ISO/IEC 24761:2019 PDF

Overview - ISO/IEC 24761:2019 (ACBio)

ISO/IEC 24761:2019, titled Information technology - Security techniques - Authentication context for biometrics (ACBio), defines the structure and data elements used to represent assurance about biometric enrolment and verification performed at a remote site. An ACBio instance is a signed report (encoded using ASN.1/BER) that carries information about the biometric processing units (BPUs), biometric references, verification results, and associated certificates so a remote validator can check the integrity and trustworthiness of a biometric transaction without receiving private biometric data.

Key aspects:

• Specifies the cryptographic syntax of ACBio instances using the Cryptographic Message Syntax (CMS) schema and compact binary encoding.
• Focuses on content and encoding of ACBio instances; it does not define protocols between BPUs, claimants, and validators.
• Applicable to single-modal and multimodal fusion biometric processes; biometric identification is out of scope.
• Real-time presentation attack detection (PAD) data is not provided; only PAD assurance information can appear in BPU reports.

Key Topics and Requirements

• ACBio instance structure: data blocks for BPU information, biometric processing details, and certificates.
• BPU (Biometric Processing Unit) reports and BPU certificates: provide assurance of device identity, capability, and execution integrity.
• Biometric capability classes: model for grouping how enrolment/verification functions map to BPU roles (e.g., sensor, comparator, storage).
• Cryptographic assurances: digital signatures and X.509 certificates (PKI/PKIX) to ensure data origin and integrity.
• Encoding and syntax: ASN.1 module and BER encoding for interoperable, compact binary representation.
• Privacy-preserving validation: design enables validators to assess results without receiving raw biometric samples.

Practical Applications and Who Uses It

ACBio is intended for organizations and professionals building or auditing biometric authentication systems that require verifiable, privacy-preserving evidence about remote biometric transactions:

• Biometric device vendors producing BPU firmware and BPU reports
• System integrators implementing remote verification or enrolment workflows
• Security architects and engineers defining assurance and trust frameworks
• Certification authorities issuing BPU and BRT certificates
• Service providers offering mobile authentication, e‑government or remote identity-proofing solutions that need tamper-evident transaction evidence

Related Standards

• ISO/IEC 24745 - Biometric information protection
• ISO/IEC 9594-8 / PKIX - Public-key and attribute certificate frameworks
• ISO/IEC 2382-37 - Biometrics vocabulary
• RFC/CMS and ASN.1/BER standards (for encoding and cryptographic message structures)

ISO/IEC 24761:2019 is essential when you need standardized, signed authentication context for biometric enrolment and verification, enabling trusted remote validation while preserving biometric privacy.