Overview
ISO/IEC 23220-1:2023 defines generic system architectures and life‑cycle phases for mobile eID systems (mobile electronic identification). It provides a building‑block view of mobile eID infrastructures and standardizes interfaces and services for mdoc apps (mobile document applications) and mobile verification applications. The standard targets entities involved in specifying, architecting, designing, testing, maintaining, administering and operating mobile eID solutions and aims to enable interoperability and secure identity management via mobile devices.
Key topics and technical requirements
- Generic system architectures: Reference architectures for installation, issuing and operational phases of mobile eID systems (including on‑site and remote identification configurations).
- Life‑cycle phases: Definitions and sub‑phases for installation, holder enrolment, issuance, monitoring and operational use.
- Building blocks and components: Modular components such as mdoc apps, identity/attribute providers, issuers, verifiers, and monitoring services; operational modes and component interactions.
- Interfaces and services: Standardized interfaces between mdoc apps and verification apps to support secure exchanges and interoperability.
- Design, privacy and security principles: Requirements and recommendations covering data minimization, consent and choice, accuracy and quality, and information security.
- Interoperability pillars: The series emphasizes secure channel establishment, API call serialization, data element naming conventions, and payload transport mechanisms.
- Trust mechanisms: Includes guidance for establishing Trust On First Use (TOFU) and for accommodating diverse secure element technologies (TEE, UICC/eUICC/iUICC, embedded secure elements, secure memory cards, or server‑based security).
- Communication channels: Consideration of local and remote channels (NFC, BLE, Wi‑Fi, mobile networks) and how interface/protocol choices affect trust and security.
Practical applications and who uses this standard
ISO/IEC 23220-1 is applicable to:
- National and regional government agencies deploying mobile ID (national ID, mobile driver’s licenses)
- Identity solution architects, system integrators and vendors building mdoc apps and verification apps
- Security architects and privacy officers designing secure enrolment, issuance and operational workflows
- Testing and certification bodies validating interoperability, security and lifecycle processes
- Sectors using mobile identity for access control, banking, health credentials, education and corporate badges
Practical uses include designing issuer workflows, defining verifier interfaces, selecting secure elements for mobile devices, and documenting lifecycle processes to meet privacy and security expectations.
Related standards
- ISO/IEC 23220 series (parts addressing data formats, protocols for issuing and operational phases, trust models and certification of secure areas)
- Backward compatibility consideration with ISO/IEC 18013‑5 (mobile driving licences)
Keywords: ISO/IEC 23220-1:2023, mobile eID systems, mdoc app, mobile verification application, identity management via mobile devices, system architecture, life‑cycle phases, TOFU, secure element, privacy, interoperability.