← Digital Identity System Architecture
IDMS
Glossary
The acronyms used across the identity architecture, in plain words.
Identity documents carry a dense vocabulary: data groups on the chip, the certificate authorities that sign them, the protocols that unlock them and the scores that decide whether a captured biometric is good enough. The terms below are grouped by where they appear in the system, and link through to the IDMS component that handles them.
5 terms
Systems
The back-end platforms behind an issuance programme.
- IDMSIdentity Management System
- The system that manages identity verification and issuance across the whole credential lifecycle, from the enrolment counter to revocation.Where it is used
- AFISAutomated Fingerprint Identification System
- Searches a captured fingerprint against an enrolled population to find duplicates or confirm a claimed identity.Where it is used
- ABISAutomated Biometric Identification System
- The multimodal form of the same idea — fingerprint, face and iris matched together rather than one modality alone.Where it is used
- KMSKey Management System
- Manages the lifecycle of cryptographic keys: generation, storage, rotation, escrow and destruction.Where it is used
- HSMHardware Security Module
- Tamper-resistant hardware that stores private keys and performs signing inside its own boundary, so the key material never appears in ordinary memory.Where it is used
7 terms
Chip data and the document
What is written on the credential and how it is structured.
- LDSLogical Data Structure
- The ICAO 9303-10 specification that fixes how data groups are laid out on the chip, so any reader in the world knows where to look.Where it is used
- DGData Group
- A structured container on the chip holding one class of biometric or biographic data. An e-Passport uses DG1 to DG14.Where it is used
- DG2Data Group 2
- The mandatory facial image, stored in JPEG 2000. Present in every ICAO-compliant e-Passport.Where it is used
- DG3Data Group 3
- Optional fingerprint data, protected by Extended Access Control. Mandatory for EU member states under EU Regulation 2252/2004.Where it is used
- DG4Data Group 4
- Optional iris data, also protected by Extended Access Control. Not included in EU e-Passports.Where it is used
- SODSecurity Object Document
- The digital signature covering all data groups. Change a single byte on the chip and the SOD no longer verifies.Where it is used
- MRZMachine Readable Zone
- The two or three fixed-width lines at the bottom of the data page, carrying the biographic data and its check digits in a form any optical reader can parse.Where it is used
3 terms
Chip access control
The protocols a reader must satisfy before the chip releases anything.
- BACBasic Access Control
- First-generation access control for e-Passports: the reader derives a session key from the MRZ, proving the book was physically opened.Where it is used
- PACEPassword Authenticated Connection Establishment
- The modern replacement for BAC, with far stronger session keys derived from the same printed data.Where it is used
- EACExtended Access Control
- The second layer that guards DG3 and DG4: only a terminal holding a valid certificate from the issuing country’s chain can read fingerprint or iris data. Mandatory for all EU e-Passports.Where it is used
6 terms
PKI and trust
The certificate chain that makes a document verifiable abroad.
- PKIPublic Key Infrastructure
- The cryptographic trust framework as a whole: keys, certificates, the authorities that issue them and the directories that publish them.Where it is used
- CSCACountry Signing Certificate Authority
- A country’s national root authority for e-Passports. It signs the Document Signer certificates and nothing else.Where it is used
- DSDocument Signer
- Signs the SOD on each document chip, under a certificate issued by the CSCA.Where it is used
- CVCACountry Verifying Certification Authority
- The root authority for Extended Access Control — the chain that decides which foreign terminals may read DG3 and DG4.Where it is used
- DVDocument Verifier
- Issues the terminal certificates used under EAC, so an inspection system can prove to the chip that it is entitled to the biometric data groups.Where it is used
- PKDPublic Key Directory
- ICAO’s global repository of CSCA certificates, Master Lists and revocation data — where a border system gets the keys to check a document it has never seen before.Where it is used
5 terms
Standards and quality
Who sets the rules, and how a captured biometric is scored against them.
- ICAOInternational Civil Aviation Organization
- Sets the e-Passport standards in Doc 9303 — the reason a passport issued anywhere can be read at any border.
- ISO/IEC 29794
- The biometric sample quality standards. Part 1 covers the framework, with Parts 4, 5 and 6 for finger, face and iris.Where it is used
- NFIQNIST Fingerprint Image Quality
- The fingerprint quality scoring algorithm, giving a captured print a usable-or-not score rather than leaving it to the operator’s eye.Where it is used
- NFIQ 2.0
- The updated algorithm, scoring 0 to 100 instead of the original coarse 1 to 5 bands.Where it is used
- IREXIris Exchange
- NIST’s iris recognition and quality evaluation programme, the reference point for iris algorithm performance.Where it is used
Keep reading
Planning an identity programme?
Tell us about your project and our team will come back with a proposal.
Get in Touch