Introduction

Biometric technologies are used to recognize individuals based on biological and behavioural characteristics. Consequently, they are often used as a component in security systems. A biometric technology assisted security system can attempt to recognize persons who are known as either friends or foes or can attempt to recognize persons who are unknown to the system as either.

Since the beginning of these technologies, the possibility of subversion of recognition by determined adversaries has been widely acknowledged, as has the need for countermeasures to detect and defeat subversive recognition attempts, or presentation attacks. Subversion of the intended function of a biometric technology can take place at any point within a security system and by any actor, whether a system insider or an external adversary. However, the ISO/IEC 30107 series is limited in scope, focusing on mechanisms for the automated detection of presentation attacks undertaken by biometric capture subjects at the capture device during the presentation of the biometric characteristics. These automated mechanisms are referred to as “presentation attack detection” (PAD) methods. Morphing attacks, where biometric samples that are manipulated to match two or more biometric data subjects are submitted during enrolment, are not considered in the ISO/IEC 30107 series, though the performance assessment methods are similar for PAD and morphing attack detection mechanisms.

The potential for subversion of biometric systems at the point of data collection by determined individuals acting as biometric capture subjects has limited the use of biometrics in applications which are unsupervised by an agent of the system owner, such as remote collections over untrusted networks. Guidelines on e-authentication, for example, do not recommend the use of biometrics as an authentication factor for this reason. In unattended applications, such as remote authentication over open networks, automated presentation attack detection methods can be applied to mitigate the risks of attack. Standards, best practices and independently-evaluated mechanisms can improve the security of all systems employing biometrics, whether using supervised or unsupervised data capture, including those using biometric recognition to secure online transactions.

As is the case for biometric recognition, PAD mechanisms are subject to errors, both false positive and false negative: false positive indications wrongly categorize bona-fide presentations as attacks, thus impairing the efficiency of the system, and false negative indications wrongly categorize presentation attacks as bona fide, not preventing a security breach. Therefore, the decision to use a specific implementation of PAD depends upon the requirements of the application and consideration of the trade-offs with respect to security and efficiency.

The purpose of this document is to provide a foundation for PAD by defining terms and establishing a framework through which presentation attack events can be specified and detected so that they can be categorized, detailed, and communicated for subsequent biometric system decision-making and performance assessment activities. This foundation will also benefit other standardization projects in ISO/IEC committees and subcommittees. This document does not advocate a specific mechanism as a standard PAD tool.

There are currently three other parts in the ISO/IEC 30107 series. ISO/IEC 30107‑2 defines data formats for conveying the type of approach used in biometric presentation attack detection and for conveying the results of PAD methods. The data formats defined in ISO/IEC 30107‑2 are integrated into the extensible biometric data interchange formats defined in the ISO/IEC 39794 series. ISO/IEC 30107‑3 establishes principles and methods for performance assessment of PAD mechanisms. ISO/IEC 30107‑4 provides requirements for assessing the performance of PAD mechanisms on mobile devices with local biometric recognition.

BS ISO/IEC 30107-1:2023

Information technology. Biometric presentation attack detection - Framework

Current

Published:

31 Aug 2023