ISO/IEC 19989-3:2020 PDF

Information security — Criteria and methodology for security evaluation of biometric systems — Part 3: Presentation attack detection

Первая страница стандарта ISO/IEC 19989-3:2020

Открыть превью (PDF)

Название (английский):

ISO/IEC 19989-3:2020

Information security — Criteria and methodology for security evaluation of biometric systems — Part 3: Presentation attack detection

Статус документа:: Действующий
Формат:: Электронный (PDF)
Количество страниц:: 18
Дата публикации:: 18 сентября 2020 г.
Издание:: ISO/IEC IS 19989 edition 1 version 1
ICS:: 35.030

Язык документа:

ruen

Срок поставки:3 раб. дн. (перевод)

Цена:270 €

Описание (английский):

For security evaluation of biometric verification systems and biometric identification systems, this document is dedicated to security evaluation of presentation attack detection applying the ISO/IEC 15408 series. It provides recommendations and requirements to the developer and the evaluator for the supplementary activities on presentation attack detection specified in ISO/IEC 19989-1. This document is applicable only to TOEs for single biometric characteristic type but for the selection of a characteristic from multiple characteristics.

Технические детали

Технический комитет: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
SKU: ISO/IEC 19989-3:2020

Abstract

Overview

ISO/IEC 19989-3:2020 specifies criteria and methodology for security evaluation of presentation attack detection (PAD) in biometric systems. It supplements the ISO/IEC 15408 evaluation framework and ISO/IEC 19989-1 by providing recommendations and requirements for developers and evaluators performing PAD testing and vulnerability assessment. The standard applies to Targets of Evaluation (TOEs) that implement a single biometric characteristic (or select one characteristic from multiple options).

Key topics and technical requirements

PAD testing classes (ATE and AVA): Defines objectives and principles for automated testing (Class ATE) and vulnerability assessment/penetration testing (Class AVA).
PAI (Presentation Attack Instrument) management: Guidance on types of PAIs to use in tests, including PAI species classification and non-standard PAIs.
PAD metrics and definitions: Implements ISO/IEC 30107-3 metrics such as APCER, BPCER, APAR, APNRR, BPNRR, IAPMR/IAPIR, and related rates used to quantify PAD performance.
Testing approach and activities: Supplementary activities to ISO/IEC 18045 covering test design, minimum test sizes, maximum error rates, and pass/fail criteria for PAD subsystems and full-system evaluations.
Vulnerability assessment (AVA): Procedures for penetration testing using PAI variations, identifying potential vulnerabilities, and rating TOE resistance to presentation attacks.
Reporting and calculations: Examples of attack potential calculations (Annex A) and reporting guidelines to ensure repeatable, objective evaluation outcomes.

Applications and who uses it

ISO/IEC 19989-3 is used by:

Biometric product developers to design PAD features and document testing evidence for security evaluations.
Evaluation labs and certification bodies performing security assurance tasks under the ISO/IEC 15408 framework.
System integrators and procurers who need objective PAD performance and vulnerability data for procurement decisions.
Security architects and risk assessors assessing biometric system resilience to presentation attacks. Practical use cases include access control, e‑ID, border control, financial authentication, and any system where biometric verification/identification must resist spoofing.

Related standards

ISO/IEC 15408 (Common Criteria for IT security evaluation)
ISO/IEC 18045 (Evaluation methodology)
ISO/IEC 19989-1 (Framework for biometric security evaluation)
ISO/IEC 30107-3 (Biometric PAD testing and reporting)
ISO/IEC 19792 (Biometric performance and security principles)

ISO/IEC 19989-3:2020 provides a focused, standardized approach to measuring and reporting PAD effectiveness-crucial for trustworthy biometric deployments and procurement. Keywords: ISO/IEC 19989-3, presentation attack detection, PAD testing, biometric evaluation, APCER, BPCER, PAI, biometric security.

Overview

Key topics and technical requirements

PAD testing classes (ATE and AVA): Defines objectives and principles for automated testing (Class ATE) and vulnerability assessment/penetration testing (Class AVA).
PAI (Presentation Attack Instrument) management: Guidance on types of PAIs to use in tests, including PAI species classification and non-standard PAIs.
PAD metrics and definitions: Implements ISO/IEC 30107-3 metrics such as APCER, BPCER, APAR, APNRR, BPNRR, IAPMR/IAPIR, and related rates used to quantify PAD performance.
Testing approach and activities: Supplementary activities to ISO/IEC 18045 covering test design, minimum test sizes, maximum error rates, and pass/fail criteria for PAD subsystems and full-system evaluations.
Vulnerability assessment (AVA): Procedures for penetration testing using PAI variations, identifying potential vulnerabilities, and rating TOE resistance to presentation attacks.
Reporting and calculations: Examples of attack potential calculations (Annex A) and reporting guidelines to ensure repeatable, objective evaluation outcomes.

Applications and who uses it

ISO/IEC 19989-3 is used by:

Biometric product developers to design PAD features and document testing evidence for security evaluations.
Evaluation labs and certification bodies performing security assurance tasks under the ISO/IEC 15408 framework.
System integrators and procurers who need objective PAD performance and vulnerability data for procurement decisions.
Security architects and risk assessors assessing biometric system resilience to presentation attacks. Practical use cases include access control, e‑ID, border control, financial authentication, and any system where biometric verification/identification must resist spoofing.

Related standards

ISO/IEC 15408 (Common Criteria for IT security evaluation)
ISO/IEC 18045 (Evaluation methodology)
ISO/IEC 19989-1 (Framework for biometric security evaluation)
ISO/IEC 30107-3 (Biometric PAD testing and reporting)
ISO/IEC 19792 (Biometric performance and security principles)

ISO/IEC 19989-3:2020 PDF

Технические детали

Abstract

Overview

Key topics and technical requirements

Applications and who uses it

Related standards

Похожие стандарты

Abstract

Overview

Key topics and technical requirements

Applications and who uses it

Related standards

Похожие стандарты

Information security, cybersecurity and privacy protection. Evaluation criteria for IT security. Security ass…

Information security — Criteria and methodology for security evaluation of biometric systems — Part 1: Framew…

Information technology — Biometric presentation attack detection — Part 3: Testing and reporting

Information security, cybersecurity and privacy protection — Evaluation criteria for IT security — Requiremen…

Information security, cybersecurity and privacy protection. General principles, requirements and guidance for…