The document discusses biometric security standards for managing biometric information. It compares two standards: X9.84 and ISO 19092. X9.84 is more comprehensive, including an ASN.1 schema, security event journal, and use cases. ISO 19092 extends X9.84 internationally but omitted some technical content. The document also provides tutorials on biometric technologies, compliance checklists, extending templates with security attributes, and a proposed biometric security management layer.

1. Biometric Information Security Management
Phillip H. Griffin
Information Security Consultant
GRIFFIN Consulting

2. Biometric Security Standards
• X9.84 - 2010 Biometric Information Management and Security
– Industry neutral information security standard
– Financial services specific use cases
– Became a US national standard in 2003
– Revised 2009
• Wells provided editor; Griffin created secure abstract schema
• Selectively incorporates ISO 19092 improvements
• ISO 19092
– Extends & internationalizes X9.84-2003
– McCormick, US expert; Griffin, standard editor
– Omitted important X9.84 technical content
– Omitted schema for practical implementation
2

3. Biometric Security Standards
Content X9.84 ISO 19092
Biometrics Overview & Tutorial  
Technical Considerations & Architecture  
Biometric Information Security Management  
Cryptographic Controls and Techniques 
Physical Controls  
ASN.1 Schema (compact binary & XML markup) 
Secure Biometric System Event Journal 
3

4. Biometric Security Standard
Content X9.84 ISO 19092
Audit Checklist (BVCO)  
Match Decision Protocol 
ISO 8583 Retail Message Extension 
Data Flow Diagrams & Descriptions 
Security Considerations  
Public Policy Considerations 
Business Use Cases  
4

5. X9.84 – A Biometrics Tutorial
Biometric Technology Overview
– Basics
”Biometric identification leverages the universally recognized
fact that certain physiological or behavioral characteristics
can reliably distinguish one person from another “
Biometric Types
– Fingerprint (Voice, Signature, Iris, Retina, Face, …)
”The pattern of friction ridges and valleys on an individual's
fingertips is considered unique to that individual.“
5

6. X9.84 Authentication System Compliance
Biometric System Auditor Checklist
Biometric Validation Control Objectives
Environmental Controls – A biometric system within or employing an
IT infrastructure requires these controls for a secure implementation
Key Management Lifecycle Controls – Needed when a biometric
system employs cryptographic protection, e.g., digital signatures for
data integrity & origin authentication, and encryption for confidentiality
Biometric Information Lifecycle Controls – A biometric system
enrolls individuals by capturing biometric data to generate, distribute,
use, and eventually terminate templates, similar to a PKI.
6

7. X9.84 Authentication System Compliance
Biometric System Event Journal
Shows that an organization provides reasonable assurance
that environmental, key management lifecycle, and biometric information
life cycle events are accurately and completely logged – that the
operation of the biometric system meets the control objectives
Confidentiality & integrity of current & archived event journals maintained
Complete event journals are securely and confidentially archived in
accordance with disclosed business practices
Event journals are reviewed periodically by authorized personnel
7

8. Extending Biometric Template Information
Biometric Template Attributes
Attributes can be bound to a template using a detached signature.
Detached signatures are stored separately from the template itself.
Detached signatures do not interfere with template use by a biometric
service provider, say during the biometric matching process.
Signature verification of information security management attributes
that are cryptographically bound to a biometric reference template can be
performed by another application process, perhaps by a Web Service.
8

9. Biometric Security Management Attributes
<Modality>
<BiometricType> fingerprint </BiometricType>
<BiometricType> iris </BiometricType>
<Modality>
<Factors> 2 </Factors> -- Two factor authentication
<Attempts> 3 </Attempts> -- Lock after 3 bad tries
<BiometricPolicy>
<policyIdentifier> 1.2.3.4 </policyIdentifier>
<policyReference>
http://phillipgriffin.com/policy/99
</policyReference>
</BiometricPolicy>
9

10. Binding Security Attributes to Reference Templates
<Detached-Signature id=1056>
<Attributes>
<Hash> ▪▫▪▫ </Hash>
<factors> 2 </factors>
<SAML> ▪▫▪▫ </SAML> BSP
<Bank> ▪▫▪▫ </Bank>
<userID> ▪▫▪▫ </userID>
▪▫▪▫
Detached signatures can bind security and
Database privacy attributes to biometric templates .
10

11. Biometric Security Management Layer
Identity
and
Access
Management BSP
User Auth
IAM / BSP API
Biometric Security
Password Management Application Event Journal
User BSM
PKI Signed Attributes
11

12. For a Deeper Dive …
• ANSI X9.84 : 2010 -
Biometric Information Management and Security
• ANSI X9.73 : 2010 -
Cryptographic Message Syntax (CMS) – ASN.1 and XML
• ISSA Journal, January 2007:
ISO 19092: A Standard for Biometric Security Management
12