ISO/IEC 19785-4:2010 情報技術—一般的な生体認証交換フォーマットフレームワーク—パート4：セキュリティブロックフォーマットの仕様 | ページ 2

3.1 ISO/IEC 19785-1 で定義される用語

この文書の目的上、ISO/IEC 19785-1 で定義されている次の用語が適用されます。

生体認証、生体認証、生体認証データ ブロック (BDB)、生体認証情報レコード (BIR)、CBEFF 生体認証組織、セキュリティ ブロック (SB)、セキュリティ ブロック フォーマット、セキュリティ ブロック フォーマット識別子、セキュリティ ブロック フォーマット所有者、標準生体認証ヘッダー (SBH)

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.

International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.

The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.

ISO/IEC 19785-4 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 37, Biometrics.

ISO/IEC 19785 consists of the following parts, under the general title Information technology — Common Biometric Exchange Formats Framework:

• Part 1: Data element specification
• Part 2: Procedures for the operation of the Biometric Registration Authority
• Part 3: Patron format specifications
• Part 4: Security block format specifications

Introduction

Biometric verification and identification are important techniques for the authentication and/or identification of an individual. Biometric data used in biometric verification and identification has to be from a trusted source with no interference in transmission (integrity). It might or might not be necessary for it to be kept secret (encryption) depending on security policy. This part of ISO/IEC 19785 provides for both integrity and encryption of the biometric data.

To ensure interoperability, the Common Biometric Exchange Formats Framework (CBEFF) was specified in ISO/IEC 19785-1 to associate meta-data with one or more Biometric Data Blocks (BDBs). In ISO/IEC 19785-1, the options for integrity and encryption, and the concept of a security block (SB) to contain security information related to these options are defined, but the format and detailed content of security blocks (SB formats) are not specified.

There are several steps in the chain, starting from a CBEFF patron format.

First, the patron format can determine that the abstract value of the CBEFF data element CBEFF_BDB_encryption_options is fixed as NO ENCRYPTION and that the CBEFF data element CBEFF_BIR_integrity_options is fixed as NO INTEGRITY. In this case, there is no need for a security block to be required in that patron format.

If the patron format requires the inclusion of a security block in some circumstances, it can fix it as one of the security blocks defined in this part of ISO/IEC 19785 (or as some other security block), or can include the CBEFF data elements CBEFF_SB_format_owner and CBEFF_SB_format_type to identify one of these or some other security block format.

Besides the security block formats defined in this part of ISO/IEC 19785, there will be many possible CBEFF security block formats meeting different needs. For example, a security block format is specified for the ILO seafarers profile in ISO/IEC 24713-3. The security block format specified in Clause 5 is designed to be as general as possible. The security block format specified in Clause 6 is designed to provide a basic security provision and supports integrity only.

This part of ISO/IEC 19785 specifies two security block formats.

The first security block specifies a general-purpose security block format with optional elements for encryption, and for integrity, using RFC 3852 Cryptographic Message Syntax (CMS), with certain modifications to EnvelopedData, EncryptedData, SignedData , and AuthenticatedData , to meet the needs and requirements in expressing the security of biometric information in conformance with CBEFF. The second is named signature-only security block format, which is also defined using RFC 3852.

The general-purpose security block format specified in this part of ISO/IEC 19785 also contains optional Authentication Context for Biometrics (ACBio) instances specified in ISO/IEC 24761. ACBio also uses the RFC 3852 Cryptographic Message Syntax scheme. The inclusion of ACBio instances enables the security levels of the systems producing the authenticated biometric to be determined. The optional use of ACBio instances is an important part of the provision of a telebiometric authentication infrastructure (TAI) [3].

1 Scope

This part of ISO/IEC 19785 specifies security block formats (see ISO/IEC 19785-1) registered in accordance with ISO/IEC 19785-2 as formats defined by the CBEFF biometric organization ISO/IEC JTC 1/SC 37, and specifies their registered security block format identifiers.

The general-purpose security block format provides for specification of whether the biometric data block (BDB) is encrypted or the SBH and BDB have integrity applied (or both), and can include ACBio instances (see ISO/IEC 24761). This security block provides all necessary security parameters, including those used for encryption or integrity.

It does not restrict the algorithms and parameters used for encryption or integrity, but provides for the recording of such algorithms and parameter values.

It is a matter for profiling to determine, for a particular application area, what algorithms and parameter ranges can be used by the generator of a security block, and hence what algorithms and parameter ranges have to be supported by the user of a security block. This is out of the scope of this part of ISO/IEC 19785.

The second security block is more limited, but simpler (and in particular cannot contain ACBio instances, and does not support encryption of the BDB).

2 Normative references

The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

3 Terms and definitions

3.2 Terms defined in ISO/IEC 19784-1

For the purposes of this document, the following term defined in ISO/IEC 19784-1 applies:

BioAPI Unit.

3.3 Terms defined in ISO/IEC 24761

For the purposes of this document, the following terms defined in ISO/IEC 24761 apply:

ACBio instance, authentication context for biometrics (ACBio), biometric processing unit (BPU).

3.4 Terms defined in ISO/IEC 9798-6

For the purposes of this document, the following term defined in ISO/IEC 9798-6 applies:

message authentication code.

Bibliography