Introduction

Biometric technologies are used to recognize individuals based on biological and behavioural characteristics and, consequently, are often used as a component in security systems. A biometric technology assisted security system may attempt to recognize persons who are known as either friends or foes, or may attempt to recognize persons who are unknown to the system as either.

Since the beginning of these technologies, the possibility of subversion of recognition by determined adversaries has been widely acknowledged, as has the need for countermeasures to detect and defeat subversive recognition attempts, or presentation attacks. Subversion of the intended function of a biometric technology can take place at any point within a security system and by any actor, whether a system insider or an external adversary. This International Standard (ISO/IEC 30107) will be limited in scope, however, focusing on techniques for the automated detection of presentation attacks undertaken by biometric capture subjects at the point of presentation and collection of the relevant biometric characteristics. We will call these automated techniques “Presentation Attack Detection” (PAD) methods.

The potential for subversion of biometric systems at the point of data collection by determined individuals acting as biometric capture subjects has limited the use of biometrics in applications which are unsupervised by an agent of the system owner, such as remote collections over untrusted networks. Guidelines on e-authentication, for example, do not recommend the use of biometrics as an authentication factor for this reason. In unattended applications, such as remote authentication over open networks, automated presentation attack detection methods could be applied to mitigate the risks of attack. Standards, best practices and independently evaluated techniques could improve the security of all systems employing biometrics, whether using supervised or unsupervised data capture, including those using biometric recognition to secure online transactions.

As is the case for biometric recognition, PAD techniques are subject to errors, both false positive and false negative: false positive indications wrongly categorize routine presentations as attacks, thus impairing the efficiency of the system, and false negative indications wrongly categorize presentation attacks as routine, not preventing a security breach. Therefore, the decision to use a specific implementation of PAD will depend upon the requirements of the application and consideration of the trade-offs with respect to security and efficiency.

The purpose of this part of ISO/IEC 30107 is to provide a foundation for PAD through defining terms and establishing a framework through which presentation attack events can be specified and detected so that they can be categorized, detailed and communicated for subsequent biometric system decision making and performance assessment activities. This foundation will also benefit other standards projects in ISO/IEC committees and sub-committees. This International Standard does not advocate a specific technique as a standard PAD tool.

There are two other parts of ISO/IEC 30107. Part 2 defines data formats for conveying the type of approach used in biometric presentation attack detection and for conveying the results of presentation attack detection methods. Part 3 establishes principles and methods for performance assessment of presentation attack detection algorithms or mechanisms.

BS ISO/IEC 30107-1:2016

Information technology. Biometric presentation attack detection - Framework

Published:

31 Jan 2016

Withdrawn:

22 Aug 2023