Understanding the Benefits and Limits of XML For Security Systems

While APIs and XML are useful for integrating security systems, their value and ease of use are routinely over-stated. This is nicely demonstrated by a recent contributed piece by a manufacturer in SecurityInfoWatch [link no longer available]. The article boldly starts, "The days of security systems operating in splendid isolation from other organizational systems are over." The author explains that:

"Using the XML markup language for data exchange, integrators can, for example, connect an access control system to virtually any other information system that supports the HTTP protocol, regardless of underlying hardware, operating system, or programming languages."

This is, at best, only partially true. XML, by itself, does not ensure integration no more than using an alphabet ensures that you can read a foreign language (even if they both use the same alphabet).

A concrete example is PSIA and ONVIF - both groups use XML but they are totally incompatible. If you tried to connect a PSIA camera to a VMS supporting ONVIF, it would not work. The key problem is that they use different semantics. An example of this is saying "you" in English and "tu" in Spanish. They both use the same alphabet and refer to the same 'object' but the combination of letters have different meanings. 

Using XML but with different semantics is extremely common in the security industry. It's unlikely that any two XML based APIs from different manufacturers are compatible. To use a language analogy, it's like everyone uses the Latin alphabet but speaks in their own language. Even with XML, unless the 'language' is the same, you are forced to build a 'translator'.

The article concludes: "The days of security systems operating in isolation are over, and I think the dawn of an XML-API integration era is now in full swing."

XML usage is certainly in full swing. However, until we standardize the language and semantics of APIs (and not simply the alphabet) expect to see challenges, delays and costs in integration.

For background, review our overview of APIs and issues in using APIs.