Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 18328 — ICC-managed Devices Series
Identification cards — ICC-managed devices (2015/2016)
📐 BS ISO/IEC 18328 is the British Standards Institution (BSI) adoption of ISO/IEC 18328, a series on identification cards under the general title Identification cards — ICC-managed devices, developed by ISO/IEC JTC 1/SC 17 (Cards and personal identification), with UK participation through IST/17. The series defines a special class of card: a card containing or externally connected to programmable devices (e.g., one-time-password generators, fingerprint sensors, rechargeable batteries, displays, keypads), which are managed uniformly by the card’s integrated circuit (ICC). Typical applications include bank OTP cards, fingerprint-verified payment cards, and secure token products with keypad and display.
💡 Meaning of “managed devices”: the card’s attached devices (display, keypad, battery, sensors, etc.) do not run independently — they are controlled and powered by the on-card chip, upgrading the traditional “static card” into an interactive, computable, securely authenticating “smart-card terminal”.
1. Structure and Scope of the Series 📌
The BS ISO/IEC 18328 series has three parts covering framework, physical & test, and interchange organization & security:
| Part | Standard No. | Subject | ICS |
|---|---|---|---|
| Part 1 | BS ISO/IEC 18328-1:2015 | General framework | 35.240.15 |
| Part 2 | BS ISO/IEC 18328-2:2015 | Physical characteristics and test methods for cards with devices | 35.240.15 |
| Part 3 | BS ISO/IEC 18328-3:2016 | Organization, security and commands for interchange | 35.240.15 |
⚠️ All three parts are first editions (2015/2016). Part 1 provides concepts and architecture, Part 2 targets manufacturing and testing, and Part 3 targets applications and interoperability. Use them together for product development.
2. General Framework (Part 1) 🔧
Part 1 specifies the general framework of ICC-managed devices, covering:
- Concepts and terms: ICC-managed device, managed unit, interfaces, and interactions;
- Architecture: the control and power relationship between the on-card chip and attached devices;
- General performance: the functional role of devices in identification, display, interaction, and security.
The part provides a unified conceptual foundation, avoiding ambiguity across vendors about “managed devices”.
3. Physical Characteristics and Test Methods (Part 2) 🔥
Part 2 specifies physical characteristics and test methods for cards with devices, covering:
- Physical characteristics: dimensions, thickness, bending and torsion strength, temperature and humidity tolerance for cards with display, keypad, sensor, and battery;
- Power consumption and supply: capacity, lifetime, and energy-saving requirements of on-board power (e.g., battery);
- Test methods: mechanical, environmental, and performance test procedures and acceptance criteria.
✅ Value: cards with devices differ significantly from traditional cards in thickness, strength, and energy consumption. Unified physical and test requirements ensure reliability and safety in wallets, terminals, and daily use.
4. Interchange Organization, Security and Commands (Part 3) 🛠️
Part 3 specifies the organization, security and commands for interchange, for interaction between the card and application systems:
- Architectural aspects: architecture, operational conditions, and interface organization of managed devices;
- Security: security mechanisms for device authentication, data transfer, and key use;
- Commands and interchange: the command set, data exchange, and interoperability rules between applications and devices.
🚨 Security note: the interchange channel of managed devices can be an attack surface (e.g., keypad recording, display tampering, battery power attacks). Apply chip-level protection and command validation per Part 3 security requirements.
5. Engineering Practice Essentials 🔍
- 🔍 One-time-password (OTP) cards: bank cards or online-banking tokens use a managed display and keypad to generate and enter dynamic passwords.
- 🔧 Biometric cards: an embedded fingerprint sensor is managed by the chip for local live-verification before payment.
- 📊 Manufacturing and acceptance: perform strength, power, and environmental tests on cards with devices per Part 2 test methods.
- 📋 Security compliance: implement device authentication and command security per Part 3 to meet financial-grade security evaluation requirements.
6. Frequently Asked Questions ❓
❓ Q: How do ICC-managed devices differ from traditional smart cards?
A: Traditional smart cards contain only a chip with no interactive devices; managed-device cards include display, keypad, and sensors managed by the ICC, enabling offline completion of more complex secure interactions.
A: Traditional smart cards contain only a chip with no interactive devices; managed-device cards include display, keypad, and sensors managed by the ICC, enabling offline completion of more complex secure interactions.
❓ Q: Why are physical characteristics and test methods specified separately?
A: Cards with battery, screen, and buttons are more complex in size, strength, and energy consumption, so dedicated requirements and tests are necessary for reliability and safety.
A: Cards with battery, screen, and buttons are more complex in size, strength, and energy consumption, so dedicated requirements and tests are necessary for reliability and safety.
❓ Q: Can managed-device cards be used for payment?
A: Yes. OTP cards and fingerprint payment cards are typical applications, but they must meet financial security requirements (e.g., key protection, side-channel resistance).
A: Yes. OTP cards and fingerprint payment cards are typical applications, but they must meet financial security requirements (e.g., key protection, side-channel resistance).
❓ Q: Can the three parts be used separately?
A: Concepts and vendor neutrality rely on Part 1; product development needs Parts 2 and 3; interoperability and security certification mainly rely on Part 3.
A: Concepts and vendor neutrality rely on Part 1; product development needs Parts 2 and 3; interoperability and security certification mainly rely on Part 3.