What is OSDP?

OSDP stands for Open Supervised Device Protocol. OSDP is a 2-way command-response protocol for use between a credential reader and access controller. The protocol is designed to run over RS-485. SIA's OSDP Technical Subcommittee also plans to deploy OSDP over IP in the future.

OSDP v1 refers to the initial OSDP protocol, which was privately developed before rights to the specification were transferred to SIA. All OSDP iterations starting with v2 were developed under SIA's guidance by the OSDP Technical Subcommittee, and include Secure Channel encryption plus features such as support for biometric readers.

The Security Industry Association (SIA) owns OSDP; no individual company owns it. OSDP v2 was developed by SIA and the OSDP Working Group, now known as the OSDP Technical Subcommittee.The OSDP Technical Subcommittee, which continues to advance OSDP, is part of the larger SIA Standards Access Control & Identity Subcommittee. The group includes engineers, product developers, specifiers, and other security professionals.

Cypress is committed to OSDP due to the longtime need for a capable Wiegand replacement. Cypress Founder Tony Diodato spent years developing solutions to address the many shortcomings of Wiegand, including lack of supervision, distance limitations, installation requirements, and overall lack of features. Wiegand brought order to the early “Wild West” days of access control, but a more advanced standard was required to keep up with industry needs.Tony's firsthand insights led him to become a proponent of the OSDP protocol and a contributor to the OSDP Working Group (later renamed the OSDP Technical Subcommittee). In 2019, Tony served as co-chair of the group; today Cypress CEO Jon Uren serves as the OSDP Technical Subcommittee's vice chair.Cypress OSDP-Wiegand Converters were the first on the market in 2015. Since then, Cypress has developed OSDP solutions such as the OSDP Cable Test Tool, OSDP Splitters, a Wireless Reader Extender for OSDP and Wiegand readers, an OSDP Tool Kit, and other problem-solving OSDP accessories.

While a secure reader protects data exchanged between the credential and reader, the reader cannot protect data when it sends the data to the access controller.Securely transmitting access control data is a two-step process. The first step is ensuring data is securely transmitted between the credential and the reader. The second step is equally critical: ensuring the data remains secure as it moves from the reader to the controller.OSDP's encryption, authentication and supervision protects the data between the reader and the controller.

OSDP v2 with Secure Channel currently has an AES-128 encryption and authentication scheme with initialization messages and keys, to ensure communication takes place strictly between intended parties and to hide the data exchanged between the reader and the controller. Wiegand, the previous de facto access control standard, is an interface without encryption, authentication or supervision.

Yes, OSDP is much more secure than Wiegand. OSDP with Secure Channel communication currently uses AES-128 encryption and authentication to prevent “eavesdropping” on the data connection. With OSDP Secure Channel, data is encrypted and is never transmitted the same way twice, making it virtually impossible to listen in on the connection.Wiegand sends data from the reader to the controller without encrypting the data, and cannot ensure that communication happens strictly between the intended parties. In addition, Wiegand does not detect reader malfunctions or vandalism, since it lacks 2-way communication and supervision.

OSDP v2 with Secure Channel currently has an AES-128 encryption and authentication scheme with initialization messages and keys, to ensure communication takes place strictly between intended parties and to hide the data exchanged between the reader and the controller. The keys are 128 bits (or 16 bytes) as dictated by AES-128 encryption.

The Wiegand interface is known to be vulnerable to man-in-the-middle attacks. The vulnerability is due to the lack of encryption and authentication in the Wiegand specification, which was developed in the 1970s, before hacking technology became smaller, cheaper, easily available, and prior to an era when information was readily available online.With the Wiegand interface, data sent from the reader to the controller is transmitted “in the clear” without any way to conceal the data from threat actors. An attack can be quickly launched at the reader, allowing credential data to be skimmed to spoof the system, open access doors or gates, and deny access to legitimate credential holders.The entire attack can be carried out without the Wiegand reader ever going offline and without the control panel receiving any notification, since Wiegand also lacks supervision.OSDP is not subject to the Wiegand vulnerability, thanks to its encryption, authentication, and supervision, although it is critical to use Secure Channel. In 2023, the Security Industry Association issued recommendations for using OSDP Verified devices and ensuring that OSDP is properly installed, including the use of Secure Channel. The recommendations were issued following an in-depth review of Bishop Fox findings on possible implementation vulnerabilities.

Yes, a Wiegand system may be retrofitted to use OSDP. A common strategy is to first identify high-security access points to install OSDP readers, and install converters that enable the OSDP reader to interface with the Wiegand panel. A best practice is planning one-to-one reader replacements when using existing cable. An OSDP controller, cabling, and additional OSDP readers can be added in later phases.Cypress offers the OSM-2400 or the OSM-CPI OSDP-Wiegand converters to securely connect the OSDP reader and Wiegand panel. The OTT-2100-2 OSDP Cable Test Tool is useful to ensure existing cable will support OSDP. The OTT-KIT1 Test Tool Kit includes the cable testing tool along with a trace tool, hub, and Data Wedge. The SPX-5631 can be used to wirelessly connect OSDP or Wiegand readers.

Yes. Cypress Wiegand and OSDP Data Splitters can connect one reader to two panels, or to an access-control system plus a non-access system such as an alarm, key cabinet, elevator, or time-and-attendance system.

Yes. A Cypress OSM-RCI or OSM-2400 can connect a Wiegand reader to an OSDP panel. An OSDP reader is preferred when available, but conversion is useful for specialty readers that do not have an OSDP model.

Yes. A Cypress OSDP Splitter such as the ODM-2015 can connect one OSDP reader to both an OSDP system and a Wiegand system.

Yes. A Cypress OSM-2400 or OSM-CPI converts credential data from an OSDP reader to Wiegand for the panel and converts the controller signal I/O into OSDP messages for the reader. The field-side credential connection remains encrypted with OSDP Secure Channel.

Yes. A Cypress OSDP Splitter can connect an OSDP reader to an access control system and another system such as an alarm, key cabinet, elevator dispatch, or time-and-attendance system.

Yes. A Cypress OSM-2400 or OSM-CPI can connect an OSDP reader to a Wiegand panel, preserving an encrypted OSDP reader connection while allowing the existing controller to remain in service.

It depends. With new OSDP systems and sites with longer cable runs or multi-drop (daisy-chain) topology, the best practice is to use new cable suitable for OSDP. With retrofits where readers will be replaced on a 1-to-1 basis, cable can be tested to ensure it supports OSDP using the Cypress OTT-2100-2 OSDP Cable Test Tool.

OSDP allows readers and other peripheral devices to be installed up to 4,000 ft. from the controller, a big improvement over the 500 ft. distance at which Wiegand generally drops off. OSDP also supports multi-drop installations.The best practice for longer cable runs and daisy chaining is to install new cable suitable for OSDP. One length of 2-conductor cable can be daisy-chained to accommodate many readers connected to a single controller. With Wiegand, cable is run between each reader and the controller.

Yes. A Cypress OSDP I/O Extender (SPX-1400) supports a door strike, Request to Exit, and Door Position Sensor while the physical I/O is handled between the Central unit at the panel and Remote unit at the reader.

Yes. Cypress Reader Extenders place one unit at the panel and another at the reader, then carry communication over a more robust medium such as RS-485 twisted pair, fiber optic cable, TCP/IP, or wireless. Moving the system to OSDP is another option.

Cypress pioneered wireless reader extenders. The Wireless Suprex supports OSDP and Wiegand readers, is made in the USA, can be paired in the field, supports expansion pairs and connection supervision, carries a lifetime warranty, and is available for qualified product trials.

Yes. The Cypress OSDP Cable Test Tool (OTT-2100-2) sends OSDP traffic over existing cable at different baud rates and measures packet loss.

Yes. The passive Cypress OSDP Connection Hub (OSM-HUB) provides seven powered connection points and replaces temporary wire nuts or terminal blocks during testing and installation.

Yes. A Cypress OSDP Cable Test Tool (OTT-2100-2) can set addresses and baud rates for most manufacturers’ OSDP readers before or during installation.

The Security Industry Association implemented the OSDP Verified program to ensure devices are tested and meet criteria for the standard and listed profiles. For manufacturers internally testing products with other OSDP devices, as well as integrators and security professionals lab-testing OSDP systems, Cypress offers the OTT-KIT1 OSDP Test Tool Kit to streamline the process. The kit includes a Hub to simplify plugging and unplugging devices, a trace tool, cable test tool, and Data Wedge.

Yes. The Cypress OSDP Trace Tool (OTT-1100) visualizes OSDP messages between the controller and reader to support troubleshooting.

Yes, there is a minimal learning curve with OSDP, as with any new technology. While installing OSDP is different than installing Wiegand, top integrators have found it worthwhile to ensure their companies are well versed in OSDP.It is important to consider system capabilities, setting baud rates and device addresses, as well as enabling Secure Channel, as discussed here.SIA offers OSDP Boot Camps, which are instructor-led, hands-on training in OSDP design, configuration and implementation. ASIS CPE credits may now be earned by attending an OSDP Boot Camp.