Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 18013 โ ISO-compliant Driving Licence (Personal Identification) Series
Information technology โ Personal identification โ ISO-compliant driving licence (2008/2009/2011)
๐ BS ISO/IEC 18013 is the British Standards Institution (BSI) adoption of ISO/IEC 18013, a personal identification series under the general title Information technology โ Personal identification โ ISO-compliant driving licence (IDL), developed by ISO/IEC JTC 1/SC 17 (Cards and personal identification), with UK participation through IST/17. The series specifies machine-readable technologies, access control and integrity validation, and test methods for driving licences, enabling licences issued by different countries or regions to be read and verified consistently by cross-border equipment โ an important standard foundation for document security and mutual recognition.
๐ก The ISO-compliant driving licence (IDL) emphasizes “machine-readable + cryptographic verification”: Part 2 defines machine-readable functions and technologies, Part 3 defines access control and integrity validation, and Part 4 defines test methods โ forming a complete document verification chain. If any link is missing, the anti-forgery and mutual-recognition capability of the document is weakened.
1. Structure and Scope of the Series ๐
The BS ISO/IEC 18013 series has multiple parts. This batch covers Parts 2, 3, and 4. They share one overall goal: to enable a single driving licence to be reliably read and securely verified by standardized terminal equipment anywhere in the world, and to be mutually recognized across different jurisdictions.
| Part | Standard No. | Subject | ICS |
|---|---|---|---|
| Part 2 | BS ISO/IEC 18013-2:2008 | Machine-readable technologies (incl. December 2011 corrigendum) | 35.240.15 |
| Part 3 | BS ISO/IEC 18013-3:2009+A2:2014 | Access control, authentication, and integrity validation (incl. 2011/2013 corrigenda) | 35.240.15 |
| Part 4 | BS ISO/IEC 18013-4:2011 | Test methods (incl. November 2013 corrigendum) | 35.240.15 |
From a scope perspective, ISO/IEC 18013 targets driving licences used for “personal identification” purposes โ the licence serves both as proof of driving entitlement and as a widely accepted identity document. The Standard therefore pays particular attention to data privacy and anti-forgery, requiring designers to balance readability, security, and cost appropriately.
โ ๏ธ Each part includes corrigenda or amendments (e.g., Part 3 is 2009+A2:2014 with December 2011 and November 2013 corrigenda). Use the latest consolidated version. BSI publishes the status and corrigendum history for each version โ always verify before citing.
2. Machine-Readable Technologies (Part 2) ๐ง
Part 2 specifies the machine-readable functions and technologies of the ISO-compliant driving licence, covering:
- IDL machine-readable functionality: mandatory and optional functions; mandatory functions are the machine-readable capabilities every conforming licence must provide, while optional functions are adopted at the issuing authority’s discretion;
- Supported machine-readable technologies: barcodes (1D/2D), contact and contactless integrated circuits, machine-readable zone (MRZ), etc.; different technologies suit different verification scenarios โ barcodes support rapid scanning, while integrated circuits can carry higher-capacity and more secure data;
- Data organization and reading: structure, encoding, and consistency requirements of machine-readable data, ensuring readers can parse and reconstruct licence information correctly.
Machine-readable technologies allow law enforcement, border control, and rental scenarios to read licence information quickly and accurately, while providing the data carrier for subsequent access control and integrity validation. Part 2 also defines minimum and optional data field sets, covering holder name, date of birth, sex, nationality, validity, document number, and other basic information.
๐ก Machine-readable technologies and security mechanisms complement each other: machine readability determines “reads accurately,” while cryptography determines “verifies authentically.” A licence design must select a reliable machine-readable carrier and pair it with the appropriate security functionality.
3. Access Control and Integrity Validation (Part 3) ๐ฅ
Part 3 specifies access control, authentication, and integrity validation, whose core is preventing document data tampering and unauthorized reading:
- Access control mechanism: access permission control for machine-readable data zones, preventing unauthorized reading; for example, zones carrying biometric or sensitive personal data may be protected by access keys so only authenticated readers can access them;
- Authentication mechanism: mutual authentication between the document and the reader, plus document signature verification; the issuing authority’s authenticity is confirmed through a certificate chain, and a challenge-response protocol confirms the legitimacy of both reader and document;
- Integrity validation: verifying data has not been tampered with via cryptography (e.g., digital signature, hash); any modification to the data causes validation failure.
โ
Value: integrity validation and access control are key to document security, effectively identifying forged or altered licences and ensuring safe cross-border mutual recognition. Combined with a public key infrastructure (PKI) and document signatures, they establish a trust chain from the issuing authority to the verification terminal.
4. Test Methods (Part 4) ๐ ๏ธ
Part 4 specifies test methods, providing repeatable test procedures to verify whether an ISO-compliant driving licence meets the requirements of Parts 2 and 3:
- Test environment, test samples, and test equipment requirements; it defines conditions such as temperature, humidity, mechanical stress, and illumination, as well as sample extraction and pre-treatment methods;
- Test cases and acceptance criteria for machine-readable functions, access control, and integrity validation; each machine-readable technology and security function is given explicit pass/fail criteria;
- Test report and conformance determination flows, including result recording, report format, and dispute-handling mechanisms.
๐จ Implementation note: the test methods cover functional and security performance. It is advisable to perform them in production, acceptance, and routine sampling to ensure batch consistency and compliance. Any new machine-readable technology or security mechanism should pass the corresponding Part 4 test cases before large-scale issuance.
5. Engineering Practice Essentials ๐
Around the BS ISO/IEC 18013 series, several engineering-practice points deserve particular attention:
- ๐ Document design and issuance: per Parts 2 and 3, select machine-readable technology and security mechanisms, balancing anti-forgery strength and production cost; choose an appropriate trade-off between data capacity, read speed, and security strength for the application.
- ๐ง Verification terminals: deploy readers supporting Part 3 verification in border control, traffic police, and rental systems; terminals should regularly update certificates and keys to keep the trust chain current.
- ๐ Interoperability verification: verify device and document conformance per Part 4 test methods for cross-system consistency; in cross-border scenarios, conduct joint testing with target-country terminals in advance.
- ๐ Privacy protection: access-control design should minimize personal data exposure and comply with data protection regulations; only authorized personnel may access sensitive fields, and access events should be audited.
โ ๏ธ Privacy and compliance are non-negotiable red lines: a licence may contain sensitive personal data such as biometrics. Access-control design must satisfy both the verification needs of enforcement and mutual recognition and the principles of minimization, purpose limitation, and data erasure, to prevent misuse or leakage of personal information.
6. Frequently Asked Questions โ
โ Q: How does an ISO-compliant driving licence differ from an ordinary licence?
A: An ISO-compliant driving licence follows ISO/IEC 18013 machine-readable and security requirements, so it can be read and verified consistently by standardized equipment across countries, facilitating mutual recognition; an ordinary licence may lack a unified machine-readable format and cryptographic verification capability.
A: An ISO-compliant driving licence follows ISO/IEC 18013 machine-readable and security requirements, so it can be read and verified consistently by standardized equipment across countries, facilitating mutual recognition; an ordinary licence may lack a unified machine-readable format and cryptographic verification capability.
โ Q: Why is access control needed?
A: Access control prevents unauthorized reading of document data (e.g., biometrics, personal privacy), protecting the licence holder’s information security; it also prevents attackers from using read data to forge or clone the document.
A: Access control prevents unauthorized reading of document data (e.g., biometrics, personal privacy), protecting the licence holder’s information security; it also prevents attackers from using read data to forge or clone the document.
โ Q: How is integrity validation implemented?
A: Through cryptographic means such as digital signatures and hashes, verifying data has not been tampered with; tampering causes verification failure, identifying forged documents. Signature verification relies on a trust chain established by the issuing authority’s public-key certificate.
A: Through cryptographic means such as digital signatures and hashes, verifying data has not been tampered with; tampering causes verification failure, identifying forged documents. Signature verification relies on a trust chain established by the issuing authority’s public-key certificate.
โ Q: Why does Part 4 specify test methods separately?
A: Unified test methods make the performance of different devices and document batches comparable and acceptance judgeable, ensuring quality consistency; they also provide a common technical basis for cross-agency and cross-country mutual recognition.
A: Unified test methods make the performance of different devices and document batches comparable and acceptance judgeable, ensuring quality consistency; they also provide a common technical basis for cross-agency and cross-country mutual recognition.
๐ Q: What compliance requirements should be considered when adopting this series?
A: Use the latest consolidated version (including corrigenda and amendments) and cite the complete standard number in technical documents; balance data protection regulations in access-control design; in cross-border scenarios, verify compatibility with target-country terminals and request conformance test reports.
A: Use the latest consolidated version (including corrigenda and amendments) and cite the complete standard number in technical documents; balance data protection regulations in access-control design; in cross-border scenarios, verify compatibility with target-country terminals and request conformance test reports.