ISO/IEC 24787-2:2024 PDF

Information technology — On-card biometric comparison — Part 2: Work-sharing mechanism

First page of standard ISO/IEC 24787-2:2024

Open preview (PDF)

Title (English):

ISO/IEC 24787-2:2024

Information technology — On-card biometric comparison — Part 2: Work-sharing mechanism

Document status:: Active
Format:: Electronic (PDF)
Number of pages:: 4
Publication date:: June 4, 2024
Edition:: ISO/IEC IS 24787 edition 1 version 1
ICS:: 35.240.15

Delivery type:

Full version25 €Read online 24h10 €Read online 72h15 €

Document language:

enru

Delivery time:Immediate download

Price:25 €

Description (English):

This document provides requirements for a biometric comparison methodology suitable for the on-card environment. In particular, it establishes the work-sharing on-card biometric comparison techniques that require an intensity exceeding the capabilities of integrated circuit cards (ICCs). This document does not establish — architectures of biometric comparison using an ICC, — on-card biometric comparison, both in sensor-off-card systems and as part of biometric system-on-card, — security policies for on-card biometric comparison, — requirements for off-card biometric comparison, — requirements for biometric system-on-card (defined in the ISO/IEC 17839 series), or — modality-specific requirements for storage and comparison.

Technical details

Technical committee: ISO/IEC JTC 1/SC 17 - Cards and security devices for personal identification
SKU: ISO/IEC 24787-2:2024

Abstract

Overview

ISO/IEC 24787-2:2024, "Information technology - On-card biometric comparison - Part 2: Work‑sharing mechanism," defines requirements for work‑sharing techniques used in on‑card biometric comparison. The document targets scenarios where biometric comparison intensity exceeds the standalone processing capabilities of an integrated circuit card (ICC) and specifies how processing tasks and data exchanges are split between the ICC and external components while keeping biometric references protected on‑card.

Key topics and requirements

Scope and exclusions: Specifies a work‑sharing methodology for on‑card comparison but does not define overall architectures, security policies, off‑card comparison requirements, biometric system‑on‑card requirements (ISO/IEC 17839), or modality‑specific storage/comparison rules.
Normative references: Relies on ISO/IEC 7816‑4, ISO/IEC 7816‑11, ISO/IEC 24787‑1 and biometric vocabulary (ISO/IEC 2382‑37).
Conformance: Implementations claiming conformance must support the work‑sharing requirements in Clause 6 and applicable sections of ISO/IEC 24787‑1.
Work‑sharing procedure (high level):
- Read biometric information template (excluding the biometric reference) from the ICC (e.g., READ BINARY).
- Read biometric auxiliary data from a working EF separate from the protected biometric reference (internal EF).
- Invoke a biometric verification command (e.g., PERFORM BIOMETRIC OPERATION / PBO) to start the first ICC processing phase.
- ICC returns status bytes (e.g., 62xx) indicating card‑originated feedback is available; host issues GET DATA to retrieve feedback.
- A final biometric verification command completes the comparison, decision and action; ICC returns status bytes with the verification result.
Command and status compliance: All command/response APDUs and status bytes must comply with ISO/IEC 7816‑4 and ISO/IEC 7816‑11.

Applications and who uses it

ISO/IEC 24787‑2 is intended for implementers and stakeholders involved with secure card‑based biometric verification:

Smart card and ICC manufacturers
Biometric system integrators and middleware developers
Secure ID and credential program managers (e.g., national identity, access control)
Security architects and evaluators who need standardized on‑card processing and data‑exchange patterns

Adopting this standard helps preserve on‑card biometric reference confidentiality while enabling higher‑intensity matching through controlled work‑sharing.

Related standards

ISO/IEC 24787‑1 - On‑card biometric comparison: general principles and specifications
ISO/IEC 7816‑4 and ISO/IEC 7816‑11 - ICC command structures and biometric personal verification
ISO/IEC 17839 (Biometric System‑on‑Card series)
ISO/IEC 19785‑3 and ISO/IEC 2382‑37

Keywords: ISO/IEC 24787‑2:2024, on‑card biometric comparison, work‑sharing mechanism, integrated circuit card (ICC), biometric auxiliary data, PBO, ISO standard.

Related standards

Standards mentioned in the description

Abstract

Overview

Key topics and requirements

Scope and exclusions: Specifies a work‑sharing methodology for on‑card comparison but does not define overall architectures, security policies, off‑card comparison requirements, biometric system‑on‑card requirements (ISO/IEC 17839), or modality‑specific storage/comparison rules.
Normative references: Relies on ISO/IEC 7816‑4, ISO/IEC 7816‑11, ISO/IEC 24787‑1 and biometric vocabulary (ISO/IEC 2382‑37).
Conformance: Implementations claiming conformance must support the work‑sharing requirements in Clause 6 and applicable sections of ISO/IEC 24787‑1.
Work‑sharing procedure (high level):
- Read biometric information template (excluding the biometric reference) from the ICC (e.g., READ BINARY).
- Read biometric auxiliary data from a working EF separate from the protected biometric reference (internal EF).
- Invoke a biometric verification command (e.g., PERFORM BIOMETRIC OPERATION / PBO) to start the first ICC processing phase.
- ICC returns status bytes (e.g., 62xx) indicating card‑originated feedback is available; host issues GET DATA to retrieve feedback.
- A final biometric verification command completes the comparison, decision and action; ICC returns status bytes with the verification result.
Command and status compliance: All command/response APDUs and status bytes must comply with ISO/IEC 7816‑4 and ISO/IEC 7816‑11.

Applications and who uses it

ISO/IEC 24787‑2 is intended for implementers and stakeholders involved with secure card‑based biometric verification:

Smart card and ICC manufacturers
Biometric system integrators and middleware developers
Secure ID and credential program managers (e.g., national identity, access control)
Security architects and evaluators who need standardized on‑card processing and data‑exchange patterns

Adopting this standard helps preserve on‑card biometric reference confidentiality while enabling higher‑intensity matching through controlled work‑sharing.

Related standards

ISO/IEC 24787‑1 - On‑card biometric comparison: general principles and specifications
ISO/IEC 7816‑4 and ISO/IEC 7816‑11 - ICC command structures and biometric personal verification
ISO/IEC 17839 (Biometric System‑on‑Card series)
ISO/IEC 19785‑3 and ISO/IEC 2382‑37

Keywords: ISO/IEC 24787‑2:2024, on‑card biometric comparison, work‑sharing mechanism, integrated circuit card (ICC), biometric auxiliary data, PBO, ISO standard.

ISO/IEC 24787-2:2024 PDF

Technical details

Abstract

Overview

Key topics and requirements

Applications and who uses it

Related standards

Related standards

Abstract

Overview

Key topics and requirements

Applications and who uses it

Related standards

Related standards

Tracked Changes. Information technology. Biometric system-on-card. Core requirements.

Identification cards. Integrated circuit(s) cards with contacts - Interindustry commands for interchange

Identification cards — Integrated circuit cards — Part 11: Personal verification through biometric methods

Information technology. On-card biometric comparison. General principles and specifications.

Information technology - Vocabulary - Part 37: Biometrics (ISO/IEC 2382-37:2022)

Information technology. Identification cards. On-card biometric comparison

Information technology — Common Biometric Exchange Formats Framework — Part 3: Patron format specifications —…