Overview
ISO/IEC 7816-4:2020/Amd 1:2023 is an amendment to the international standard for identification cards that use integrated circuit cards (ICC). This amendment introduces the support of multiple logical security devices within a single physical ICC, enhancing the organization's security architecture and improving command interchange protocols. Developed by ISO and IEC, this standard is pivotal in advancing secure digital identity and authentication technologies in smart card applications.
The amendment extends the existing framework by defining how logical security devices operate independently yet coexist on one physical ICC. It covers the organization, security, and command handling for these devices, enabling enhanced flexibility and security management within identification cards.
Key Topics
-
Logical Security Device Concept
A logical security device is a virtual ICC created from a collection of logical resources on a physical ICC, including data structures, security attributes, logical channels, and command sets. Each has a unique identifier called the logical security device number enabling independent operation within the same physical card.
-
Multiple Logical Security Devices Support
- The physical interface activation automatically opens and selects the basic logical security device (number '00').
- Additional logical security devices may be created, opened, selected, reset, or closed dynamically using the
MANAGE LOGICAL SECURITY DEVICE command (INS '7C').
- Logical security devices use the physical interface, transmission protocol, and other ICC common services but maintain separate security status and logical channels.
- Resources assigned to a logical security device are isolated from others, ensuring independent management and operation.
-
Command Enhancements
- The amendment adds a new command,
MANAGE LOGICAL SECURITY DEVICE, allowing the external environment to control logical security devices via operations such as open, select, reset, and close.
- Logical security device reset can produce a reset string for identification or setup purposes.
- Logical security devices use their logical security device numbers for addressing within commands, enabling precise and secure targeting of operations.
-
Security and Resource Management
The standard clarifies state transitions for logical security devices, including opening (selection), resetting (restoring initial state), and closing (releasing allocated resources). Closing a selected logical security device returns control to the basic logical security device automatically.
Applications
ISO/IEC 7816-4:2020/Amd 1:2023 is highly relevant across industries where secure personal identification and data protection are critical and smart cards are in use. Key applications include:
-
Government Identification and ePassports
Supporting multiple logical security devices allows for separate secure environments on the same card-for instance, separating biometric data, authentication, and payment applications securely.
-
Financial Services
Bank cards and payment devices can manage multiple accounts or services securely using distinct logical security devices, enhancing multi-application support and security isolation.
-
Enterprise Access Control
Organizations can implement sophisticated access control systems by segregating security domains within a single card, using logical devices for different roles or access levels.
-
Healthcare Credentials
Enables coexistence of multiple healthcare applications, such as patient identification, insurance verification, and medical record access, managed securely and independently.
-
Telecommunications SIM Cards
Logical security devices facilitate support for multiple subscriber profiles or enhanced security features within a single SIM card.
Related Standards
This amendment is part of the broader ISO/IEC 7816 series, which encompasses standards for integrated circuit cards with contacts. Relevant related standards include:
-
ISO/IEC 7816-1 to 3
Cover general physical characteristics, dimensions, and electrical interfaces for ICCs.
-
ISO/IEC 7816-2
Details physical characteristics and ATR (Answer To Reset) interface.
-
ISO/IEC 7816-8
Specifies commands for security operations, closely tied to logical device security features.
-
ISO/IEC 7816-12
Addresses card application management.
-
ISO/IEC Directives, Part 1 and Part 2
Outline rules for developing and maintaining ISO/IEC standards, critical for understanding amendment scope and implementation.
For implementers, consulting the full ISO/IEC 7816 series ensures comprehensive compliance and interoperability across smart card technologies.
Keywords: ISO/IEC 7816-4 Amendment, integrated circuit cards, logical security devices, ICC security, smart card commands, multiple logical devices, card security architecture, contact smart cards, MANAGE LOGICAL SECURITY DEVICE command, identification card standards, data interchange security.
Open preview (PDF)Identification cards — Integrated circuit cards — Part 4: Organization, security and commands for interchange — Amendment 1: Support of multiple logical security devices
