What is High-Security? A Guide to High-Security Access Control from ProdataKey (PDK)
High-security access control encompasses the technologies and practices used to protect facilities, users, credentials, and access-control infrastructure from unauthorized access and evolving security threats. Modern systems must address security at multiple levels, including credential technology, device communications, network connectivity, software, firmware, and continued operation during network disruptions.
This white paper examines the principal technologies and capabilities associated with high-security access control. It considers the security of credential-to-reader communication, reader-to-controller communication, firmware management, offline functionality, and multi-factor authentication. The white paper then examines how these principles are implemented within the Red™ high-security ecosystem from ProdataKey (PDK).
Encrypted Communication
Encryption is a fundamental component of a high-security access-control system. Security considerations apply to multiple communication points, beginning with the credential and reader and extending through the reader-controller connection and the network connection to the access-control management system.
Credential to Reader
The credential-to-reader interface is a primary security boundary because the credential is the first thing used to establish a user's authorization to enter a protected area. For this reason, it’s critical for credential-reader communication to be protected.
Physical credentials today offer varying degrees of security, related to their ability to encrypt information. Proximity credentials operate at a 125 kHz frequency and transmit relatively simple credential identifiers to readers. Because this low-frequency technology lacks modern encryption and authentication capabilities, credential data can be more susceptible to cloning and unauthorized duplication. Alternatively, high-security credential technologies operating at 13.56 MHz use encrypted authentication to establish trust between the credential and reader.
One example of such high-security credential technology is MIFARE DESFire, a 13.56 MHz contactless technology that supports encrypted authentication and communication.
DESFire EV2 and EV3 credentials incorporate security features that can be used to authenticate the credential and protect communications with a compatible reader. Rather than relying solely on a copyable identifier, the authentication process uses encryption keys and security information associated with the credential to protect information in transit.
Mobile credentials provide another approach to credential security. A smartphone can function as the user's access credential while taking advantage of security capabilities built into modern mobile devices. Bluetooth Low Energy (BLE) communication can support secure, encrypted connections when implemented with appropriate authentication and encryption protocols. Modern BLE implementations can also use device-level security features and protected connections to reduce the risk of unauthorized interception or credential duplication.
Together, encrypted physical and mobile credentials establish the first layer of protection in a high-security access-control system, and secure credential-to-reader exchange does the critical work of preventing unauthorized parties from obtaining or reproducing the information required to gain access.
Reader to Controller
The communication path between a reader and controller represents another important security boundary. Wiegand has historically been one of the most common reader-to-controller communication methods. However, Wiegand was designed as a basic data-transmission interface and does not provide the encryption, authentication, or supervision capabilities expected of a modern secure communications protocol.
As a result, Open Supervised Device Protocol (OSDP) was developed to provide a more capable communication standard for access control devices. OSDP supports AES-128 encryption, meaning that data transmitted between the reader and controller is protected. In addition to encrypting data, OSDP is also capable of wire monitoring, which helps to ensure that no tampering occurs.
In addition to encryption, OSDP supports RS485 bidirectional communication. The bidirectional nature of OSDP is significant from both security and operational perspectives. Rather than functioning solely as a one-way transmission of credential information, an OSDP connection allows the controller and reader to communicate with one another. This enables device monitoring and additional security functions that are not available through traditional Wiegand connections.
Automatic Firmware Updates
Security threats evolve continuously. Vulnerabilities can be discovered in device firmware, operating systems, communication protocols, and supporting software after an access control system has been installed and placed into service. Maintaining current firmware is consequently an important component of security management. However, the true effectiveness of a firmware update program depends on whether updates can be deployed consistently across the installed system.
Manual firmware updates can require service personnel to visit individual locations or devices. This can become increasingly difficult as the number of controlled doors and facilities grows. Automatic firmware updates can reduce this operational burden and allow security updates to be deployed more consistently. OSDP can contribute to this process by providing bidirectional communication between readers and controllers, through which firmware updates can be sent.
Keeping firmware current helps address newly identified vulnerabilities, improve device reliability, and introduce security enhancements as they become available.
Offline Functionality
Cloud connectivity provides centralized administration, monitoring, reporting, and system management. Access control decisions, however, may need to continue even when an Internet connection or other network service is temporarily unavailable. Network interruptions can result from service outages, infrastructure failures, maintenance, configuration problems, or other circumstances. A system that depends entirely on continuous cloud connectivity may be unable to perform normal access control functions during such an interruption. High-security access control architectures can address this issue by maintaining the information necessary for access decisions locally at the controller.
Under this model, the controller retains a local database containing relevant credentials, permissions, schedules, and other information required to determine whether an access request should be granted. The controller can then continue making decisions at the door without requiring a real-time connection to the cloud. Offline functionality also requires synchronization controls. When network connectivity is restored, the local controller should synchronize with the central management system so that changes to users, credentials, permissions, and schedules are incorporated into the local system.
Two-Factor Authentication
Two-factor authentication strengthens access control by requiring two distinct authentication factors rather than relying exclusively on a single credential.
The three commonly recognized authentication categories are:
Something you have: a card, key fob, smartphone, or other credential
Something you know: a PIN or password
Something you are: a biometric characteristic such as a fingerprint or facial characteristic
A keypad reader can provide an additional authentication factor by requiring a user to enter a PIN in conjunction with a physical or mobile credential. For example, a facility can require an authorized credential and a personal PIN before granting access. In this configuration, possession of a lost or stolen credential would not, by itself, satisfy the access requirement. Mobile credentials can also interact with the authentication mechanisms built into modern smartphones. Devices may require a passcode or biometric authentication before allowing the user to access applications or credentials.
Red™ High-Security from ProdataKey
The principles described above are incorporated into the Red high-security ecosystem from ProdataKey. The Red architecture combines high-security credentials, readers, controllers, wireless locking hardware, and cloud management within a unified access control platform.
Red Cloud Node
The Red Cloud Node provides the local connection between the PDK.io cloud platform and access control equipment installed at a facility. The Cloud Node functions as an on-site gateway while maintaining local system information and communicating with the PDK cloud through encrypted network connections. The architecture also supports continued local access control operation when Internet connectivity is interrupted.
Red Door Controllers
Red Door Controllers provide local access control processing and connect readers, locking hardware, and the broader PDK system. Red controllers support OSDP communication with compatible readers and incorporate Controller Continuity, allowing access decisions to continue locally when network or cloud connectivity is unavailable. ProdataKey’s Controller Continuity database uses AES-128 encryption with a unique key per controller, designed to protect credentials and other sensitive information from retrieval, including against reverse-engineering attempts.
PDK’s door controller design also incorporates a secure execution environment with firmware image signing and verification on every update.
Red Readers V2
The Red Reader V2 product family is responsible for reading and authenticating user credentials within the PDK system. The readers are available in mullion, single-gang, and keypad configurations. Red Reader V2 supports multiple credential technologies, including Bluetooth, proximity, and 13.56 MHz high-security credentials. OSDP provides the communication path between the reader and compatible controller—guaranteeing encrypted communication and firmware updates around the clock. The keypad form factors also support PIN-based authentication, allowing organizations to implement an additional authentication factor where desired.
Red Wireless Locksets
Red Wireless Locksets extend PDK’s Red technology to wireless openings. The product family includes cylindrical, deadbolt, and interconnected varieties and communicates through PDK's wireless infrastructure, HubNet. The locksets support the credential and authentication options available within the Red ecosystem, including high-security credentials, mobile credentials, Bluetooth, proximity, and PIN-based authentication.
Red Credentials
Red Credentials provide the physical credential component of the Red high-security system. They use 13.56 MHz MIFARE DESFire EV2 technology to provide encrypted authentication between the credential and compatible readers. Available form factors include cards and key fobs. The use of MIFARE DESFire technology provides a higher level of credential protection than traditional unencrypted proximity technologies by incorporating encrypted authentication rather than relying solely on a static credential identifier.
Red Credentials are designed specifically for use with the Red High-Security Readers V2 and Wireless Locksets.
Mobile Credentials
Mobile Credentials available in the PDK Access app provide an alternative to physical cards and key fobs by allowing supported smartphones to function as access credentials. PDK's Bluetooth credentials utilize the encrypted communications and the security capabilities of modern mobile devices. Mobile credentials can also simplify credential administration by allowing credentials to be assigned and managed digitally through PDK.io.
A Layered Approach to High-Security Access Control
High-security access control requires consideration of the complete system architecture. Credential security, reader-to-controller communication, network encryption, firmware management, local access decisions, and authentication methods each address different aspects of the security and reliability requirements of a modern access control system.
The Red high-security ecosystem from ProdataKey incorporates these capabilities across its hardware and software architecture. Red Credentials use MIFARE DESFire technology for encrypted credential authentication. Red Readers V2 use OSDP for secure reader-to-controller communication. Red Door Controllers provide local access control decision-making and Controller Continuity, while the Red Cloud Node connects the local system to centralized cloud management. The architecture also supports OSPD-enabled automatic firmware updates, encrypted local data, mobile credentials, keypad-based authentication, and wireless locking hardware.
These capabilities provide multiple layers of protection across the access control system. Each layer addresses a specific security or operational requirement, from protecting the credential presented at the reader to maintaining access decisions during network interruptions and keeping deployed devices current as security requirements evolve. For organizations evaluating high-security access control, these technical characteristics provide a framework for assessing how a system protects credentials, communications, devices, data, and access control operations throughout the system lifecycle.
ProdataKey (PDK) is a leading provider of cloud-based access control solutions, delivering secure, scalable, and innovative technologies for organizations across North America and beyond. The company’s PDK.io cloud platform and PDK Access mobile application provide centralized system management and control from virtually any web-connected device, enabling organizations to efficiently manage access, security, and operations across their facilities and portfolios.
With hundreds of thousands of active devices protecting millions of people around the world, PDK combines enterprise-grade security, reliability, and data privacy with an intuitive user experience. By unifying cloud-based management with innovative access control technology, PDK empowers organizations to modernize physical security, streamline operations, and confidently scale their access control infrastructure.
