BS ISO IEC 24727-1-2014 Identification cards Integrated circuit card programming interfaces Architecture《识别卡 集成电路卡程序设计接口 体系架构》.pdf

1、BSI Standards Publication BS ISO/IEC 24727-1:2014 Identification cards Integrated circuit card programming interfaces Part 1: ArchitectureBS ISO/IEC 24727-1:2014 BRITISH STANDARD National foreword This British Standard is the UK implementation of ISO/IEC 24727-1:2014. It supersedes BS ISO/IEC 24727-

2、1:2007 which is withdrawn. The UK participation in its preparation was entrusted to Technical Committee IST/17, Cards and personal identification. A list of organizations represented on this committee can be obtained on request to its secretary. This publication does not purport to include all the n

3、ecessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2014. Published by BSI Standards Limited 2014 ISBN 978 0 580 79717 0 ICS 35.240.15 Compliance with a British Standard cannot confer immunity from legal obligations. This British St

4、andard was published under the authority of the Standards Policy and Strategy Committee on 30 June 2014. Amendments/corrigenda issued since publication Date Text affectedBS ISO/IEC 24727-1:2014 Identification cards Integrated circuit card programming interfaces Part 1: Architecture Cartes didentific

5、ation Interfaces programmables de cartes puce Partie 1: Architecture ISO/IEC 2014 INTERNATIONAL STANDARD ISO/IEC 24727-1 Second edition 2014-06-15 Reference number ISO/IEC 24727-1:2014(E)BS ISO/IEC 24727-1:2014ISO/IEC 24727-1:2014(E)ii ISO/IEC 2014 All rights reserved COPYRIGHT PROTECTED DOCUMENT IS

6、O/IEC 2014 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can b

7、e requested from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org Published in SwitzerlandBS ISO/IEC 24727-1:2014ISO/IEC 247

8、27-1:2014(E) ISO/IEC 2014 All rights reserved iii Contents Page Foreword iv Introduction v 1 Scope .1 2 Normative references 1 3 Terms and definitions .1 4 Abbreviated terms 3 5 Interoperability .3 6 Architecture .4 6.1 General . 4 6.2 Architectural attributes . 4 6.3 Logical architecture 4 6.4 Prot

9、ocol independence 5 6.5 Client-application service access layer interface . 6 6.6 Capability description . 6 6.7 Data model 6 6.8 Generic card interface . 7 6.9 Connectivity interface . 7 6.10 Trusted channel interface 7 7 Security rationale 7 Annex A (informative) Implementation configuration examp

10、les 8 Bibliography .18BS ISO/IEC 24727-1:2014ISO/IEC 24727-1:2014(E) Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC par

11、ticipate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmen

12、tal and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. The procedures used to develop this document and those intended for its further maintenance are describe

13、d in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives). Attention is drawn to the po

14、ssibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the

15、ISO list of patent declarations received (see www.iso.org/patents). Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement. For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment,

16、 as well as information about ISOs adherence to the WTO principles in the Technical Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information The Committee responsible for this document is ISO/IEC JTC 1, Information technology, Subcommittee SC 17, Cards and personal identif

17、ication. This second edition cancels and replaces the first edition (ISO/IEC 24727-1:2007), which has been technically revised. ISO/IEC 24727 consists of the following parts, under the general title Identification cards Integrated circuit card programming interfaces: Part 1: Architecture Part 2: Gen

18、eric card interface Part 3: Application interface Part 4: Application programming interface (API) administration Part 5: Testing procedures Part 6: Registration authority procedures for the authentication protocols for interoperabilityiv ISO/IEC 2014 All rights reservedBS ISO/IEC 24727-1:2014ISO/IEC

19、 24727-1:2014(E) Introduction ISO/IEC 24727 specifies a set of programming interfaces and protocols enabling interactions between integrated circuit cards (ICCs) and applications resident on diverse computer platforms. The ICCs provide generic services for multi-sector use aimed preferentially at su

20、pporting trusted Identification, Authentication and Signature (IAS) operations. The organization and the operation of the ICCs conform to ISO/IEC 7816-4. ISO/IEC 24727 makes use of the general principles of the Open Systems Interconnect reference model presented in ISO/IEC 7498-1 | ITU-T Rec. X.200.

21、 These principles suggest that the connection of complementary applications on diverse computer platforms be accomplished by well defined procedures accessed through standard interfaces. The procedures encompass both hardware and software facilities that allow the applications to interact, even when

22、 separated by complex communication pathways. The collection of procedures that connect one application to another is referred to as a protocol stack. Each component of such a stack comprises an interface and a layer. The layer comprises the implementation of the procedural functionality that accept

23、s and responds to requests conveyed through the interface. ISO/IEC 24727 specifies interfaces allowing independent layer implementations to be interchangeable. This comprises the basic definition of interoperability: independent implementations are interchangeable. To achieve true interoperability a

24、cross a wide range of application domains, some of which may pre-date ISO/IEC 24727, requires a variety of mechanisms to be addressed within the relevant implementations. These mechanisms include: common architectures, common semantics, formally defined interfaces, discoverability, extensibility, ba

25、ckward compatibility and conformance testing. The means of realizing these mechanisms are addressed in the following clauses and in the other parts of ISO/IEC 24727. ISO/IEC 2014 All rights reserved vBS ISO/IEC 24727-1:2014BS ISO/IEC 24727-1:2014Identification cards Integrated circuit card programmi

26、ng interfaces Part 1: Architecture 1 Scope ISO/IEC 24727 specifies a set of programming interfaces and protocols enabling interactions between integrated circuit cards (ICCs) and applications resident on a variety of computer platforms. The ICCs provide generic services for multi-sector use by the a

27、pplications. The organization and the operation of the ICCs conform to ISO/IEC 7816-4. It is anticipated that some application domains will seek to achieve interoperability through ISO/IEC 24727 facilities even though the applications pre-exist these facilities. To this end, various means of backwar

28、d compatibility are established through mechanisms specified in ISO/IEC 24727. This part of ISO/IEC 24727 specifies system architecture and principles of operation, the means for achieving interoperability among diverse application domains, the conceptual service and data models that span the releva

29、nt application domains, and the rationale for trusted processes enabled under these models. 2 Normative references The following documents, in whole or in part, are normatively referenced in this document and are indispensable for its application. For dated references, only the edition cited applies

30、. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 7816-4:2005, Identification cards Integrated circuit cards Part 4: Organization, security and commands for interchange 3 Terms and definitions For the purposes of this document, the fo

31、llowing terms and definitions apply. 3.1 authentication process of assessing a level of confidence in identity or identification 3.2 authentication protocol specific process for authentication 3.3 card integrated circuit card INTERNATIONAL ST ANDARD ISO/IEC 24727-1:2014(E) ISO/IEC 2014 All rights re

32、served 1BS ISO/IEC 24727-1:2014ISO/IEC 24727-1:2014(E) 3.4 card-application uniquely addressable set of functionalities on an ICC that provide data storage and computational services to a client-application 3.5 client-application processing software needing access to one or more card-application(s)

33、3.6 data element item of information seen at the interface for which are specified a name, a description of logical content, a format and a coding SOURCE: ISO/IEC 7816-4 3.7 data set named collection of data structures for interoperability 3.8 data structure for interoperability ISO/IEC 7816-4 file

34、identified by a two-byte file identifier or an ISO/IEC 8825 BER-TLV data object identified by an octet string encoding an ASN.1 tag 3.9 differential-identity set of information that comprises a name, a marker, and an authentication protocol 3.10 generic card access layer component which provides an

35、ISO/IEC 24727-2 interface to a service access layer 3.11 identification collective aspect of a set of characteristics and processes by which an entity is recognizable or known 3.12 interface point at which independent and often unrelated systems meet and act on or communicate with each other 3.13 in

36、teroperability ability for any card-application interface that conforms to ISO/IEC 24727 to be used by any client- application conforming to ISO/IEC 24727 3.14 marker item of information within a differential-identity representing a unique characteristic of an entity 3.15 middleware software that co

37、nnects two otherwise separate applications 3.16 SAL-lite Lightweight component which provides a subset of ISO/IEC 24727-3 API for data structure discoverability by a client-application2 ISO/IEC 2014 All rights reservedBS ISO/IEC 24727-1:2014ISO/IEC 24727-1:2014(E) 3.17 service set of processing func

38、tions available at an interface 3.18 service access layer component which provides an ISO/IEC 24727-3 API to a client-application 4 Abbreviated terms AID application identifier ACD application capability description APDU application protocol data unit API application programming interface BER basic

39、encoding rules CCD card capability description GCAL generic card access layer GCI generic card interface ICC integrated circuit card IFD interface device SAL service access layer SAL-lite service access layer lightweight component TLV tag-length-value 5 Interoperability Interoperability addresses th

40、e facilities through which card-application interfaces conforming to ISO/IEC 24727 can be accessed by a client-application conforming to ISO/IEC 24727. ISO/IEC 24727 achieves interoperability through a variety of mechanisms, including: common architecture, common semantics, formally defined interfac

41、es, discoverability, extensibility, backward compatibility, and conformance testing. All of the interfaces in ISO/IEC 24727 are specified through formal languages. This establishes a rigorous expression of grammar and semantics allowing the interfaces to be independently implemented and conveyed thr

42、oughout a variety of protocol stacks in an interoperable fashion. ISO/IEC 2014 All rights reserved 3BS ISO/IEC 24727-1:2014ISO/IEC 24727-1:2014(E) As illustrated in Figure 1, for each specified interface the relevant parts of ISO/IEC 24727 shall define the functionality to be supported. ISO/IEC 2472

43、7 applies to an ICC providing directly, or indirectly, a capability description. The capability description is further described in Clause 6.6, and is more rigorously specified in ISO/IEC 24727-2. Means of extending the various interfaces and protocols addressed by ISO/IEC 24727, including relevant

44、ICC technology, are addressed in the various parts of the standard. 6 Architecture 6.1 General ISO/IEC 24727 partitions functionality between a client-application running on a host platform and a set of services provided by an ICC resident card-application that can be used by a client-application. A

45、ccess to such services is provided through a protocol stack that provides a service interface, a generic card interface, and one or more card-applications resident on an ICC. 6.2 Architectural attributes The service interface implements features discussed in Clause 6.5 and more rigorously addressed

46、in ISO/IEC 24727-3. The generic card interface implements features discussed in Clause 6.8 and more rigorously addressed in ISO/IEC 24727-2. The connectivity interface implements features discussed in Clause 6.9 and more rigorously addressed in ISO/IEC 24727-3, ISO/IEC 24727-3 and ISO/IEC 24727-6. T

47、he trusted channel interface implements features discussed in Clause 6.10 and more rigorously addressed in ISO/IEC 24727-4. Card-applications manage data sets, including establishing a unique name space for data sets and all information contained within data sets. Each data set is named and the card

48、-application list of data set names is available to the client-application by direct knowledge or discovery. A client-application uses the data set name when requesting a service to be performed on a data set. Access to data sets is controlled through an access control list. The access control list

49、describes the security conditions that shall be satisfied in order to perform an action on the data set. ISO/IEC 24727-3 and ISO/IEC 24727-4 provide additional detail on access control lists, identities, and actions. Card-applications are organized on an ICC through an encompassing alpha card-application and one or more contained card-applications. Card-applications are selectable by AID at the service interface. 6.3 Logical architecture Figure 1 illustrates the relationships between a client-applica