Q. What is OSDP? What is the meaning of the OSDP name? What do PD and ACU mean?

A. OSDP stands for Open Supervised Device Protocol. OSDP is a secure, supervised, interoperable, and highly functional protocol that has replaced Wiegand as the official access control protocol of the Security Industry Association (SIA). 

OSDP is a 2-way command-response protocol for use between a credential reader and access controller, and was designed to run over RS-485 cable. The OSDP Working Group also aims to deploy OSDP over IP in the future.

In 2020, the OSDP protocol became an international standard (IEC 60839-11-5) after attaining the approval of the International Electrotechnical Commission. 

SIA recommends broad adoption of OSDP, especially in high-security settings. 

The terms peripheral device (PD) and ACU (access control unit) are frequently used in OSDP discussions.

Q. Who owns OSDP? Who developed OSDP?

A.  The Security Industry Association (SIA) owns OSDP; it is not owned by any company. While the earliest version of OSDP was jointly developed in 2008 by HID Global, Mercury, and Lenel, ownership of the specification was transferred to SIA in 2012. 

OSDP v2 was developed by SIA and the OSDP Working Group. 

The OSDP Working Group, part of the larger SIA Standards Access Control & Identity Subcommittee, is a group of engineers, product developers, specifiers and security professionals who continue to advance OSDP.

Q. Why is Cypress committed to OSDP? Why should I use OSDP?

A.  Cypress is committed to OSDP due to the longtime need for a capable Wiegand replacement. Cypress Founder and CTO Tony Diodato spent years engineering solutions to address the many shortcomings of Wiegand: Wiegand’s lack of supervision, its distance limitations, its installation requirements, and its overall lack of features. Wiegand brought order to the early “Wild West” days of access control but did not keep up with industry needs. 

Tony’s firsthand insights led him to become a proponent of the OSDP protocol and a contributor to the OSDP Working Group. In 2019, Tony was named co-chair of the OSDP Working Group, alongside Steve Rogers of IQ Devices. Cypress also develops OSDP solutions such as the first OSDP-Wiegand Converter on the market, the pluggable OSDP Hub for testing, the OSDP In-Panel Interface, the Embedded OSDP Module that allows reader manufacturers to support OSDP, and other OSDP devices (link to OSDP products page).

Download the free fact sheet, “Why use OSDP instead of Wiegand?” 

Q. What is the difference between OSDP v1 and OSDP v2?

A.  OSDP v1 refers to the initial OSDP protocol, which was privately developed before rights to the specification were transferred to SIA. All OSDP iterations starting with v2 were developed under SIA’s guidance by the OSDP Working Group, and include Secure Channel encryption plus features such as support for biometric readers. 

All products with the OSDP Verified mark, which signifies that the products have met SIA’s independent conformance testing requirements, use OSDP v2. Since OSDP v1 products are now difficult to source, the more relevant issue is choosing an OSDP Verified product. 

Q. What is OSDP Verified certification?

A. A product that is OSDP Verified has passed independent conformance testing. SIA founded the OSDP Verified program in 2020 to validate devices conforming to the SIA Open Supervised Device Protocol (OSDP) standard and related performance profiles. 

See also: OSDP & interoperability.

Q. Is OSDP more secure than Wiegand?

A. Yes, OSDP is much more secure than Wiegand. OSDP with Secure Channel communication uses AES-128 encryption and authentication to prevent “eavesdropping” on the data connection. With OSDP, data is encrypted and is never transmitted the same way twice, making it virtually impossible to listen in on the connection.

Wiegand, however, sends data from the reader to the controller without encrypting the data, and without any way to ensure only the intended parties are communicating. In addition, a Wiegand system cannot detect reader malfunctions or vandalism, since Wiegand lacks 2-way communication and supervision.

The Security Industry Association (SIA) recommends broad adoption of OSDP, especially in high-security and government settings. OSDP meets federal access control requirements, such as PKI for FICAM.

See also: Wiegand vulnerability, OSDP encryption, Secure credentials or OSDP, Secure Channel & keys and OSDP supervision.

Q. What is the Wiegand vulnerability? Does the vulnerability affect OSDP?

A. The Wiegand interface is notoriously vulnerable to man-in-the-middle attacks. The vulnerability is due to the lack of encryption and authentication in the Wiegand specification, which was developed in the 1970s, before hacking technology became smaller, cheaper, easily available, and before information was readily available online.

With the Wiegand interface, data sent from the reader to the controller is transmitted “in the clear” without any way to conceal the data from threat actors. In less than one minute, an attack can be launched at the reader, allowing credential data to be skimmed to spoof the system, open access doors or gates, and deny access to legitimate credential holders.

The entire attack can be carried out without the Wiegand reader ever going offline and without the control panel receiving any notification, since Wiegand also lacks supervision. 

OSDP is not subject to the Wiegand vulnerability, thanks to its encryption, authentication, and supervision.

Q. Is OSDP encrypted? Is Wiegand encrypted?

A. OSDP v2 with Secure Channel has an AES-128 encryption and authentication scheme with initialization messages and keys, to ensure communication takes place strictly between intended parties and to hide the data exchanged between the reader and the controller. Wiegand, the previous de facto access control standard, is an interface without encryption, authentication or supervision.

See also: Is OSDP secure?

Q. What is Secure Channel? What does SCBK mean? How do I load keys?

A. OSDP v2 with Secure Channel has an AES-128 encryption and authentication scheme with initialization messages and keys, to ensure communication takes place strictly between intended parties and to hide the data exchanged between the reader and the controller. The keys are 128 bits (or 16 bytes) as dictated by AES-128 encryption. 

All OSDP devices have a known default Secure Channel Base Key (SCBK), per the OSDP spec. The SCBK is a key shared by the peripheral device / reader and the controller, which is used once to initiate the encryption. The SCBK allows the panel to send a challenge command (vital information that the peripheral device can use to begin the “handshake” process and initiate a Secure Channel session). Note that OSDP security is not limited to the Secure Channel Base Key; the SCBK is used just once at the start of the session before special session keys are generated and used to encrypt the OSDP data.

An important part of setting up an OSDP installation is properly configuring the SCBK in the controller and the reader or peripheral device. Each reader should have its own, unique SCBK. The SCBK should be loaded into the reader out-of-band, meaning the reader is directly connected to the controller over a few feet of wire and not connected to the OSDP network.

Q. If the reader is already secure, why do I need OSDP?

A. A secure reader protects data exchanged between the credential and reader, but the reader cannot protect data as it travels to the access controller.

Securely transmitting access control data is a 2-part process: think of the data as a letter that is first taken to the post office, before the letter is loaded on a truck for delivery. 

After data is sent from the credential to the reader, the data is then sent from the reader to the controller. In high security areas, it is critical to secure data at both points: at the credential-to-reader connection, and the reader-to-panel connection.

OSDP’s encryption, authentication and supervision protects the data between the reader and the controller; Wiegand does not protect the data.

Q. Does OSDP communicate differently than Wiegand? Why does it matter?

A. Since Wiegand is a simple 1-way interface, the reader sends out data to the controller, without any assurance that the data reaches the controller, and the controller has no way to supervise the connection. OSDP, however, is a 2-way (bi-directional) protocol, which allows the end devices to have a conversation.

OSDP is a command-response protocol: The panel issues commands to the reader and the reader responds with updates such as credential data, or the I/O states of LEDs, buzzers, or tamper. 

The 2-way communication (and other aspects of OSDP) allows for much greater functionality than Wiegand. For example, OSDP supports a file transfer feature for remote updates, allowing configuration and firmware update files to be sent from the panel, instead of requiring a technician to physically remove each reader from the wall.

Q. Why is OSDP supervision important? Does Wiegand have supervision?

A. OSDP has 2-way communication to supervise and constantly monitor the connection to alert the controller if the reader is tampered with, malfunctions, or loses power. Since Wiegand is a simple interface with 1-way communication, there is no way of knowing if the controller has lost contact with the reader. 

Q. Are there other OSDP-Wiegand differences? How does OSDP compare to Wiegand in terms of functionality?

A. OSDP is much more advanced and functional than Wiegand. For example:

• OSDP supports protocol messages for commands such as turning on an LED; Wiegand requires I/O wires
• OSDP supports a file transfer feature for remote updates, allowing configuration and firmware update files to be sent from the panel, instead of requiring a technician to physically remove each reader from the wall
• OSDP supports 1024 bits of credential data to accommodate larger formats; Wiegand data formats are usually 200 bits or less
• OSDP supports a variety of baud rates to best suit a network, allowing many readers or longer cable runs, for example
• Biometrics: OSDP biometric readers can be installed similar to any OSDP reader using 2-wire RS-485; no Ethernet or PoE connection is required, and functionality/data is handled with specific OSDP protocol messages, thanks to 2-way data and greater bandwidth than Wiegand

Q. Can I use OSDP devices from different manufacturers? Can all OSDP Verified devices be mixed & matched?

A.  The OSDP protocol was designed to enable interoperability between devices from different manufacturers. This is why OSDP is recommended as a replacement for proprietary RS-485 protocols which may be more secure than Wiegand, but cannot be mixed with devices from other manufacturers to best suit the application.

SIA implemented the OSDP Verified program to ensure devices are tested and meet critieria for the standard and the listed profiles. SIA notes that there are still design considerations that an implementer must account for when deploying a SIA OSDP system.

Q. Why use OSDP instead of Wiegand?

A. The Open Supervised Device Protocol (OSDP) has replaced Wiegand as the Security Industry Association's standard for many reasons. For example:

• OSDP v2 with Secure Channel is a true protocol with encryption and authentication for robust security, while Wiegand lacks encryption and authentication
• OSDP has 2-way communication for supervision, remote maintenance and enhanced functions, while Wiegand is a simple 1-way interface without supervision or OSDP’s functionality
• OSDP is designed for interoperability
• OSDP was approved as an international standard in 2020 by the International Electrotechnical Commission (IEC 60839-11-5)

For an expanded list of differences between Wiegand and OSDP, download the free OSDP v Wiegand fact sheet.

Q. Is it possible to retrofit a Wiegand system to use OSDP in a phased installation?

A. Yes, a Wiegand system may be retrofitted to use OSDP. A common strategy is to first identify high-security access points to install OSDP readers, along with converters to allow the OSDP reader to interface with the Wiegand panel. Cypress offers the OSM-1000 or the OSM-CPI OSDP-Wiegand converters for use at the panel to secure the cable run with OSDP Secure Channel. More OSDP readers and an OSDP panel can be added in later phases.

Q. Do you need special OSDP RS-485 cable to install an OSDP system?

A. The short answer: It depends. Generally when we speak with customers retrofitting a Wiegand panel with an OSDP reader plus our converter, they can reuse existing cable, since the distance is generally less than 500 feet. The farther the cable run, the more suitable the cable needs to be to the needs of OSDP (RS-485). OSDP-specific cable will do the job very well though, and is especially worth considering for a new installation with longer cable runs between readers and the controller. 

Q. How far from an OSDP panel can I install an OSDP reader? Does OSDP allow for multi-drop installations?

A. OSDP allows readers & other peripheral devices to be installed up to 4,000 ft. from the controller, a big improvement over the 500 ft. distance at which Wiegand generally drops off. OSDP also supports multi-drop installations. One length of 2-conductor cable can be daisy-chained to accommodate many readers connected to a single controller. With Wiegand, each reader/peripheral device must be wired all the way to the panel. 

See also: OSDP wiring.

Q. Is there a learning curve with OSDP? If so, where can I find OSDP training?

A. Yes, there is a minimal learning curve with OSDP, as with any new technology. While installing OSDP is different than installing Wiegand, top integrators have found it worthwhile to ensure their companies are well versed in OSDP. SIA offers OSDP Boot Camps, which are instructor-led, hands-on training in OSDP design, configuration and implementation. ASIS CPE credits may now be earned by attending an OSDP Boot Camp. 

Q. How do I find reputable OSDP devices? Is there an OSDP testing process?

A. The Security Industry Association implemented the OSDP Verified program to ensure devices are tested and meet critieria for the standard and listed profiles. For manufacturers internally testing products with other OSDP devices, as well as integrators and security professionals lab-testing OSDP systems, Cypress offers the OSM-HUB test tool to streamline the process. The Hub allows devices to be plugged into ports, instead of wiring devices using a busbar, terminal blocks or wire nuts.