Overview
ISO/IEC 24727-4:2008 - "Identification cards - Integrated circuit card programming interfaces - Part 4: Application programming interface (API) administration" defines the connectivity and security mechanisms that mediate between client‑applications and card‑applications on integrated circuit cards (ICCs / smart cards). As part of the ISO/IEC 24727 family, Part 4 standardizes service‑independent, implementation‑independent API administration, enabling action requests to specific card‑applications while supporting discovery of data models and content for multi‑sector interoperability.
Keywords: ISO/IEC 24727-4, API administration, smart card API, integrated circuit card, trusted channel, ICC interoperability
Key Topics
- API‑Administration scope: Administration of ISO/IEC 24727‑compliant modules to enable client → card action requests across diverse implementations.
- Architecture specialization: Defined stack variants (e.g., full‑network‑stack, loyal‑stack, opaque‑ICC‑stack, remote‑loyal‑stack, ICC‑resident‑stack, remote‑ICC‑stack) that describe where components and trust boundaries reside.
- Security architecture: Path‑protection policies, channel types (trusted, loyal, dubious), confidentiality and integrity concepts, and access control mapping (ACL → ACR).
- Trusted channels and secure messaging: Mechanisms for confidentiality, integrity and authenticity of messages; trusted‑channel key administration and secure messaging semantics.
- Connection components and semantics: Action request/response semantics, proxy/agent architectures, and the TC_API (trusted‑channel API) operations (Open, Close, Read, Write, Reset, GetStatus).
- Interface Device (IFD) API: Device management operations (EstablishContext, ListIFDs, Connect/Disconnect, Transmit, VerifyUser, Output, SignalEvent, etc.) and support for web‑service bindings.
- Annexes: Normative mechanisms for path protection and Web Service bindings for IFD APIs and callbacks.
Applications
ISO/IEC 24727-4 is practical for organizations implementing interoperable smart‑card ecosystems where secure client‑to‑card communication and administration are required:
- Middleware and SDK vendors building card access libraries and API administration layers
- System integrators deploying national ID, e‑ID, e‑government, payment, healthcare and access‑control solutions using ICCs
- Card and reader manufacturers implementing trusted‑channel interfaces and IFD APIs
- Security architects defining path‑protection policies, ACLs and secure messaging between client apps and card apps
Related Standards
- ISO/IEC 24727 (Parts 1–3, 5–6) - architecture, generic card interface, application interface, testing, registration
- ISO/IEC 7816‑4 - ICC organization, security and APDU commands
- ISO/IEC 9797‑1 - MAC mechanisms
- IETF RFC 2246 (TLS v1.0) - transport security reference
Adopting ISO/IEC 24727‑4 helps ensure interoperable, secure API administration for smart‑card applications across sectors and platforms.