ISO/IEC INTERNATIONAL 30136 STANDARD First edition 2018-03 Information technology Performance testing of biometric template protection schemes Technologies de I'information - Essais de performance des systemes de protection par modele Reference number IEC IS0/IEC 30136:2018(E) osi @ IS0/IEC 2018 IS0/IEC 30136:2018(E) COPYRIGHT PROTECTED DOCUMENT @ IS0/IEC 2018 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either IsO at the address below or Iso's member body in the country of the requester. ISO copyright office CP 401 : Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +41 22 749 01 11 Fax: +41 22 749 09 47 Email: [email protected] Website: www.iso.org Published in Switzerland i IS0/IEC 2018 - All rights reserved IS0/IEC 30136:2018(E) Contents Page Foreword ..iv Introduction ..V 1 Scope. 1 2 Normative references. ..1 3 Terms and definitions 4 Abbreviated terms ..3 5 Conformance. ..4 6 Methods for biometric template protection (informative) 6.1 .4 General 6.2 Generalized architecture for biometric template protection system. .5 6.3 Data separation .8 6.4 Examples of typical architectures in template protection systems. .8 6.4.1 Biometric verification utilizing multiple databases. .8 6.4.2 Two-factor biometric verification utilizing smart card. 6.4.3 ..10 Two-factor biometric verification utilizing passwords Overview of performance evaluation for biometric template protection schemes ..10 7 7.1 Methods for attacking a biometric template protection system. 10 7.2 Necessity of metrics beyond traditional recognition performance .10 7.3 Technology evaluation .11 7.4 Theoretical evaluation and empirical evaluation. ..11 7.5 Threat models. .11 7.5.1 Naive model. .12 7.5.2 Collision model .12 7.5.3 General models .12 Performance metrics for biometric template protection systems 8 ..13 .13 8.1 General 8.2 Case of multiple biometric access control systems. .13 8.3 Metrics for enrolment and verification performance .14 8.3.1 General. ..14 8.3.2 Accuracy degradation. .14 8.3.3 Template diversity 15 Storage requirement per registered individual 8.3.4 .16 8.4 Metrics for security and privacy protection performance ..16 8.4.1 Irreversibility .16 8.4.2 Unlinkability ..18 8.4.3 Successful Attack Rate (SAR) (optional) .19 Annex A (informative) Publication of algorithms or proofs used in performance evaluations. ..21 Bibliography .22 iii @ IS0/IEC 2018 - All rights reserved