Overview
ISO/IEC 23465-1:2023 - "Card and security devices for personal identification - Programming interface for security devices - Part 1: Introduction and architecture description" introduces a standardized programming interface (API) concept for interacting with tamper-resistant security devices (e.g., smart cards, eSE, SIM/UICC, SD-cards, ICC). The standard aims to simplify access to ISO/IEC 7816-based APDU functionality by defining a general architecture, data model and usage model that reduce application-level complexity and middleware footprint.
Key topics and technical requirements
- System overview and components
- Defines roles: client application, proxy, and security device.
- Describes simple and complex system configurations (SoC, mobile devices with single or multiple security devices, ID systems).
- Architecture model
- Component interactions, data management and security architecture considerations (including interaction with a Trusted Execution Environment - TEE).
- Data model and serialization
- General data model used by the API and methods for serialization of requests/responses (e.g., JSON/CBOR references in normative context).
- API requirements and implementation
- High-level requirements for an API that abstracts APDU specifics and supports discoverability and multi-sector ICC functionality.
- Proxy characteristics
- Describes the sub-system (Proxy) that converts API calls into messages suitable for the security device interface (e.g., APDU), enabling minimal middleware.
- Use cases and design guidance
- Practical use cases, design rules and variants of security device interfaces are provided in informative annexes.
- Evolution and coexistence
- Discussion on evolution of security device types and coexistence with existing APIs/middleware (e.g., OpenMobileAPI, PKCS#11).
Practical applications and target users
- Who should use it
- Software architects, application developers, OS designers, security-element vendors, and system integrators working with identity tokens, mobile devices, IoT/M2M, and secure credential management.
- Benefits
- Simplifies development by hiding APDU complexity.
- Encourages a small middleware footprint, improving portability of ICC functionality to constrained environments.
- Enables consistent access to embedded secure elements across mobile OSes and devices.
- Typical applications
- Mobile authentication, eSIM/iSIM provisioning, secure credential storage, payment and identity systems, and IoT devices requiring trusted hardware.
Related standards and references
- ISO/IEC 7816 series (APDU protocol and ICC behavior)
- ISO/IEC 24727 (device discoverability and middleware considerations)
- Existing APIs and middleware (OpenMobileAPI, PKCS#11) - noted for interoperability and contrast
- ISO/IEC 23465 series (Part 2: API definition; Part 3: Proxy - technical specifications referenced by this part)
Keywords: ISO/IEC 23465-1:2023, programming interface, security device API, APDU, secure element, smart card, proxy, embedded secure element, mobile security, TEE.