Overview
ISO/IEC 19989-3:2020 specifies criteria and methodology for security evaluation of presentation attack detection (PAD) in biometric systems. It supplements the ISO/IEC 15408 evaluation framework and ISO/IEC 19989-1 by providing recommendations and requirements for developers and evaluators performing PAD testing and vulnerability assessment. The standard applies to Targets of Evaluation (TOEs) that implement a single biometric characteristic (or select one characteristic from multiple options).
Key topics and technical requirements
- PAD testing classes (ATE and AVA): Defines objectives and principles for automated testing (Class ATE) and vulnerability assessment/penetration testing (Class AVA).
- PAI (Presentation Attack Instrument) management: Guidance on types of PAIs to use in tests, including PAI species classification and non-standard PAIs.
- PAD metrics and definitions: Implements ISO/IEC 30107-3 metrics such as APCER, BPCER, APAR, APNRR, BPNRR, IAPMR/IAPIR, and related rates used to quantify PAD performance.
- Testing approach and activities: Supplementary activities to ISO/IEC 18045 covering test design, minimum test sizes, maximum error rates, and pass/fail criteria for PAD subsystems and full-system evaluations.
- Vulnerability assessment (AVA): Procedures for penetration testing using PAI variations, identifying potential vulnerabilities, and rating TOE resistance to presentation attacks.
- Reporting and calculations: Examples of attack potential calculations (Annex A) and reporting guidelines to ensure repeatable, objective evaluation outcomes.
Applications and who uses it
ISO/IEC 19989-3 is used by:
- Biometric product developers to design PAD features and document testing evidence for security evaluations.
- Evaluation labs and certification bodies performing security assurance tasks under the ISO/IEC 15408 framework.
- System integrators and procurers who need objective PAD performance and vulnerability data for procurement decisions.
- Security architects and risk assessors assessing biometric system resilience to presentation attacks.
Practical use cases include access control, e‑ID, border control, financial authentication, and any system where biometric verification/identification must resist spoofing.
Related standards
ISO/IEC 19989-3:2020 provides a focused, standardized approach to measuring and reporting PAD effectiveness-crucial for trustworthy biometric deployments and procurement. Keywords: ISO/IEC 19989-3, presentation attack detection, PAD testing, biometric evaluation, APCER, BPCER, PAI, biometric security.