Read this if you are a division of motor vehicles, or interested in mDLs.
It can be challenging to learn about the technical specifications that must be met to safely acquire, implement, and use emerging technologies. And why wouldn’t it be? Technical specifications are full of jargon only a technical expert can understand, and seem to appear out of thin air. Well, BerryDunn is here to help. When it comes to mobile driver’s licenses (mDLs), we’ve got the scoop.
Technical standards are developed by a few large international organizations. The International Organization for Standardization (ISO) is a Swiss-based organization responsible for the development of international standards for technical, industrial, and commercial industries in 165 countries. The International Electrotechnical Commission (IEC) is an international standards organization that develops and publishes standards for electronic technologies. The ISO and IEC have been collaborating on international technical standards for mDL technology. Recently, the ISO/IEC finalized and published these standards, which can be purchased on ISO’s website for $198 Swiss francs (about $213 US).
These technical standards cover three key components:
- Data exchanged during an mDL transaction
- Security during online and offline mDL transaction scenarios
- mDL data model to ensure mDL interoperability
Data exchange/transaction
Data exchange is the process by which an mDL device is used to provide credentials (e.g., verify age or identity) to an mDL reader. Broadly speaking, data exchange consists of three phases: initialization (activating your device at a store to confirm your identity), device engagement (the mDL device creates a connection with the mDL reader), and data retrieval (the mDL reader requests the appropriate data to continue a transaction). The process can occur when the mDL has an internet connection (online retrieval) or when it does not have an internet connection (offline retrieval). Offline data retrieval can be conducted using a combination of Bluetooth Low Energy (BLE), Near-Field Communication (NFC), or Wi-Fi Aware technologies. These are all methods by which an mDL can connect to mDL readers at short ranges, functionally similar to Apple Pay. Online Data retrieval can be conducted using a web-based application programming interface (WebAPI) or OpenID Connect (OIDC). These are methods by which mDLs connect with the mDL issuer, confirm the mDL holder’s identity, and allow the mDL issuer to transfer data to the mDL reader. In short, an mDL transaction might look something like this:
- Initialization: An mDL holder attempts to purchase alcohol from a local store. The mDL holder opens their device, enters their mDL application using a PIN or biometric security feature, and uses NFC or a QR code to initiate a connection between the mDL and mDL reader.
- Device engagement: The mDL and mDL reader connect using NFC or a QR code.
- Data retrieval: The mDL reader either asks the mDL for data to confirm the holder’s age, or asks the mDL issuer to confirm the mDL holder’s age. Either the mDL or mDL issuer sends appropriate data to the mDL reader to confirm the holder’s age. Once validated, the mDL-reading establishment and mDL holder are free to complete the transaction.
Security for mobile driver’s licenses
mDL security aims to protect against four primary threats.
- mDL forgery/forgery of data elements
- mDL cloning/cloning of data elements
- mDL communication eavesdropping
- Unauthorized mDL access
mDL security needs to cover online scenarios, in which an mDL-holder’s device is connected to the internet, as well as offline scenarios, when an mDL holder’s device does not have internet connectivity. Potential mDL security options include:
- Authentication of mDL data to protect against data cloning
- Authentication of the legitimacy of the mDL reader to prevent alteration of communications between the mDL and mDL reader
- Session encryption to preserve mDL data confidentiality and prevent mDL data alteration or unauthorized data access
- Issuer data authentication to ensure the mDL data originates at a legitimate issuing authority
During online retrieval scenarios, mDLs can employ transport layer security (TLS) to preserve the confidentiality of mDL data, or use a JavaScript Object Notation (JSON) Web Token (JWT) to authenticate mDL data origin.
mDL technical specifications: Key terms and definitions
Technical specifications are an important, yet confusing aspect of IT system implementations, particularly for emerging technologies where expertise has not yet been established within the market. The same holds true for mDLs. Understanding mDL technical specifications requires understanding the specific terms used to describe the technical specifications along with general mDL terminology. Here’s a list of mDL-related and technical specification terms and definitions.
Key terms and definitions
| Terms |
Definitions |
| Bluetooth Low Energy (BLE) |
A form of Bluetooth that provides a wireless connectivity of similar range to traditional Bluetooth at reduced device power consumption. |
| IEC |
International Electrotechnical Commission |
| ISO |
International Organization for Standardization |
| JavaScript Object Notation (JSON) |
An open standard file format and data interchange format that uses human-readable text to store and transmit data objects. |
| JSON Web Token (JWT) |
An object used to transfer information between two parties over the web. |
| mDL issuer |
The department of motor vehicles or bureau of motor vehicles responsible for administering rights to, and overseeing distribution of, mDL data to mDL holders. |
| mDL holder |
The person whose data is contained in, and represented by, the mDL. |
| mDL reader |
The hardware technology used to consume mDL data from an mDL holder’s device. |
| mDL-reading establishment |
The institution consuming mDL data via an mDL reader (e.g., law enforcement, liquor store, Transportation Safety Administration). |
| Near-Field Communication (NFC) |
Communication protocols that allow electronic devices to communicate over distances of 1.5 inches or less (e.g., Apple Pay). |
| Offline retrieval |
The mDL holder’s device is not directly connected to an internet network via Wi-Fi or cellular data, requiring the mDL device to hold some mDL data—behind security features (e.g., PIN, or biometric lock)—and, at a minimum, confirm holder identity, driving privileges, age, and residence. |
| Online retrieval |
The mDL holder’s device is connected to an internet network via Wi-Fi or cellular data. Upon request, the mDL holder can initiate a transfer of mDL data using a QR code or web token to approve the sharing of mDL data between the mDL issuer and mDL reader. |
| OpenID Connect (OIDC) |
OpenID Connect is an authentication protocol that allows for the verification of end user identity. |
| Transport Layer Security (TLS) |
A cryptographic protocol that provides communication security over a computer network (e.g., between an mDL reader and mDL issuer). |
| Web Application Programming Interface (API) |
An interface for a web server or web browser. |
| Wi-Fi Aware |
A Wi-Fi capability that allows devices to discover potential Wi-Fi connections nearby without connecting to them. Wi-Fi Aware runs in the background, and does not require users to have current Wi-Fi or cellular connections. |
If you have any questions regarding mDLs and technical requirements, please contact us. We’re here to help.