Campus access control systems are built to answer the seemingly straightforward question, “Should this person be allowed through this door?”

But before the system can make that decision, it first must answer the question, “Is the credential itself legitimate?”

That is the precise question the Public Key Open Credential standard was designed to answer, and it does it without a shared secret.

PKOC (pronounced “peacock”) is designed to standardize how a credential authenticates itself to a reader using public-key cryptography. It was developed by the Physical Security Interoperability Alliance, a global consortium of companies in the access control space that work together to create industry standards.

At its core, PKOC is the layer that can sit between the credential and the reader allowing each to determine the other’s legitimacy.

At its core, PKOC is the layer that can sit between the credential and the reader allowing each to determine the other’s legitimacy. It handles this initial step in an access control transaction. It does not, however, replace the campus access control system or the rules that determine who can enter a building.

Authentication versus authorization

Consider a student entering a residence hall.

The credential first has to prove that it is legitimate. Once the credential has been authenticated, then the existing campus access control system can determine whether it is authorized for that particular residence hall, at that particular time.

“Once the reader has authenticated the credential, the credential identifier is passed into the existing access control infrastructure where the normal access rules are applied,” explains David Bunzel, Executive Director of the Physical Security Interoperability Alliance.

According to Bunzel, PKOC addresses the first part of the equation – whether the credential is legitimate.

Because of the two separate steps, PKOC's role and the access control system's role are segregated.

“This is an important point, because it means PKOC is not a rip-and-replace proposition,” says Bunzel.

It also means that a valid credential can still be denied access if it doesn’t belong there. If a student graduates, loses a card, or otherwise has their privileges revoked, the campus can deactivate the credential through its existing credential management and access control processes.

Moving away from shared secrets

The big technical change with PKOC is the move from symmetric to asymmetric cryptography.

Traditional proprietary credential systems typically rely on symmetric cryptography and its shared secret keys. The credential and reader need access to appropriate secrets to authenticate one another. Those secrets have to be created and distributed across potentially thousands of devices -- not to mention protected.

PKOC instead uses asymmetric cryptography to create public/private key pairs.

With PKOC, you no longer have the problem of distributing and protecting shared secret keys across thousands of readers and credentials.

In this type of system, the credential retains its own private key and never hands over to the reader. Instead, the reader uses public information – the public key – to authenticate the credential.

“That greatly simplifies key management and reduces the consequences of a reader being compromised,” Bunzel says. “You no longer have the problem of distributing and protecting shared secret keys across thousands of readers and credentials.”

Compromise of one reader therefore does not present significant risk because only the public key is exposed. No credentials are impacted. Conversely, if one credential happened to be compromised, it would not impact any of the other credentials in the system.

Public key technology does not make the credential invulnerable, but it does change the potential consequences of a compromise.

A credential that can outlive its transport

Another important PKOC characteristic is that it is transport independent.

The credential is separated from the technology used to communicate with the reader. Today that might mean a physical card or a mobile credential using Bluetooth Low Energy or Near Field Communications. Tomorrow it could involve an entirely new transport technology that hasn’t been invented yet.

Campus access control infrastructure can have a much longer life than credential technology. A reader installation may remain in service for decades. Phones, mobile wallets, and contactless technologies evolve faster.

“A campus shouldn't have to redesign its access control architecture every time the technology used to present a credential changes,” Bunzel says.

That makes PKOC less about choosing today's “best” credential and more about establishing a credential layer that can accommodate future technologies.

“The biggest benefit is flexibility and choice,” he says.

What a campus keeps

One of the more attractive aspects of PKOC for higher education is that adoption does not necessarily mean ripping out the existing access control infrastructure.

The campus can generally continue using its existing database, access rules, controllers, wiring, locks, and other door infrastructure.

A standards-based credential layer creates the option of a staged migration – upgrading where and when it makes sense.

PKOC-capable credentials and readers are required, along with a way to enroll those credentials into the existing access control environment.

Replacing an entire access control infrastructure at once can be financially and operationally challenging. A standards-based credential layer creates the option of a staged migration – upgrading where and when it makes sense.

The goal is to increase choice

Security is only part of the PKOC argument. Bunzel says the larger benefit is flexibility and avoiding vendor lock-in.

A proprietary credential environment can make changing one component of the ecosystem difficult. A campus may want a new reader, a different credential manufacturer, or a mobile option, only to discover that the change affects multiple other areas of its infrastructure.

PKOC is intended to loosen the grips on vendor-client relationships.

PKOC is intended to loosen the grips on vendor-client relationships.

Because of the open standard approach, a campus can use credentials and readers from different manufacturers and adopt new technologies without replacing the entire access control architecture.

Instead of asking which proprietary credential ecosystem it wants to live with for the next decade, an institution can ask which products support the open credential standard it has selected.

This article is part of our CampusIDNews Series titled, "Open standards for campus mobile credentials." The series takes a deep dive into the three emerging standards – Aliro, Public Key Open Credential (PKOC), and LEAF Verified. The articles will explore how each standard operates and potential impacts higher education credentialing.

Part 1: An intro to open standards for campus mobile credentials

Part 2: Exploring the PKOC standard for campus mobile credentials