ANSI INCITS ISO IEC 24727-4-2008 Identification cards Integrated circuit card programming interfaces Part 4 Application programming interface (API) administration.pdf

1、INCITS/ISO/IEC 24727-4-20082009 (ISO/IEC 24727-4:2008, IDT) Identification cards Integrated circuit card programming interfaces Part 4: Application programming interface (API) administrationINCITS/ISO/IEC 24727-4-20082009 (ISO/IEC 24727-4:2008, IDT)INCITS/ISO/IEC 24727-4-20082009 ii ITIC 2009 All ri

2、ghts reserved PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloadi

3、ng this file, parties accept therein the responsibility of not infringing Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the Gene

4、ral Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given

5、 below. Adopted by INCITS (InterNational Committee for Information Technology Standards) as an American National Standard. Date of ANSI Approval: 7/27/2009Published by American National Standards Institute, 25 West 43rd Street, New York, New York 10036 Copyright 2009 by Information Technology Indust

6、ry Council (ITI). All rights reserved. These materials are subject to copyright claims of International Standardization Organization (ISO), International Electrotechnical Commission (IEC), American National Standards Institute (ANSI), and Information Technology Industry Council (ITI). Not for resale

7、. No part of this publication may be reproduced in any form, including an electronic retrieval system, without the prior written permission of ITI. All requests pertaining to this standard should be submitted to ITI, 1250 Eye Street NW, Washington, DC 20005. Printed in the United States of America I

8、NCITS/ISO/IEC 24727-4-20082009 ITIC 2009 All rights reserved iiiContents Page Foreword v Introduction.vi 1 Scope.1 2 Normative references .1 3 Terms and definitions.2 4 Abbreviated terms 3 5 Architecture specialization 4 5.1 Full-network-stack 6 5.2 Loyal-stack 8 5.3 Opaque-ICC-stack.9 5.4 Remote-lo

9、yal-stack .10 5.5 ICC-resident-stack 11 5.6 Remote-ICC-stack .12 6 Security architecture 12 6.1 Path-protection-policy12 6.2 ACL ACR mapping.14 6.3 Secure messaging 14 6.4 Trusted-channel key administration15 7 Connection components 15 7.1 Action request and response semantics 15 7.2 Proxy Agent Arc

10、hitecture15 7.3 Trusted-channel Interface 16 7.3.1 TC_API_Open request 17 7.3.2 TC_API_Close request18 7.3.3 TC_API_Read request.19 7.3.4 TC_API_Write request 20 7.3.5 TC_API_Reset request21 7.3.6 TC_API_GetStatus request.22 7.4 Interface Device API23 7.4.1 Establish Context24 7.4.2 ReleaseContext .

11、25 7.4.3 ListIFDs26 7.4.4 GetIFDCapabilities 27 7.4.5 GetStatus.30 7.4.6 Wait 32 7.4.7 Cancel 33 7.4.8 ControlIFD .34 7.4.9 Connect .35 7.4.10 Disconnect.36 7.4.11 BeginTransaction37 7.4.12 EndTransaction.38 7.4.13 Transmit.39 7.4.14 VerifyUser40 7.4.15 ModifyVerificationData .43 7.4.16 Output45 7.4

12、.17 SignalEvent .47 INCITS/ISO/IEC 24727-4-20082009 iv ITIC 2009 All rights reservedAnnex A (normative) Path-protection Mechanisms.48 Annex B (normative) IFD - API: Web Service Binding.55 Annex C (normative) IFD-Callback-API - Web Service Binding 78 Bibliography.81 INCITS/ISO/IEC 24727-4-20082009 IT

13、IC 2009 All rights reserved vForeword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of Internati

14、onal Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison wit

15、h ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical c

16、ommittee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is drawn t

17、o the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC 24727-4 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC

18、17, Cards and personal identification. ISO/IEC 24727 consists of the following parts, under the general title Identification cards Integrated circuit card programming interfaces: Part 1: Architecture Part 2: Generic card interface Part 3: Application interface Part 4: Application programming interfa

19、ce (API) administration Part 5: Testing Part 6: Registration authority procedures for the authentication protocols for interoperability INCITS/ISO/IEC 24727-4-20082009 vi ITIC 2009 All rights reservedIntroduction ISO/IEC 24727 is a set of programming interfaces for interactions between integrated ci

20、rcuit cards (ICCs) and external applications to include generic services for multi-sector use. The organization and the operation of the ICCs conform to ISO/IEC 7816-4. ISO/IEC 24727 is relevant to ICC applications desiring interoperability among diverse application domains. ISO/IEC 7498-1:1994 is u

21、sed as the layered architecture of the client-application to card-application connectivity. That is, the client-application, through the application interface, assumes that there is a protocol stack through which it will exchange information and transactions among card-applications using commands co

22、nveyed through the message structures defined in ISO/IEC 7816. The semantics of action requests through the interface defined in ISO/IEC 24727-3 refers to application protocol data units (APDUs) as characterized through the interface defined in ISO/IEC 24727-2, and in the following International Sta

23、ndards: ISO/IEC 7816-4:2005, Identification cards Integrated circuit cards Part 4: Organization, security and commands for interchange ISO/IEC 7816-8:2004, Identification cards Integrated circuit cards Part 8: Commands for security operations ISO/IEC 7816-9:2004, Identification cards Integrated circ

24、uit cards Part 9: Commands for card management The goal of ISO/IEC 24727 is to maximize the applicability and solution space of software tools that provide application interface support to card-aware client-applications. This effort includes supporting the evolution of card systems as they become mo

25、re powerful, peer-level partners with existing and future applications while minimizing the impact to existing solutions conforming to ISO/IEC 24727. By conforming to this part of ISO/IEC 24727, interoperable implementations of ISO/IEC 24727-3 and ISO/IEC 24727-2 can be realized. Implementation deta

26、ils are not defined within this part of ISO/IEC 24727; it is assumed that an implementation conforms to an accepted security policy. The specific security policy is outside the scope of ISO/IEC 24727. AMERICAN NATIONAL STANDARD INCITS/ISO/IEC 24727-4-20082009 ITIC 2009 All rights reserved 1Identific

27、ation cards Integrated circuit card programming interfaces Part 4: Application programming interface (API) administration 1 Scope ISO/IEC 24727 defines a set of programming interfaces for interactions between integrated circuit cards and external applications to include generic services for multi-se

28、ctor use. This part of ISO/IEC 24727 standardizes the connectivity and security mechanisms between the client-application and the card-application. It specifies API-Administration of service-independent and implementation-independent ISO/IEC 24727 compliant modules, including security, that enables

29、action requests to a specific card-application of an ICC such that, when coupled to data model and content discovery operations, the card-application can be used by a variety of client-applications. 2 Normative references The following referenced documents are indispensable for the application of th

30、is document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 7816-4:2005, Identification cards Integrated circuit cards Part 4: Organization, security and commands for interchange

31、ISO/IEC 9797-1:1999, Information technology Security techniques Message Authentication Codes (MACs) Part 1: Mechanisms using a block cipher ISO/IEC 24727-1, Identification cards Integrated circuit card programming interfaces Part 1: Architecture ISO/IEC 24727-2, Identification cards Integrated circu

32、it card programming interfaces Part 2: Generic card interface ISO/IEC 24727-3, Identification cards Integrated circuit card programming interfaces Part 3: Application interface IETF RFC 2246, The TLS Protocol Version 1.0 INCITS/ISO/IEC 24727-4-20082009 2 ITIC 2009 All rights reserved3 Terms and defi

33、nitions For the purposes of this document, the terms and definitions given in ISO/IEC 24727-1, ISO/IEC 24727-2, ISO/IEC 24727-3 and the following apply. 3.1 channel physical pathway allowing movement of information bits between a client-application and a card-application 3.2 component executable cod

34、e comprising a processing layer accessed with ISO/IEC 24727 defined application programming interfaces 3.3 confidentiality access restricted to some defined level of differential-identity authentication 3.4 dubious-channel channel that might allow information messages to be altered, dropped, replaye

35、d or overheard by eavesdroppers 3.5 instantiation operational component implementation or communication channel implementation 3.6 integrity state of immutability of information 3.7 ISO/IEC 24727 protocol stack series of processing components connected by communication channels that connect a client

36、-application to a card-application 3.8 loyal-channel channel that intrinsically maintains the integrity of channel end-points along with the confidentiality, integrity and authenticity of information 3.9 loyal-platform computing platform that is trusted to perform data transformations and communicat

37、ion while maintaining confidentiality, integrity and authenticity of information 3.10 loyal-stack ISO/IEC 24727 stack in which the full stack from client-application to the integrated circuit card that contains the card-application is implemented on a single loyal-platform 3.11 path-protection-polic

38、y specification of the security characteristics of all platforms and channels using ISO/IEC 24727 that connect the client-application to the card-application INCITS/ISO/IEC 24727-4-20082009 ITIC 2009 All rights reserved 33.12 proxy application programming interface implementation that conveys action

39、 requests and parameters to a layer implementation located elsewhere 3.13 TC_API application programming interface used by components of an ISO/IEC 24727 stack to effect the stacks instantiation in a network environment 3.14 trusted-channel channel that explicitly assures the confidentiality, integr

40、ity and authenticity of information during the transfer process, independent of the characteristics of the transfer mechanism or media 3.15 trusted-path connection between a client-application and a card-application in which all platforms and channels have security characteristics as defined by the

41、client-application 4 Abbreviated terms TLS - transport layer security CC - cryptographic checksum CG - cryptogram D - decipherDES - data encryption standard DO - data object E - encipherK - key Le - expected length MAC - message authentication code SSC - send sequence counter API - application progr

42、amming interface APDU - application protocol data unit INCITS/ISO/IEC 24727-4-20082009 4 ITIC 2009 All rights reserved5 Architecture specialization ISO/IEC 24727-1, ISO/IEC 24727-2 and ISO/IEC 24727-3 define an architecture, application programming interface and a command-set communication message s

43、tructure and protocol through which a client-application can access information and computation services from a card-application. The objective of ISO/IEC 24727 is to achieve interoperability among diverse implementations of card-applications and client-applications. ISO/IEC 24727-1 specifies the ov

44、erarching architecture of ISO/IEC 24727. ISO/IEC 24727-2 specifies a generic request set through which card-application services may be accessed. ISO/IEC 24727-3 specifies the application interface through which client-applications shall access services provided by card-applications. The architectur

45、al overview of ISO/IEC 24727 as illustrated in Figure 1 envisions a variety of implementations that can satisfy the standard in sufficient detail to successfully conform to the testing procedures which will be specified in ISO/IEC 24727-5. API Layer ImplementationGCI Layer ImplementationCard Service

46、 APIs cf ISO/IEC 24727-3Generic Card Interface cf ISO/IEC 24727-2Interface Device Access MechanismInterface Device Configuration SelectionISO/IEC 24727-4Security tightly coupled meaning that the connection to the card-application containing ICC through operating system specific code for accessing an

47、 interface device is encompassed by the ISO/IEC 24727-2 instantiation. The remote-loyal-stack considers a configuration in which a loyal-stack shall be utilized on a platform that is remote from the client-application. The ICC-resident-stack considers a card-application that shall support the ISO/IE

48、C 24727-3 layer implementation. Finally, the remote-ICC-stack discusses a stack in which the physical connection of the ICC shall be made to a different platform from the rest of the stack. It is noted that all parts of ISO/IEC 24727 are neutral with respect to the physical interconnection mechanism

49、 used to complete a communication channel(s) from the client-application to the card-application. Consequently, references to ICC should be interpreted as being equally applicable to PICC or to non-card resident card-applications and that references to IFD are equally applicable to PCD or other card-application containing platform interfaces. Figure 2 illustrates the generic elements of an ISO/IEC 24727 protocol stack. Client-ApplicationSAL - API - ProxyTC-APITC-APIService