ISO/IEC 27553-1:2022 情報セキュリティ、サイバーセキュリティ、およびプライバシー保護 — モバイル デバイスでの生体認証を使用した認証のセキュリティおよびプライバシー要件 — Part 1: ローカル モード | ページ 6

3.1

attack presentation classification error rate

APCER

proportion of attack presentations using the same presentation attack instrument (PAI) species incorrectly classified as bona fide presentations in a specific scenario

Note 1 to entry: PAI means the biometric characteristic or object used in a presentation attack (3.17) .

[SOURCE:ISO/IEC 30107-3:2017, 3.2.1, modified — Note 1 to entry has been added.]

3.2

artefact

artificial object or representation presenting a copy of biometric characteristics or synthetic biometric patterns

[SOURCE:ISO/IEC 30107-1:2016, 3.1]

3.3

authentication

provision of assurance in the identity of an entity

[SOURCE:ISO/IEC 29115:2013, 3.2]

3.4

authentication agent

component in a mobile device that performs authentication-related functions on the mobile device and interacts with the local biometric components

3.5

authentication credential

credential containing information that can be used to help authenticate the entity

[SOURCE:ISO/IEC 20009-4:2017, 3.3]

3.6

authentication service provider

entity that provides authentication services to a relying party (3.19)

3.7

biometric data

biometric sample or aggregation of biometric samples at any stage of processing

Note 1 to entry: Biometric data need not be attributable to a specific individual, e.g. Universal Background Models.

[SOURCE:ISO/IEC 2382-37:2022, 37.03.06]

3.8

biometric information

information conveyed or represented by biometric data (3.7)

Note 1 to entry: Biometric data include for instance data derived or transformed from biometric data which are handled in connection with biometric data within a biometric system.

[SOURCE:ISO/IEC 24745:2022, 3.9]

3.9

biometric probe

biometric sample (3.12) or biometric feature set input to an algorithm for comparison to a biometric reference(s)

[SOURCE:ISO/IEC 2382-37:2022, 37.03.14, modified — Notes to entry have been removed.]

3.10

biometric processing unit

BPU

trusted implementation of a collection of biometric subprocesses implemented in a single physical unit

Note 1 to entry: A BPU commonly comprises biometric subprocesses that are sequential in the process flow for a biometric verification.

Note 2 to entry: Application/service requirements typically require BPU subprocesses to meet a uniform level of security assurance. In ACBio, assurance is achieved through a BPU evaluation process that is authenticated by means of an X.509 certificate embedded in an ACBio instance.

[SOURCE:ISO/IEC 24761:2019, 3.3]

3.11

biometrics

automated recognition of individuals based on their biological and behavioural characteristics

[SOURCE:ISO/IEC 2382-37:2022, 37.01.03, modified — Notes to entry have been removed.]

3.12

biometric sample

analogue or digital representation of biometric characteristics prior to biometric feature extraction

[SOURCE:ISO/IEC 2382-37:2022, 37.03.21]

3.13

credential

representation of an identity for use in authentication (3.3)

Note 1 to entry: As described in ISO/IEC 24760-1:2019, 5.4, customary embodiments of a credential are very diverse. To accommodate this wide range, the definition adopted in this document is very generic.

Note 2 to entry: A credential is typically made to facilitate data authentication of the identity information pertaining to the identity it represents. Data authentication is typically used in authorization.

Note 3 to entry: The identity information represented by a credential can, for example, be printed on human-readable media, or stored within a physical token. Typically, such information can be presented in a manner designed to reinforce its perceived validity.

Note 4 to entry: A credential can be a username, username with a password, a PIN, a smartcard, a token, a fingerprint, a passport, etc.

[SOURCE:ISO/IEC 24760-1:2019, 3.3.5]

3.14

device binding

association of a specific device with the data (credential) and the holder (individual getting the credential)

Note 1 to entry: The binding process typically provides assurance to a known level.

3.15

information asset

knowledge or data that has value to the individual or organization

[SOURCE:ISO/IEC 27032:2012, 4.27, modified – Note 1 to entry has been removed]

3.16

mobile device

small, compact, handheld, lightweight, standalone computing device, typically having a display screen with digitizer input and/or a miniature keyboard

Note 1 to entry: Examples include laptops, tablet PCs, wearable information and communication technology (ICT) devices, and smartphones.

[SOURCE:ISO/IEC 30107-4:2020, 3.1]

3.17

presentation attack

presentation to the biometric data capture subsystem with the goal of interfering with the operation of the biometric system

Note 1 to entry: Presentation attack can be implemented through a number of methods, e.g. artefact, mutilations, replay, etc.

Note 2 to entry: Presentation attacks can have a number of goals, e.g. impersonation or not being recognized.

Note 3 to entry: It is possible that biometric systems are unable to differentiate between biometric presentation attacks with the goal of interfering with the systems operation and non-conformant presentations.

[SOURCE:ISO/IEC 30107-1:2016, 3.5, modified —"may" has been changed to"can" and"it is possible" in Notes 2 and 3 to entry.]

3.18

presentation attack detection

PAD

automated determination of a presentation attack (3.17)

Note 1 to entry: PAD cannot infer the subject’s intent. In fact it may be impossible to derive that difference from the data capture process or acquired sample.

[SOURCE:ISO/IEC 30107-1:2016, 3.6]

3.19

relying party

RP

entity that relies on the verification of identity information for a particular entity

Note 1 to entry: A relying party is exposed to risk caused by incorrect identity information. Typically it has a trust relationship with one or more identity information authorities.

Note 2 to entry: In the context of this document, an RP is implemented as a server plus an agent. An RP agent is a software component located in the mobile device which initiates authentication requests to an RP server, displays the returned information, and interacts with the identity information provider (IIP) agent to fulfil the authentication process.

[SOURCE:ISO/IEC 24760-1:2019, 3.3.7, modified – Note 2 to entry and EXAMPLE added]

3.20

renewable biometric reference

RBR

renewable identifier that represents an individual or data subject within a domain by means of a protected binary identity (re)constructed from the captured biometric sample, and fulfilling irreversibility requirements

Note 1 to entry: A renewable biometric reference fulfilling irreversibility requirement provides additional security property.

Note 2 to entry: An example of a renewable biometric reference is a pseudonymous identifier and additional data elements required for biometric verification or identification such as auxiliary data.

[SOURCE:ISO/IEC 24745:2022, 3.34]

3.21

threat

potential cause of an unwanted incident, which can result in harm to a system or organization

[SOURCE:ISO/IEC 27000:2018, 3.74]

3.22

trusted environment

secure area that guarantees the confidentiality and integrity of code and data loaded inside

Note 1 to entry: Examples include trusted execution environment (TEE), SE secure element (SE), and trusted platform module (TPM). See ISO 12812-1 and the ISO/IEC 11889 series for further details.