BS ISO IEC 19785-4-2010 Information technology Common Biometric Exchange Formats Framework Security block format specifications《信息技术 通用生物统计交换格式的框架结构 安全块格式规范》.pdf

1、BSI Standards PublicationBS ISO/IEC 19785-4:2010Incorporating corrigendum November 2013Information technology Common Biometric Exchange Formats FrameworkPart 4: Security block format specificationsBS ISO/IEC 19785-4:2010 BRITISH STANDARDNational forewordThis British Standard is the UK implementation

2、 of ISO/IEC 19785-4:2010, incorporating corrigendum November 2013.The start and finish of text introduced or altered by corrigendum is indicated in the text by tags. Text altered by ISO/IEC corrigendum November 2013 is indicated in the text by .The UK participation in its preparation was entrusted t

3、o Technical Committee IST/44, Biometrics.A list of organizations represented on this committee can be obtained on request to its secretary.This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards

4、 Institution 2014. Published by BSI Standards Limited 2014ISBN 978 0 580 81744 1ICS 35.040Compliance with a British Standard cannot confer immunity from legal obligations.This British Standard was published under the authority of the Standards Policy and Strategy Committee on 30 September 2010.Amend

5、ments/corrigenda issued since publicationDate Text affected31 January 2014 Implementation of ISO/IEC corrigendum November 2013BS ISO/IEC 19785-4:2010Reference numberISO/IEC 19785-4:2010(E)ISO/IEC 2010INTERNATIONAL STANDARD ISO/IEC19785-4First edition2010-08-15Information technology Common Biometric

6、Exchange Formats Framework Part 4: Security block format specifications Technologies de linformation Cadre de formats dchange biomtriques communs Partie 4: Spcifications de format de bloc de scurit BS ISO/IEC 19785-4:2010ISO/IEC 19785-4:2010(E) PDF disclaimer This PDF file may contain embedded typef

7、aces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infrin

8、ging Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optim

9、ized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2010 All rights reserved

10、. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISOs member body in the country of the requester.

11、 ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org Published in Switzerland ii ISO/IEC 2010 All rights reservedBS ISO/IEC 19785-4:2010ISO/IEC 19785-4:2010(E) ISO/IEC 2010 All rights reserved iiiContents Page Fo

12、reword iv Introduction.v 1 Scope1 2 Normative references1 3 Terms and definitions .2 3.1 Terms defined in ISO/IEC 19785-1 .2 3.2 Terms defined in ISO/IEC 19784-1 .2 3.3 Terms defined in ISO/IEC 24761 2 3.4 Terms defined in ISO/IEC 9798-6 .2 4 Abbreviated terms .2 4.1 Abbreviated terms defined in ISO

13、/IEC 19785-1 2 4.2 Abbreviated terms defined in ISO/IEC 247612 4.3 Abbreviated terms defined in ISO/IEC 9798-6 2 4.4 Abbreviated terms defined in RFC 3852 .3 5 Security block format: general purpose .3 5.1 Security block format owner 3 5.2 Security block format owner identifier3 5.3 Security block f

14、ormat name .3 5.4 Security block format identifier .3 5.5 ASN.1 object identifier for this security block format .3 5.6 Domain of use4 5.7 Version identifier .4 5.8 Format specification and conformance statement 4 5.9 Encoding of abstract values 10 6 Security block format: signature only.11 6.1 Secu

15、rity block format owner 11 6.2 Security block format owner identifier11 6.3 Security block format name .11 6.4 Security block format identifier .11 6.5 ASN.1 object identifier for this security block format .11 6.6 Domain of use12 6.7 Version identifier .12 6.8 Format specification and conformance s

16、tatement 12 Annex A (normative) ASN.1 module for security block format13 Annex B (informative) Difference from types defined in RFC 5911 .15 Bibliography18 BS ISO/IEC 19785-4:2010ISO/IEC 19785-4:2010(E) ISO/IEC 2010 All rights reserved iiiContents Page Foreword iv Introduction.v 1 Scope 2 Normative

17、references1 3 Terms and definitions .2 3.1 Terms defined in ISO/IEC 19785-1 .2 3.2 Terms defined in ISO/IEC 19784-1 .2 3.3 Terms defined in ISO/IEC 24761 2 3.4 Terms defined in ISO/IEC 9798-6 . 4 Abbreviated terms .2 4.1 Abbreviated terms defined in ISO/IEC 19785-1 2 4.2 Abbreviated terms defined in

18、 ISO/IEC 247612 4.3 Abbreviated terms defined in ISO/IEC 9798-6 2 4.4 Abbreviated terms defined in RFC 3852 . 5 Security block format: general purpose .3 5.1 Security block format owner 3 5.2 Security block format owner identifier3 5.3 Security block format name .3 5.4 Security block format identifi

19、er .3 5.5 ASN.1 object identifier for this security block format .3 5.6 Domain of use4 5.7 Version identifier .4 5.8 Format specification and conformance statement 4 5.9 Encoding of abstract values 10 6 Security block format: signature only.11 6.1 Security block format owner 11 6.2 Security block fo

20、rmat owner identifier11 6.3 Security block format name .11 6.4 Security block format identifier .11 6.5 ASN.1 object identifier for this security block format .11 6.6 Domain of use12 6.7 Version identifier .12 6.8 Format specification and conformance statement 12 A (normative) ASN.1 module for secur

21、ity block format13 Annex B (informative) Difference from types defined in RFC 5911 .15 Bibliography18 1214BS ISO/IEC 19785-4:2010ISO/IEC 19785-4:2010(E) iv ISO/IEC 2010 All rights reservedForeword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Co

22、mmission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity.

23、ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee,

24、ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to nati

25、onal bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible f

26、or identifying any or all such patent rights. ISO/IEC 19785-4 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 37, Biometrics. ISO/IEC 19785 consists of the following parts, under the general title Information technology Common Biometric Exchange Forma

27、ts Framework: Part 1: Data element specification Part 2: Procedures for the operation of the Biometric Registration Authority Part 3: Patron format specifications Part 4: Security block format specifications BS ISO/IEC 19785-4:2010ISO/IEC 19785-4:2010(E) ISO/IEC 2010 All rights reserved vIntroductio

28、n Biometric verification and identification are important techniques for the authentication and/or identification of an individual. Biometric data used in biometric verification and identification has to be from a trusted source with no interference in transmission (integrity). It might or might not

29、 be necessary for it to be kept secret (encryption) depending on security policy. This part of ISO/IEC 19785 provides for both integrity and encryption of the biometric data. To ensure interoperability, the Common Biometric Exchange Formats Framework (CBEFF) was specified in ISO/IEC 19785-1 to assoc

30、iate meta-data with one or more Biometric Data Blocks (BDBs). In ISO/IEC 19785-1, the options for integrity and encryption, and the concept of a security block (SB) to contain security information related to these options are defined, but the format and detailed content of security blocks (SB format

31、s) are not specified. There are several steps in the chain, starting from a CBEFF patron format. First, the patron format can determine that the abstract value of the CBEFF data element CBEFF_BDB_encryption_options is fixed as NO ENCRYPTION and that the CBEFF data element CBEFF_BIR_integrity_options

32、 is fixed as NO INTEGRITY. In this case, there is no need for a security block to be required in that patron format. If the patron format requires the inclusion of a security block in some circumstances, it can fix it as one of the security blocks defined in this part of ISO/IEC 19785 (or as some ot

33、her security block), or can include the CBEFF data elements CBEFF_SB_format_owner and CBEFF_SB_format_type to identify one of these or some other security block format. Besides the security block formats defined in this part of ISO/IEC 19785, there will be many possible CBEFF security block formats

34、meeting different needs. For example, a security block format is specified for the ILO seafarers profile in ISO/IEC 24713-3. The security block format specified in Clause 5 is designed to be as general as possible. The security block format specified in Clause 6 is designed to provide a basic securi

35、ty provision and supports integrity only. This part of ISO/IEC 19785 specifies two security block formats. The first security block specifies a general-purpose security block format with optional elements for encryption, and for integrity, using RFC 3852 Cryptographic Message Syntax (CMS), with cert

36、ain modifications to EnvelopedData, EncryptedData, SignedData, and AuthenticatedData, to meet the needs and requirements in expressing the security of biometric information in conformance with CBEFF. The second is named signature-only security block format, which is also defined using RFC 3852. The

37、general-purpose security block format specified in this part of ISO/IEC 19785 also contains optional Authentication Context for Biometrics (ACBio) instances specified in ISO/IEC 24761. ACBio also uses the RFC 3852 Cryptographic Message Syntax scheme. The inclusion of ACBio instances enables the secu

38、rity levels of the systems producing the authenticated biometric to be determined. The optional use of ACBio instances is an important part of the provision of a telebiometric authentication infrastructure (TAI) 3. BS ISO/IEC 19785-4:2010BS ISO/IEC 19785-4:2010INTERNATIONAL STANDARD ISO/IEC 19785-4:

39、2010(E) ISO/IEC 2010 All rights reserved 1Information technology Common Biometric Exchange Formats Framework Part 4: Security block format specifications 1 Scope This part of ISO/IEC 19785 specifies security block formats (see ISO/IEC 19785-1) registered in accordance with ISO/IEC 19785-2 as formats

40、 defined by the CBEFF biometric organization ISO/IEC JTC 1/SC 37, and specifies their registered security block format identifiers. NOTE The security block format identifier is recorded in the standard biometric header (SBH) of a patron format (or defined by that patron format as the only available

41、security block format). The general-purpose security block format provides for specification of whether the biometric data block (BDB) is encrypted or the SBH and BDB have integrity applied (or both), and can include ACBio instances (see ISO/IEC 24761). This security block provides all necessary sec

42、urity parameters, including those used for encryption or integrity. It does not restrict the algorithms and parameters used for encryption or integrity, but provides for the recording of such algorithms and parameter values. It is a matter for profiling to determine, for a particular application are

43、a, what algorithms and parameter ranges can be used by the generator of a security block, and hence what algorithms and parameter ranges have to be supported by the user of a security block. This is out of the scope of this part of ISO/IEC 19785. The second security block is more limited, but simple

44、r (and in particular cannot contain ACBio instances, and does not support encryption of the BDB). 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest

45、 edition of the referenced document (including any amendments) applies. ISO/IEC 8824 (all parts) | ITU-T Rec. X.680683, Information technology Abstract Syntax Notation One (ASN.1) ISO/IEC 8825 (all parts) | ITU-T Rec. X.690693, Information technology ASN.1 encoding rules ISO/IEC 9798-6, Information

46、technology Security techniques Entity authentication Part 6: Mechanisms using manual data transfer ISO/IEC 19784-1, Information technology Biometric application programming interface Part 1: BioAPI specification ISO/IEC 19785-1, Information technology Common Biometric Exchange Formats Framework Part

47、 1: Data element specification BS ISO/IEC 19785-4:2010ISO/IEC 19785-4:2010(E) 2 ISO/IEC 2010 All rights reservedISO/IEC 24761, Information technology Security techniques Authentication context for biometrics RFC 3852, Cryptographic Message Syntax (CMS), July 2004 RFC 5911, New ASN.1 Modules for Cryp

48、tographic Message Syntax (CMS) and S-MIME, June 2010 3 Terms and definitions 3.1 Terms defined in ISO/IEC 19785-1 For the purposes of this document, the following terms defined in ISO/IEC 19785-1 apply: biometric, biometrics, biometric data block (BDB), biometric information record (BIR), CBEFF biom

49、etric organization, security block (SB), security block format, security block format identifier, security block format owner, standard biometric header (SBH). 3.2 Terms defined in ISO/IEC 19784-1 For the purposes of this document, the following term defined in ISO/IEC 19784-1 applies: BioAPI Unit. 3.3 Terms defined in ISO/IEC 24761 For the purposes of this document, the following terms defined in ISO/IEC 24761 apply: ACBio instance, authentication context for biometrics (ACBio), biometric processi