Overview
ISO/IEC 24787-2:2024, "Information technology - On-card biometric comparison - Part 2: Work‑sharing mechanism," defines requirements for work‑sharing techniques used in on‑card biometric comparison. The document targets scenarios where biometric comparison intensity exceeds the standalone processing capabilities of an integrated circuit card (ICC) and specifies how processing tasks and data exchanges are split between the ICC and external components while keeping biometric references protected on‑card.
Key topics and requirements
- Scope and exclusions: Specifies a work‑sharing methodology for on‑card comparison but does not define overall architectures, security policies, off‑card comparison requirements, biometric system‑on‑card requirements (ISO/IEC 17839), or modality‑specific storage/comparison rules.
- Normative references: Relies on ISO/IEC 7816‑4, ISO/IEC 7816‑11, ISO/IEC 24787‑1 and biometric vocabulary (ISO/IEC 2382‑37).
- Conformance: Implementations claiming conformance must support the work‑sharing requirements in Clause 6 and applicable sections of ISO/IEC 24787‑1.
- Work‑sharing procedure (high level):
- Read biometric information template (excluding the biometric reference) from the ICC (e.g., READ BINARY).
- Read biometric auxiliary data from a working EF separate from the protected biometric reference (internal EF).
- Invoke a biometric verification command (e.g., PERFORM BIOMETRIC OPERATION / PBO) to start the first ICC processing phase.
- ICC returns status bytes (e.g., 62xx) indicating card‑originated feedback is available; host issues GET DATA to retrieve feedback.
- A final biometric verification command completes the comparison, decision and action; ICC returns status bytes with the verification result.
- Command and status compliance: All command/response APDUs and status bytes must comply with ISO/IEC 7816‑4 and ISO/IEC 7816‑11.
Applications and who uses it
ISO/IEC 24787‑2 is intended for implementers and stakeholders involved with secure card‑based biometric verification:
- Smart card and ICC manufacturers
- Biometric system integrators and middleware developers
- Secure ID and credential program managers (e.g., national identity, access control)
- Security architects and evaluators who need standardized on‑card processing and data‑exchange patterns
Adopting this standard helps preserve on‑card biometric reference confidentiality while enabling higher‑intensity matching through controlled work‑sharing.
Related standards
Keywords: ISO/IEC 24787‑2:2024, on‑card biometric comparison, work‑sharing mechanism, integrated circuit card (ICC), biometric auxiliary data, PBO, ISO standard.