个人身份证明的卡和安全设备 通过移动设备实现身份管理的构建模块 第4部分：运行阶段的协议和服务

[中文适用范围]： 本文件规定了移动电子身份（mobile eID）系统运行阶段实施所需构建的模块，以及供各国政府机构或特定文档标准制定方根据需求创建配置文件的通用 mdoc（mobile document）相关规范。本文件明确了 mdoc 应用与 mdoc 读卡器之间的接口，以及 mdoc 读卡器与签发机构基础设施之间的接口。 具体而言，本文件定义了多种无线射频（RF）解决方案及基于互联网的传输协议；定义了应用层协议，包括 mdoc 应用与 mdoc 读卡器之间、以及 mdoc 读卡器与签发机构之间的请求 - 响应协议；同时规定了身份认证机制，涵盖签发方认证、mdoc 认证及证件持有人身份验证。 此外，本文件还规定了使除签发机构以外的各方能够执行以下操作的技术机制： - 使用设备获取 mdoc 数据； - 将 mdoc 与持有人进行绑定； - 验证 mdoc 数据的来源； - 验证 mdoc 数据的完整性。 以下事项不属于本文件的适用范围： - mdoc 数据的配置（该事项由 ISO/IEC TS 23220-3 规范）； - 持有人同意共享数据的方式获取过程； - 关于 mdoc 数据及 mdoc 私钥存储的要求。 最后，本文件提供了创建合规配置文件所需的相关信息。 [外文原描述]： This document specifies building blocks for the implementation of the operational phase of mobile eID systems and any other mdoc for national bodies or document-specific standards to create profiles according to their needs. This document specifies the interface between the mdoc app and mdoc reader and the interface between the mdoc reader and the issuing authority infrastructure. More specifically, this document defines transport protocols for various RF solutions and for over the internet. It defines the application layers, such as the request-response protocols between an mdoc app and mdoc reader and between an mdoc reader and issuing authority. It further defines the security mechanism for issuer authentication, mdoc authentication and credential holder verification. This document also specifies mechanisms enabling parties other than the issuing authority to: use a machine to obtain the mdoc data; bind the mdoc to the mdoc holder; authenticate the origin of the mdoc data; verify the integrity of the mdoc data. The following items are out of scope for this document: provisioning of the mdoc data (this is covered by ISO/IEC TS 23220-3); how holder’s consent to share data is obtained; requirements on storage of mdoc data and mdoc private keys. Finally, it provides information to create a conformant profile.