The WIA Access Control System (WIA-ACS) standard provides a comprehensive, unified approach to physical and digital access control. Designed to address the challenges outlined in Chapter 2, WIA-ACS offers standardized data formats, APIs, protocols, and integration patterns that enable interoperability, security, and scalability. This chapter provides an overview of the WIA-ACS standard, its design principles, architecture, and four-phase implementation model.
WIA-ACS is built on the foundational philosophy of 弘益人間 (Hongik Ingan)—broadly benefiting humanity. This philosophy manifests in several core design principles:
WIA-ACS uses open, well-documented standards rather than proprietary protocols. All specifications are publicly available, enabling any vendor to implement WIA-ACS-compliant systems without licensing fees or vendor lock-in.
Security is not an afterthought but built into every layer:
WIA-ACS incorporates privacy-preserving techniques:
The standard supports deployments from small businesses to global enterprises:
WIA-ACS prioritizes user experience for both end users and administrators:
The WIA-ACS architecture consists of several layers, each with clearly defined responsibilities:
WIA-ACS Layered Architecture:
┌─────────────────────────────────────────────────────────┐
│ Application Layer │
│ (Management Portals, Mobile Apps, Integrations) │
└──────────────────────┬──────────────────────────────────┘
│ REST/GraphQL APIs
┌──────────────────────▼──────────────────────────────────┐
│ Service Layer │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ Auth │ │ Authz │ │ Credential│ │ Audit │ │
│ │ Service │ │ Service │ │ Service │ │ Service │ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
└──────────────────────┬──────────────────────────────────┘
│ Internal APIs
┌──────────────────────▼──────────────────────────────────┐
│ Data Layer │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ Users │ │ Roles │ │Credentials│ │ Events │ │
│ │ DB │ │ DB │ │ DB │ │ DB │ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
└──────────────────────┬──────────────────────────────────┘
│ Adapters & Connectors
┌──────────────────────▼──────────────────────────────────┐
│ Integration Layer │
│ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ │
│ │ LDAP │ │ PACS │ │ SSO │ │ Bio │ │ RFID │ ... │
│ └──────┘ └──────┘ └──────┘ └──────┘ └──────┘ │
└─────────────────────────────────────────────────────────┘
User-facing applications and integrations consume WIA-ACS services through standardized APIs. This layer includes:
Core business logic implemented as microservices:
| Service | Responsibility | Key Functions |
|---|---|---|
| Authentication | Verify user identity | Credential validation, MFA, session management |
| Authorization | Grant/deny access | RBAC/ABAC evaluation, policy enforcement |
| Credential | Manage credentials | Provisioning, revocation, renewal, encoding |
| Audit | Log all events | Event collection, integrity verification, reporting |
| User | User lifecycle | Provisioning, deprovisioning, profile management |
| Device | Hardware management | Reader/controller registration, health monitoring |
Persistent storage with strong consistency guarantees and encryption at rest. WIA-ACS supports multiple database backends while defining standard schemas for interoperability.
Adapters and connectors enable WIA-ACS to integrate with existing systems. The standard defines common integration patterns for:
WIA-ACS uses a phased approach to implementation, allowing organizations to adopt the standard incrementally while achieving immediate benefits at each phase.
Standardize data schemas for users, credentials, permissions, and audit events. This foundational phase enables data exchange and reporting across systems even without full integration.
Deliverables:
Benefits: Unified reporting, easier migrations, data portability
Define RESTful and gRPC APIs for authentication, authorization, credential management, and auditing. Applications can now programmatically interact with access control systems.
Deliverables:
Benefits: Automation, integration flexibility, self-service capabilities
Establish secure communication protocols using TLS 1.3, OAuth 2.0, OpenID Connect, and SAML 2.0. This ensures end-to-end encryption and federated identity support.
Deliverables:
Benefits: Strong security, single sign-on, compliance readiness
Deploy reference implementations and integration adapters for common enterprise systems. Organizations can connect WIA-ACS to existing LDAP, PACS, biometric, and IoT infrastructure.
Deliverables:
Benefits: Rapid deployment, vendor interoperability, future-proof architecture
WIA-ACS complements and extends existing standards rather than replacing them:
| Standard | Focus | WIA-ACS Relationship |
|---|---|---|
| OSDP | Reader-controller communication | WIA-ACS supports OSDP as a transport protocol |
| OAuth 2.0 | Authorization framework | WIA-ACS uses OAuth for API authorization |
| OpenID Connect | Authentication layer on OAuth | WIA-ACS supports OIDC for user authentication |
| SAML 2.0 | Enterprise SSO | WIA-ACS provides SAML integration for enterprise IdPs |
| LDAP | Directory services | WIA-ACS integrates with LDAP/AD as user source |
| XACML | Policy language | WIA-ACS can express policies in XACML |
The key differentiator is that WIA-ACS provides a complete, end-to-end standard covering the full access control lifecycle—from credential provisioning to audit reporting—while existing standards typically address only specific aspects.
WIA-ACS includes a certification program to verify compliance and interoperability:
| Level | Requirements | Suitable For |
|---|---|---|
| Bronze | Phase 1 (Data Format) compliance | Basic interoperability, reporting tools |
| Silver | Phase 1 + 2 (API Interface) | Integrated applications, automation |
| Gold | Phase 1 + 2 + 3 (Protocol) | Enterprise deployments, high security |
| Platinum | All phases + reference integrations | Complete systems, multi-vendor environments |
To accelerate adoption and ensure standard quality, WIA provides an open-source reference implementation covering all four phases. This implementation serves multiple purposes:
Reference Implementation Components:
wia-acs-core/
├── services/
│ ├── authentication/ # Auth service with MFA
│ ├── authorization/ # RBAC/ABAC engine
│ ├── credential/ # Credential lifecycle
│ ├── audit/ # Event logging
│ └── user/ # User management
├── api/
│ ├── rest/ # RESTful API (FastAPI)
│ └── grpc/ # gRPC service (Go)
├── integrations/
│ ├── ldap/ # LDAP/AD connector
│ ├── pacs/ # HID, Lenel adapters
│ ├── biometric/ # Biometric device APIs
│ └── mobile/ # iOS/Android SDKs
├── web/
│ ├── admin-portal/ # React admin console
│ └── self-service/ # User portal
├── database/
│ ├── schemas/ # PostgreSQL schemas
│ └── migrations/ # Version migrations
└── deployment/
├── docker/ # Container images
├── kubernetes/ # K8s manifests
└── terraform/ # Infrastructure as code
License: Apache 2.0
Repository: github.com/wia-official/wia-acs
WIA-ACS is governed by an open, transparent process:
Representatives from vendors, integrators, end users, and security researchers guide standard development.
WIA-ACS follows semantic versioning (MAJOR.MINOR.PATCH):
Major versions maintained for 5 years, minor versions for 2 years, ensuring long-term stability.
This chapter introduced the WIA Access Control System standard, including its design philosophy (openness, security, privacy, scalability, usability), layered architecture, four-phase implementation model, certification program, and governance structure. WIA-ACS provides a comprehensive, end-to-end standard for unified physical and digital access control.
The following chapters dive deep into each implementation phase. Chapter 4 begins with Phase 1, examining the standardized data formats for credentials, users, permissions, and audit events that form the foundation of WIA-ACS interoperability.