Overview
ISO/IEC 7816-7:1999 defines the interindustry commands for Structured Card Query Language (SCQL), a database query language based on SQL, for integrated circuit cards with contacts (commonly known as smart cards). Developed by ISO and IEC, Part 7 of the ISO/IEC 7816 series establishes the concept of a SCQL database and prescribes related enhanced commands that enable secure, interoperable management of card-resident databases across multiple applications and industries.
This standard enables smart cards to store, retrieve, and manage structured information through a standardized SQL-based interface, facilitating consistent data handling in identification cards used globally.
Key Topics
-
SCQL Database Model:
The standard introduces the SCQL database, comprising tables, views, and dictionaries. SCQL is based on the familiar SQL model (referencing ISO/IEC 9075), enabling powerful, flexible data operations directly on the card.
-
Database Objects:
- Tables: Structured with named columns and rows for data storage.
- Views: Logical subsets of tables for defining access restrictions (static or dynamic).
- Dictionaries: Read-only views on system tables used for management and access control.
-
User Profiles and Access Control:
User roles such as Database Owner (DB_O), Database Object Owner (DBOO), and Database Basic User (DBBU) are defined, with associated permissions ensuring security and controlled access.
-
Interindustry Commands:
Commands like CREATE TABLE, CREATE VIEW, INSERT, UPDATE, DELETE, and transaction management (BEGIN, COMMIT, ROLLBACK) are standardized as Application Protocol Data Units (APDUs), allowing for interoperability across card platforms.
-
Security Attributes:
Built-in mechanisms for user authentication and data confidentiality, ensuring that only authorized users may view or modify sensitive data stored on smart cards.
-
System Tables:
System-maintained tables (object, user, and privilege description) support core functions like defining database structure, user management, and privilege assignments.
Applications
ISO/IEC 7816-7 finds practical application in any environment requiring secure, structured card-based data storage and retrieval. Typical use cases include:
-
Banking and Secure Payments:
Enabling financial institutions to safely store customer profiles, transactions, and authentication data on chip cards.
-
Identity Verification:
Government-issued identity cards, driving licenses, and health cards use SCQL-enabled smart cards for secure access to personal records.
-
Access Control Systems:
Organizations employ interoperable cards for facility access, leveraging the security and data management capabilities described by the standard.
-
Multi-application Smart Cards:
Facilitates the integration of several applications (e.g., transit passes, loyalty programs) on a single card, with controlled data sharing and user authentication.
By adopting SCQL and these interindustry commands, card issuers and solution providers benefit from standardized database management, enhanced security, and broad interoperability.
Related Standards
ISO/IEC 7816-7:1999 aligns with several key international standards for smart cards and SQL-based database management:
- ISO/IEC 7816-4: Specifies general interindustry commands for interchange.
- ISO/IEC 7816-6: Defines interindustry data elements for IC cards with contacts.
- ISO/IEC 9075: Establishes the SQL database language foundation upon which SCQL is built.
- Other Parts of ISO/IEC 7816: Cover physical characteristics, contact dimensions, and security-related commands, forming a comprehensive suite for IC card standardization.
Keywords: ISO/IEC 7816-7, SCQL, smart card security, integrated circuit cards, smart card database, SQL in smart cards, card-based authentication, interindustry commands, identification cards with contacts, card data management
By following ISO/IEC 7816-7, organizations ensure secure, consistent, and interoperable management of card-resident databases for a range of applications worldwide.