BS ISO IEC 19795-5-2011 Information technology Biometric performance testing and reporting Access control scenario and grading scheme《信息技术 生物识别性能测试和报告 访问控制方案和分级方案》.pdf

1、raising standards worldwide NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAW BSI Standards Publication BS ISO/IEC 19795-5:2011 Information technology Biometric performance testing and reporting Part 5: Access control scenario and grading schemeBS ISO/IEC 19795-5:2011 BRITISH ST

2、ANDARD National foreword This British Standard is the UK implementation of ISO/IEC 19795-5:2011. The UK participation in its preparation was entrusted to Technical Committee IST/44, Biometrics. A list of organizations represented on this committee can be obtained on request to its secretary. This pu

3、blication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. BSI 2011 ISBN 978 0 580 56518 2 ICS 35.040 Compliance with a British Standard cannot confer immunity from legal obligations. This British Standard was published under

4、the authority of the Standards Policy and Strategy Committee on 31 March 2011. Amendments issued since publication Date Text affectedBS ISO/IEC 19795-5:2011Reference number ISO/IEC 19795-5:2011(E) ISO/IEC 2011INTERNATIONAL STANDARD ISO/IEC 19795-5 First edition 2011-03-01 Information technology Biom

5、etric performance testing and reporting Part 5: Access control scenario and grading scheme Technologies de linformation Essais et rapports de performance biomtriques Partie 5: Plan de classement pour valuation de scnario de contrle daccs BS ISO/IEC 19795-5:2011 ISO/IEC 19795-5:2011(E) PDF disclaimer

6、 This PDF file may contain embedded typefaces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept

7、 therein the responsibility of not infringing Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the fil

8、e; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. COPYRIGHT PROTECTED

9、DOCUMENT ISO/IEC 2011 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISOs mem

10、ber body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org Published in Switzerland ii ISO/IEC 2011 All rights reservedBS ISO/IEC 19795-5:2011 ISO/IEC 19795-5:2011(E) ISO/IEC 20

11、11 All rights reserved iiiContents Page Foreword .v Introductionvi 1 Scope1 2 Conformance .2 3 Normative references2 4 Terms and definitions .2 5 Definition of testing scenario.3 5.1 Overview.3 5.2 Relationship of biometric system / subsystem to access control system3 5.3 Evaluation metrics overview

12、 5 5.4 Evaluation approach .5 5.4.1 Tests .5 5.4.2 Universality of the test6 5.4.3 Levels of effort and decision policies .6 5.4.4 Controlled Indoor Environment .6 5.5 Crew characteristics and management.7 5.5.1 Crew demographics 7 5.5.2 Crew size 8 5.5.3 Test crew selection .8 5.5.4 Test crew train

13、ing9 5.5.5 Operator - crew member interaction .9 5.5.6 Habituation.9 5.6 Privacy9 5.6.1 General .9 5.6.2 Crew identity protection .9 5.6.3 Data protection 10 5.6.4 Proprietary information.10 6 Testing approach and conduct 10 6.1 Planning .10 6.1.1 General .10 6.1.2 Test objectives.10 6.1.3 Inputs to

14、 and outputs from the test process10 6.1.4 Concept of operations 10 6.1.5 Adherence to native system operations .11 6.2 General test approach.11 6.2.1 General .11 6.2.2 Pre-test activities.12 6.2.3 System operability verification 14 6.2.4 Data collection .14 6.2.5 Problem reporting and tracking.15 6

15、.2.6 Post-test briefing.16 6.3 Testing methodology 16 6.3.1 Introduction16 6.3.2 Enrolment transactions and results generation 17 6.3.3 Verification attempts, transactions, and results generation.17 6.3.4 Enrolment and verification temporal separation .18 6.3.5 Impostor tests20 6.4 Errors and except

16、ion cases .20 6.5 Incremental performance evaluations.21 BS ISO/IEC 19795-5:2011 ISO/IEC 19795-5:2011(E) iv ISO/IEC 2011 All rights reserved7 Grading and reporting 21 7.1 Grading 21 7.1.1 Data analysis. 21 7.1.2 Using statistical analysis methods. 21 7.1.3 Performance measures 21 7.1.4 Grading of ma

17、tching performance illustration 25 7.1.5 Uses (of grading) . 25 7.2 Documentation requirements and control . 26 7.2.1 General. 26 7.2.2 Test control . 26 7.3 Reporting performance results . 27 7.3.1 Reporting requirements . 27 7.3.2 Report structure 28 Annex A (informative) Grading information 29 A.

18、1 Equivalence of tests . 29 A.2 Comparison of test results 29 A.3 Grading values for enrolment performance. 29 A.4 Grading values for matching performance 30 A.5 Grading illustration shown in Figure A.1 . 30 A.6 Grading values for transaction time performance 31 A.7 Defining system requirements as i

19、n Table 7 . 31 Annex B (normative) Statistical methods for estimation of confidence bounds graded test metrics 33 B.1 Correlated binary method 33 B.2 Beta distribution method . 34 B.3 Z-statistic. 35 Bibliography. 36 BS ISO/IEC 19795-5:2011 ISO/IEC 19795-5:2011(E) ISO/IEC 2011 All rights reserved vF

20、oreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technic

21、al committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part

22、in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare Interna

23、tional Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of

24、 the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC 19795-5 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 37, Biometrics. ISO/IEC 19795

25、consists of the following parts, under the general title Information technology Biometric performance testing and reporting: Part 1: Principles and framework Part 2: Testing methodologies for technology and scenario evaluation Part 3: Modality-specific testing Technical report Part 4: Interoperabili

26、ty performance testing Part 5: Access control scenario and grading scheme Part 6: Testing methodologies for operational evaluation Part 7: Testing of on-card biometric comparison algorithms BS ISO/IEC 19795-5:2011 ISO/IEC 19795-5:2011(E) vi ISO/IEC 2011 All rights reservedIntroduction This part of I

27、SO/IEC 19795 is concerned solely with the scientific “technical performance testing” of biometric systems and subsystems to be used for access control. Technical performance testing seeks to determine error rates and transaction times with the goal of understanding and predicting the real-world erro

28、r and transaction times of a biometric system. The error rates include false accept rate, and false reject rate, as well as failure to enrol (FTE) and failure to acquire (FTA) rates across the test population. These measures are generally applicable to all access control systems that contain a biome

29、tric verification subsystem. This part of ISO/IEC 19795 defines a testing framework with the following fundamental aspects. This part of ISO/IEC 19795 was conceived to be a framework for a general- or multi-purpose test: “one size fits many (but not all)”. The focus is limited to access control appl

30、ications. The framework is suitable as both a requirements statement and an evaluation report. The general-purpose nature of this part of ISO/IEC 19795 is centred on the common access control application requirements, and acknowledges the fact that this framework will not be suitable for specialized

31、 applications (very high levels of protection, specialized user populations like the elderly, students, etc.). Specialized applications will warrant specialized testing processes. The perceived benefit of the general- or multi-purpose test is economy. The supplier can submit to one testing process,

32、and many potential customers can utilize the results, interpreting the suitability of the device (based on the results) for their application. This testing framework assigns grades representing the tested level of performance, and these grades include a statistical confidence taking the conservative

33、 approach, that is, the performance of the system is at least as good as the grade indicated (at the 90% confidence level). Using the grading scheme to specify a required performance level of a system needs to take into account this conservative approach. It is acknowledged that technical performanc

34、e testing is only one form of biometric testing. Other types of testing not considered in this part of ISO/IEC 19795 include the following: reliability, availability and maintainability; security, including vulnerability; human factors, including user acceptance; environmental; safety; cost/benefit;

35、 privacy regulation compliance. Methods and philosophies for these other types of tests are currently being considered internationally by a broad range of groups. The purpose of this part of ISO/IEC 19795 is to capture the current understanding by the biometrics community of requirements and best sc

36、ientific practices for conducting performance testing towards the end of providing consistent, structured evaluations of biometric systems intended for use in access control applications. The framework defined in this part of ISO/IEC 19795 has utility as a method for defining user requirements, for

37、specifying the extent of performance evaluation, for conducting and for reporting. BS ISO/IEC 19795-5:2011 INTERNATIONAL STANDARD ISO/IEC 19795-5:2011(E) ISO/IEC 2011 All rights reserved 1Information technology Biometric performance testing and reporting Part 5: Access control scenario and grading s

38、cheme 1 Scope This part of ISO/IEC 19795: defines a common biometric access control scenario for use in scenario evaluation of biometric verification systems; provides a grading scheme for expressing quantitative biometric system requirements and performance levels; provides a common basis for condu

39、cting scenario evaluations to demonstrate that specified performance grades are being achieved which is adaptable to particular testing facilities and to specific biometric systems. This part of ISO/IEC 19795 is applicable to performance testing of biometric systems without detailed knowledge of the

40、 comparison algorithms or of the underlying distribution of biometric characteristics in the population of interest. The minimum false accept rate (FAR) tested by this part of ISO/IEC 19795 is 0.1%. If a lower FAR is required, customized testing (outside the scope of this part of ISO/IEC 19795) migh

41、t be appropriate, and needs to be fully compliant with ISO/IEC 19795-2. This part of ISO/IEC 19795 addresses testing a biometric system for physical access control, and the suitability of the testing for logical access devices needs to be determined on a case-by-case basis. Not within the scope of t

42、his part of ISO/IEC 19795 is the measurement of error and throughput rates for people deliberately trying to circumvent correct recognition by the biometric system (i.e. active impostors). In addition, this part of ISO/IEC 19795 does not assess the following: reliability, availability and maintainab

43、ility; security, including vulnerability; human factors, including user acceptance; environmental impacts; safety; cost/benefit/suitability; privacy regulation compliance. These assessments are the responsibility of the procuring authority. BS ISO/IEC 19795-5:2011 ISO/IEC 19795-5:2011(E) 2 ISO/IEC 2

44、011 All rights reserved2 Conformance A test conforms to this part of ISO/IEC 19795 if the scenario used (including test crew demographics, environmental controls, time separation between enrolment and revisit, numbers of attempts and transactions), test conduct, and test reporting all conform to the

45、 mandatory requirements in Clauses 5 through 7. 3 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any

46、 amendments) applies. ISO/IEC 19795-1:2006, Information technology Biometric performance testing and reporting Part 1: Principles and framework ISO/IEC 19795-2:2007, Information technology Biometric performance testing and reporting Part 2: Testing methodologies for technology and scenario evaluatio

47、n ISO/IEC TR 19795-3, Information technology Biometric performance testing and reporting Part 3: Modality-specific testing 4 Terms and definitions For the purposes of this document, the terms and definitions given in ISO/IEC 19795-1 and the following apply. 4.1 access control system ACS entire elect

48、ro-mechanical suite that performs the granting or denying of access at controlled entry points of a facility 4.2 biometric subsystem portion of a biometric system that is present at each access entry point, including the biometric sensor or sampling subsystem 4.3 grade levels measurement associated

49、with the quantified levels of biometric subsystem performance NOTE Grade levels are defined, ranging from 0 to 3, or 0 to 6. It is possible that additional grade levels above these values will be defined at a future date. 4.4 FAR level scale for the relative level of resistance to false accepts in a form associated with three specific false accept rate (FAR) values 4.5 transaction time time required for the biometric system portion of an access control transactio