← Digital Identity System Architecture
IDMS
Glossary
The acronyms used across the identity architecture, in plain words.
Identity documents carry a dense vocabulary: data groups on the chip, the certificate authorities that sign them, the protocols that unlock them and the scores that decide whether a captured biometric is good enough. The terms below are grouped by where they appear in the system, and link through to the IDMS component that handles them.
5 terms
Systems
The back-end platforms behind an issuance programme.
- IDMSIdentity Management System
- The system that manages identity verification and issuance across the whole credential lifecycle, from the enrollment counter to revocation.Where it is used
- AFISAutomated Fingerprint Identification System
- Searches a captured fingerprint against an enrolled population to find duplicates or confirm a claimed identity.Where it is used
- ABISAutomated Biometric Identification System
- The multimodal form of the same idea — fingerprint, face and iris matched together rather than one modality alone.Where it is used
- KMSKey Management System
- Manages the lifecycle of cryptographic keys: generation, storage, rotation, escrow and destruction.Where it is used
- HSMHardware Security Module
- Tamper-resistant hardware that stores private keys and performs signing inside its own boundary, so the key material never appears in ordinary memory.Where it is used
7 terms
Chip data and the document
What is written on the credential and how it is structured.
- LDSLogical Data Structure
- The ICAO 9303-10 specification that fixes how data groups are laid out on the chip, so any reader in the world knows where to look.Where it is used
- DGData Group
- A structured container on the chip holding one class of biometric or biographic data. An e-Passport uses DG1 to DG14.Where it is used
- DG2Data Group 2
- The mandatory facial image, stored in JPEG 2000. Present in every ICAO-compliant e-Passport.Where it is used
- DG3Data Group 3
- Optional fingerprint data, protected by Extended Access Control. Mandatory for EU member states under EU Regulation 2252/2004.Where it is used
- DG4Data Group 4
- Optional iris data, also protected by Extended Access Control. Not included in EU e-Passports.Where it is used
- SODSecurity Object Document
- The digital signature covering all data groups. Change a single byte on the chip and the SOD no longer verifies.Where it is used
- MRZMachine Readable Zone
- The two or three fixed-width lines at the bottom of the data page, carrying the biographic data and its check digits in a form any optical reader can parse.Where it is used
3 terms
Chip access control
The protocols a reader must satisfy before the chip releases anything.
- BACBasic Access Control
- First-generation access control for e-Passports: the reader derives a session key from the MRZ, proving the book was physically opened.Where it is used
- PACEPassword Authenticated Connection Establishment
- The modern replacement for BAC, with far stronger session keys derived from the same printed data.Where it is used
- EACExtended Access Control
- The second layer that guards DG3 and DG4: only a terminal holding a valid certificate from the issuing country's chain can read fingerprint or iris data. Mandatory for all EU e-Passports.Where it is used
6 terms
PKI and trust
The certificate chain that makes a document verifiable abroad.
- PKIPublic Key Infrastructure
- The cryptographic trust framework as a whole: keys, certificates, the authorities that issue them and the directories that publish them.Where it is used
- CSCACountry Signing Certificate Authority
- A country's national root authority for e-Passports. It signs the Document Signer certificates and nothing else.Where it is used
- DSDocument Signer
- Signs the SOD on each document chip, under a certificate issued by the CSCA.Where it is used
- CVCACountry Verifying Certification Authority
- The root authority for Extended Access Control — the chain that decides which foreign terminals may read DG3 and DG4.Where it is used
- DVDocument Verifier
- Issues the terminal certificates used under EAC, so an inspection system can prove to the chip that it is entitled to the biometric data groups.Where it is used
- PKDPublic Key Directory
- ICAO's global repository of CSCA certificates, Master Lists and revocation data — where a border system gets the keys to check a document it has never seen before.Where it is used
5 terms
Standards and quality
Who sets the rules, and how a captured biometric is scored against them.
- ICAOInternational Civil Aviation Organization
- Sets the e-Passport standards in Doc 9303 — the reason a passport issued anywhere can be read at any border.
- ISO/IEC 29794
- The biometric sample quality standards. Part 1 covers the framework, with Parts 4, 5 and 6 for finger, face and iris.Where it is used
- NFIQNIST Fingerprint Image Quality
- The fingerprint quality scoring algorithm, giving a captured print a usable-or-not score rather than leaving it to the operator's eye.Where it is used
- NFIQ 2.0
- The updated algorithm, scoring 0 to 100 instead of the original coarse 1 to 5 bands.Where it is used
- IREXIris Exchange
- NIST's iris recognition and quality evaluation programme, the reference point for iris algorithm performance.Where it is used