HID Global in 2008, and donated, free of intellectual property, to the Security Industry Association (SIA) to improve interoperability among access control and security products.

Since then, it has been adopted as a standard by SIA, becoming the first secure, bidirectional reader/controller protocol to be governed by a major standards body in the security industry. In 2020 OSDP reached an additional milestone in becoming an International Electrotechnical Commission (IEC) standard.

Why implement OSDP as a standard?

OSDP is the only protocol that is secure and open for communication between readers and controllers

The growth of networked devices, such as video and access control products, has led to an increased demand for converged solutions. Businesses and organisations recognise the value of implementing an integrated solution to enhance security and add value to technology investment.

OSDP is the only protocol that is secure and open for communication between readers and controllers and is also being widely adopted by industry-leading reader and controller manufacturers. It is an evolving, ‘living standard,’ making it a safer, more robust, future-proof option for governing physical access control systems. OSDP offers important benefits:

1) Increased security

Implementing OSDP standards can increase security, as OSDP with Secure Channel Protocol (SCP) supports AES-128 encryption that is required in U.S. federal government applications. Additionally, OSDP constantly monitors wiring to protect against tampering, removing the guesswork since the encryption and authentication are predefined.

2) Bidirectional communication

Early on, communication protocols such as Wiegand were unidirectional, with external card readers sending information one way to a centralized access control platform. OSDP has transformed the ability for information to be collected, shared, and acted upon with the addition of bidirectional communication for configuration, status monitoring, tampering, and malfunction detection, and other valuable functions. In fact, OSDP is the only open, non-proprietary, bidirectional, secure protocol for communication between card reader and physical access controller.

3) Open and interoperable

OSDP adds new technology that enhances its ability to protect incoming and outgoing data collection OSDP supports IP communications and point-to-point serial interfaces, enabling customers to flexibly enhance system functionality as needs change and new threats emerge. They also can proactively add new technology that enhances their ability to protect incoming and outgoing data collection through a physical access control system.

4) Reduced installation costs

OSDP’s use of two wires (as compared to a potential of 11 wires with Wiegand) allows for multi-drop installation, supervised connections to indicate reader malfunctions, and scalability to connect more field devices.

Daisy-chaining accommodates many readers connected to a single controller, eliminating the need to run home-run wiring for each reader, and the use of a four-conductor cable achieves up to 10x longer distances between reader and controller than Wiegand while also powering the reader and sending/receiving data.

5) User friendly

OSDP gives credential holders greater ease of use, with audio and visual feedback such as coloured lights, audible beeps, and the ability to display alerts on the reader.

For security administrators, managing and servicing OSDP-enabled readers also becomes increasingly convenient, as OSDP-enabled readers can be remotely configured from network-connected locations. Users can poll and query readers from a central location, eliminating the cost and time to physically visit and diagnose malfunctioning devices.

Unlimited application enhancements

OSDP streamlines installations and upgrades while saving organisations the expense of replacing readers 

OSDP supports advanced smartcard technology applications, including PKI/FICAM and biometrics, and other enhanced authentication protocols used in applications that require Federal Information Processing Standards (FIPS) compliance and interactive terminal capabilities. Audio-visual user feedback mechanisms provide a rich, user-centric access control environment.

OSDP offers advantages for users, administrators, and integrators, alike. It adds security and real-world efficiencies, and its interoperability ensures that organisations can use systems from numerous manufacturers as they invest in infrastructure that maximises the protection of critical data.

For our part, HID Global’s range of HID Signo readers is OSDP verified, ensuring they offer the intended interoperability and security for secure bidirectional communication and provide an easy migration from Wiegand devices. In a campus environment, OSDP streamlines installations and upgrades while saving organisations the expense of replacing readers if a new access control solution is implemented. There are also service and maintenance benefits as OSDP encourages continuous monitoring of system uptime and allows for remote configuration of -- or upgrades to -- a reader.

Cost savings upon system upgrade

Integrators can also capitalise on the introduction of OSDP by encouraging open standards, which can, in turn, help them build new customer relationships and win more projects.

Although upgrading to access control systems that adhere to OSDP standards is a significant initiative, the range of benefits outweighs the cost of upgrading. Increased security coupled with business efficiencies adds value for those administering the system and a high level of interoperability ensures users can deploy systems from numerous third-party manufacturers.

Integrators who understand the benefits of OSDP can also help their customers support both current and future technology requirements. When a site’s needs change, OSDP offers significant cost savings as the open functionality makes adding new devices easier and reduces the expense of requiring all readers to be replaced if a new solution is installed. Businesses and organisations transitioning to OSDP will also enhance value in terms of operational costs such as servicing and maintenance.