ISO/IEC 24787-2:2024

Overview

ISO/IEC 24787-2:2024, "Information technology - On-card biometric comparison - Part 2: Work‑sharing mechanism," defines requirements for work‑sharing techniques used in on‑card biometric comparison. The document targets scenarios where biometric comparison intensity exceeds the standalone processing capabilities of an integrated circuit card (ICC) and specifies how processing tasks and data exchanges are split between the ICC and external components while keeping biometric references protected on‑card.

Key topics and requirements

• Scope and exclusions: Specifies a work‑sharing methodology for on‑card comparison but does not define overall architectures, security policies, off‑card comparison requirements, biometric system‑on‑card requirements (ISO/IEC 17839), or modality‑specific storage/comparison rules.
• Normative references: Relies on ISO/IEC 7816‑4, ISO/IEC 7816‑11, ISO/IEC 24787‑1 and biometric vocabulary (ISO/IEC 2382‑37).
• Conformance: Implementations claiming conformance must support the work‑sharing requirements in Clause 6 and applicable sections of ISO/IEC 24787‑1.
• Work‑sharing procedure (high level):
  • Read biometric information template (excluding the biometric reference) from the ICC (e.g., READ BINARY).
  • Read biometric auxiliary data from a working EF separate from the protected biometric reference (internal EF).
  • Invoke a biometric verification command (e.g., PERFORM BIOMETRIC OPERATION / PBO) to start the first ICC processing phase.
  • ICC returns status bytes (e.g., 62xx) indicating card‑originated feedback is available; host issues GET DATA to retrieve feedback.
  • A final biometric verification command completes the comparison, decision and action; ICC returns status bytes with the verification result.
• Command and status compliance: All command/response APDUs and status bytes must comply with ISO/IEC 7816‑4 and ISO/IEC 7816‑11.

Applications and who uses it

ISO/IEC 24787‑2 is intended for implementers and stakeholders involved with secure card‑based biometric verification:

• Smart card and ICC manufacturers
• Biometric system integrators and middleware developers
• Secure ID and credential program managers (e.g., national identity, access control)
• Security architects and evaluators who need standardized on‑card processing and data‑exchange patterns

Adopting this standard helps preserve on‑card biometric reference confidentiality while enabling higher‑intensity matching through controlled work‑sharing.

Related standards

• ISO/IEC 24787‑1 - On‑card biometric comparison: general principles and specifications
• ISO/IEC 7816‑4 and ISO/IEC 7816‑11 - ICC command structures and biometric personal verification
• ISO/IEC 17839 (Biometric System‑on‑Card series)
• ISO/IEC 19785‑3 and ISO/IEC 2382‑37

Keywords: ISO/IEC 24787‑2:2024, on‑card biometric comparison, work‑sharing mechanism, integrated circuit card (ICC), biometric auxiliary data, PBO, ISO standard.