Overview
ISO/IEC 24787-1:2024 - Information technology - On-card biometric comparison - Part 1: General principles and specifications - defines requirements, principles and specifications for performing on-card biometric comparison inside an integrated circuit card (ICC). The standard specifies architectures for biometric comparison using an ICC, covers sensor‑off‑card on‑card comparison as well as on‑card comparison as part of a biometric system‑on‑card, and establishes security policies for on‑card biometric comparison. It is the first part of a split revision (replacing ISO/IEC 24787:2018) and focuses on general rules rather than modality‑specific or off‑card comparison requirements.
Key topics and technical requirements
- Architectures and operational models
- Definitions of on‑card comparison, off‑card comparison, sensor‑off‑card and biometric system‑on‑card concepts.
- Framework for biometric verification using an ICC.
- Biometric data handling and encoding
- Requirements for storage formats, biometric information templates, and encoding suitable for use on ICCs.
- Guidance on use of a biometric reference for multiple applications.
- Processes and lifecycle
- Enrolment/re‑enrolment, verification, comparison/decision processes and termination (permanent deactivation).
- Security policies
- Minimum security policy requirements for on‑card biometric comparison, retry counter management, and policies for multiple applications (taxonomies and SP1/SP2/SP3 models).
- Interoperability artefacts
- Application selection (AID), APDU examples, and data object formats to support vendor and system interoperability.
- Informative annexes
- Examples for APDU usage, global biometric reference implementation, security status transitions, and CBEFF‑3 style biometric information templates.
Applications and who uses this standard
ISO/IEC 24787-1 is intended for organizations implementing secure biometric verification on smart cards and similar ICC devices, including:
- Card manufacturers and secure element designers
- Biometric system integrators and solution vendors
- Government agencies issuing eIDs, national ID cards, or border‑control credentials
- Financial and enterprise security architects deploying card-based authentication
- Test and certification labs assessing on‑card biometric implementations
Practical benefits include enhanced privacy (biometric references remain on‑card), reduced risk of biometric data leakage, and standardized approaches for secure on‑card verification in sensor‑off‑card deployments.
Related standards
Keywords: ISO/IEC 24787-1:2024, on-card biometric comparison, ICC, sensor-off-card, biometric reference, security policies, biometric verification.