ISO/IEC 30107-4:2024 PDF

Information technology — Biometric presentation attack detection — Part 4: Profile for testing of mobile devices

First page of standard ISO/IEC 30107-4:2024

Open preview (PDF)

Title (English):

ISO/IEC 30107-4:2024

Information technology — Biometric presentation attack detection — Part 4: Profile for testing of mobile devices

Document status:: Active
Format:: Electronic (PDF)
Number of pages:: 14
Publication date:: February 7, 2024
Edition:: ISO/IEC IS 30107 edition 2 version 1
ICS:: 35.240.15

Delivery type:

Full version25 €Read online 24h10 €Read online 72h15 €

Document language:

enru

Delivery time:Immediate download

Price:25 €

Description (English):

This document is a profile that specifies requirements for testing biometric presentation attack detection (PAD) mechanisms on mobile devices with local biometric recognition and on biometric modules integrated into mobile devices. The profile lists requirements from ISO/IEC 30107-3 that are specific to mobile devices. It also establishes requirements that are not present in ISO/IEC 30107-3. For each requirement, the profile defines an “Approach in PAD Tests for Mobile Devices”. For some requirements, numerical values or ranges are provided in the form of best practices. This profile is applicable to mobile devices that operate as closed systems with no access to internal results, including mobile devices with local biometric recognition as well as biometric modules for mobile devices. This document is not applicable to mobile devices with solely remote biometric recognition. The attacks considered in this document take place at the capture device during the presentation and collection of biometric characteristics. Any other attacks are outside the scope of this document.

Technical details

Technical committee: ISO/IEC JTC 1/SC 37 - Biometrics
SKU: ISO/IEC 30107-4:2024

Abstract

Overview

ISO/IEC 30107-4:2024 - "Information technology - Biometric presentation attack detection - Part 4: Profile for testing of mobile devices" is an ISO profile that tailors PAD (presentation attack detection) testing requirements specifically for mobile devices. It specifies how to evaluate PAD mechanisms on mobile devices with local biometric recognition and on biometric modules integrated into mobile devices. The profile lists mobile-specific requirements drawn from ISO/IEC 30107-3 and adds mobile-focused requirements and test approaches. It applies to closed systems (no access to internal PAD results) and excludes devices that rely solely on remote biometric recognition. Only attacks at the capture device during presentation are considered.

Key topics and technical requirements

Scope and applicability: Targets mobile devices (smartphones, tablets, wearables, laptops) and embedded biometric modules operating as closed systems. Not applicable to remote-only biometric systems.
PAD evaluation profile: Defines a mobile-specific profile that maps ISO/IEC 30107-3 requirements to an “Approach in PAD Tests for Mobile Devices,” including numerical best-practices where appropriate.
Attack types and attacker models: Requires specification of the presentation attacker type (e.g., biometric impostor or concealer) and the set or range of attack types under test.
Item under test (IUT) description: Test reports must fully describe mobile device model, OS and version, sensor position (front/back), biometric module positioning, and user interaction method (touch, swipe, gaze, passphrase).
Evaluation level: Emphasizes full-system evaluations for mobile devices; clarifies when subsystem or capture-level tests apply.
PAI and bona fide samples: Requires a representative set of presentation attack instruments (PAIs) and bona fide test subjects; best-practice PAI species minimum has been updated (document notes change from minimum 3 to minimum 6).
Artefact creation and usage: Test reports must document artefact creation, preparation difficulty, durability, presenter training level, and any oversight during usage.
FIDO-specific profile: Clause dedicated to FIDO biometric PAD evaluation requirements for Fast IDentity Online implementations on mobile platforms.

Applications and who uses this standard

Mobile device manufacturers and biometric module vendors - for implementing, testing and documenting PAD capability.
Security evaluation laboratories and certification bodies - to plan and execute PAD tests and to produce compliant evaluation reports.
Mobile OS and app developers integrating local biometric authentication - to understand testing expectations and ensure compatibility with PAD profiles.
Procurement, compliance, and risk teams - to specify PAD testing requirements in contracts and regulatory submissions.
FIDO implementers - to align mobile biometric PAD tests with FIDO-specific requirements.

Related standards

ISO/IEC 30107-1 (PAD framework)
ISO/IEC 30107-3 (PAD testing and reporting)
ISO/IEC 19795-1 (biometric performance testing)
ISO/IEC 2382-37 (biometrics vocabulary)

Keywords: ISO/IEC 30107-4:2024, biometric presentation attack detection, PAD testing, mobile devices, FIDO biometric, biometric module, presentation attack instruments, mobile biometrics.

Related standards

Standards mentioned in the description

Abstract

Overview

Key topics and technical requirements

Scope and applicability: Targets mobile devices (smartphones, tablets, wearables, laptops) and embedded biometric modules operating as closed systems. Not applicable to remote-only biometric systems.
PAD evaluation profile: Defines a mobile-specific profile that maps ISO/IEC 30107-3 requirements to an “Approach in PAD Tests for Mobile Devices,” including numerical best-practices where appropriate.
Attack types and attacker models: Requires specification of the presentation attacker type (e.g., biometric impostor or concealer) and the set or range of attack types under test.
Item under test (IUT) description: Test reports must fully describe mobile device model, OS and version, sensor position (front/back), biometric module positioning, and user interaction method (touch, swipe, gaze, passphrase).
Evaluation level: Emphasizes full-system evaluations for mobile devices; clarifies when subsystem or capture-level tests apply.
PAI and bona fide samples: Requires a representative set of presentation attack instruments (PAIs) and bona fide test subjects; best-practice PAI species minimum has been updated (document notes change from minimum 3 to minimum 6).
Artefact creation and usage: Test reports must document artefact creation, preparation difficulty, durability, presenter training level, and any oversight during usage.
FIDO-specific profile: Clause dedicated to FIDO biometric PAD evaluation requirements for Fast IDentity Online implementations on mobile platforms.

Applications and who uses this standard

Mobile device manufacturers and biometric module vendors - for implementing, testing and documenting PAD capability.
Security evaluation laboratories and certification bodies - to plan and execute PAD tests and to produce compliant evaluation reports.
Mobile OS and app developers integrating local biometric authentication - to understand testing expectations and ensure compatibility with PAD profiles.
Procurement, compliance, and risk teams - to specify PAD testing requirements in contracts and regulatory submissions.
FIDO implementers - to align mobile biometric PAD tests with FIDO-specific requirements.

Related standards

ISO/IEC 30107-1 (PAD framework)
ISO/IEC 30107-3 (PAD testing and reporting)
ISO/IEC 19795-1 (biometric performance testing)
ISO/IEC 2382-37 (biometrics vocabulary)

Keywords: ISO/IEC 30107-4:2024, biometric presentation attack detection, PAD testing, mobile devices, FIDO biometric, biometric module, presentation attack instruments, mobile biometrics.

ISO/IEC 30107-4:2024 PDF

Technical details

Abstract

Overview

Key topics and technical requirements

Applications and who uses this standard

Related standards

Related standards

Abstract

Overview

Key topics and technical requirements

Applications and who uses this standard

Related standards

Related standards

Information technology — Biometric presentation attack detection — Part 3: Testing and reporting

Information technology. Biometric presentation attack detection. Framework.

BS ISO/IEC 19795-1 Information technology — Biometric performance testing and reporting - Part 1: Principles…

Information technology - Vocabulary - Part 37: Biometrics (ISO/IEC 2382-37:2022)