ISO/IEC 19989-3:2020 情報セキュリティ—生体認証システムのセキュリティ評価の基準と方法論—パート3：プレゼンテーション攻撃の検出 | ページ 6

3.1

attack presentation acquisition rate

APAR

proportion of attack presentations using the same PAI species (3.15) from which the data capture subsystem acquires a biometric sample of sufficient quality

[SOURCE: ISO/IEC 30107-3: 2017, 3.2.5]

3.2

attack presentation classification error rate

APCER

proportion of attack presentations using the same PAI species (3.15) incorrectly classified as bona fide presentations (3.5) in a specific scenario

[SOURCE: ISO/IEC 30107-3: 2017, 3.2.1]

3.3

attack presentation non-response rate

APNRR

proportion of attack presentations using the same PAI species (3.15) that cause no response at the PAD subsystem or data capture subsystem

[SOURCE: ISO/IEC 30107-3: 2017, 3.2.3]

3.4

attack type

element and characteristic of a presentation attack, including PAI species (3.15) , concealer or impostor attack, degree of supervision, and method of interaction with the capture device

[SOURCE: ISO/IEC 30107-3: 2017, 3.1.3]

3.5

bona fide presentation

interaction of the biometric capture subject and the biometric data capture subsystem in the fashion intended by the policy of the biometric system

Note 1 to entry: Bona fide is analogous to normal or routine, when referring to a bona fide presentation.

Note 2 to entry: Bona fide presentations can include those in which the user has a low level of training or skill. Bona fide presentations encompass the totality of good-faith presentations to a biometric data capture subsystem.

[SOURCE: ISO/IEC 30107-3: 2017, 3.1.2]

3.6

bona fide presentation classification error rate

BPCER

proportion of bona fide presentations (3.5) incorrectly classified as presentation attacks in a specific scenario

[SOURCE: ISO/IEC 30107-3: 2017, 3.2.2]

3.7

bona fide presentation non-response rate

BPNRR

proportion of bona fide presentations (3.5) that cause no response at the PAD subsystem or data capture subsystem

[SOURCE: ISO/IEC 30107-3: 2017, 3.2.4]

3.8

concealer attack presentation non-identification rate

CAPNIR

<full-system evaluation of an identification system> proportion of concealer presentation attacks using the same PAI species (3.15) in which the reference identifier of the concealer is not among the identifiers returned or, depending on intended use case, in which no identifiers are returned

Note 1 to entry: In a negative identification system, such as a black-list, the concealer can intend that no identifiers are returned to avoid scrutiny by a human operator.

[SOURCE: ISO/IEC 30107-3: 2017, 3.2.9]

3.9

concealer attack presentation non-match rate

CAPNMR

<full-system evaluation of a verification system> proportion of concealer attack presentations using the same PAI species (3.15) in which the reference of the concealer is not matched

[SOURCE: ISO/IEC 30107-3: 2017, 3.2.7]

3.10

false-negative identification-error rate

FNIR

proportion of identification transactions by users enrolled in the system in which the user’s correct identifier is not among those returned

[SOURCE: ISO/IEC 19795-1:2006, 4.6.8]

3.11

false-positive identification-error rate

FPIR

proportion of identification transactions by users not enrolled in the system, where an identifier is returned

[SOURCE: ISO/IEC 19795-1:2006, 4.6.9]

3.12

impostor attack presentation identification rate

IAPIR

<full-system evaluation of an identification system> proportion of impostor attack presentations using the same PAI species (3.15) in which the targeted reference identifier is among the identifiers returned or, depending on intended use case, at least one identifier is returned by the system

Note 1 to entry: An attacker can be both an impostor (trying to match an existing non-self enrolee) and a concealer (obscuring his real biometric sample with a PAI).

[SOURCE: ISO/IEC 30107-3: 2017, 3.2.8]

3.13

impostor attack presentation match rate

IAPMR

<full-system evaluation of a verification system> proportion of impostor attack presentations using the same PAI species (3.15) in which the target reference is matched

[SOURCE: ISO/IEC 30107-3: 2017, 3.2.6]

3.14

non-standard PAI

presentation attack instrument (PAI) not corresponding to a standard PAI species (3.18) .

3.15

PAI species

class of presentation attack instruments created using a common production method and based on different biometric characteristics

Note 1 to entry: The term “recipe” is often used to refer to how to make a PAI species.

Note 2 to entry: Presentation attack instruments of the same species may have different success rates due to variability in the production process.

[SOURCE: ISO/IEC 30107-3: 2017, 3.1.6]

3.16

penetration testing

testing used in vulnerability analysis for vulnerability assessment, trying to reveal vulnerabilities of the TOE based on the information about the TOE gathered during the relevant evaluation activities

Note 1 to entry: In the ISO/IEC 15408 series, this term is used without definition.

3.17

standard PAI

PAI in standard PAI species (3.18)

3.18

standard PAI species

PAI species (3.15) determined and specified as standard by a certification body or a technical community for the purpose of conducting evaluations

Note 1 to entry: If standard PAI species are not specified, the developer as well as the evaluator prepare non-standard PAIs (3.14) to use in evaluation activities.