ISO/IEC 18328-3:2016 PDF

Overview

ISO/IEC 18328-3:2016 - "Identification cards - ICC‑managed devices - Part 3: Organization, security and commands for interchange" defines the logical interface and security framework for applications on card‑ICs (card‑IC) that manage additional electronic devices (for example displays, keypads or sensors) and communicate via APDUs. The standard specifies command sets, data structures, device management semantics and security mechanisms - not the physical/electrical characteristics - to enable reliable, secure interaction between the card operating system (COS), device drivers and external hosts.

Key Topics and Requirements

• Logical architecture and operational conditions
  • General architecture, interfaces, device discovery and logical activation
  • Activity states, activation sequence and exclusive‑usage attributes
• Addressing and device control
  • Device identifiers, device handles and administration templates
  • Device Control Parameter (DVCP) and general device information templates
• Command model
  • Standardized ADM (additional device management) command family: open, reset (general/logical), activate/deactivate, exclusive usage, get/put, get device information, erase, manage configuration
  • Specific status bytes and command handling semantics
• Off‑card devices & transmission
  • Mechanisms for devices not embedded in the ICC, handle usage and transmission constraints
  • Secure channel considerations for off‑card communications
• Security and trust assessment
  • Security attributes, access modes and required security conditions
  • Data integrity, confidentiality and trust assessment coding (warnings, fonts, colours) for managed data
• Extensibility
  • Command and structure designs that support future extensions and adaptations
• Device configuration templates
  • Templates and mechanisms for managing device configuration data under COS control

Practical Applications & Who Uses This Standard

ISO/IEC 18328-3:2016 is valuable when integrating electronic peripherals into smart‑card ecosystems. Typical use cases include:

• Smart card manufacturers designing cards with integrated displays, keypads, fingerprint sensors or other peripherals
• Payment and banking solutions that use on‑card displays for transaction verification (e.g., dynamic CVV, transaction signing)
• Government and ID programs deploying secure citizen ID, e‑passport or e‑voting cards with peripherals
• Card OS and device driver developers implementing the logical API, security checks and command handling
• System integrators, security architects and auditors establishing interoperable, secure device management and trust assessment policies

Adopting this part of the ISO/IEC 18328 series helps ensure interoperability, consistent security behavior, and future‑proof integration of evolving peripheral technologies.

Related Standards

• ISO/IEC 18328-2 - physical characteristics for devices on ICC (complements Part 3)
• ISO/IEC 7816 (all parts) - APDU and general smart‑card application framework referenced throughout Part 3
• Other parts of the ISO/IEC 18328 series for broader device and card guidance

Keywords: ISO/IEC 18328-3:2016, identification cards, ICC‑managed devices, card‑IC, APDU, logical interface, device management, secure channel, trust assessment.