CEN/TS 17261:2018
(Main)Biometric authentication for critical infrastructure access control - Requirements and Evaluation
Biometric authentication for critical infrastructure access control - Requirements and Evaluation
This document addresses biometric recognition systems that are used as part of an automated access control system to provide a second and independent authentication factor of the individual using the AACS to access secured areas of critical infrastructure.
This document:
- specifies requirements for biometric recognition systems to be used as part of an AACS for critical infrastructure,
- describes a methodology for the evaluation of biometric authentication for AACSs against the specified requirements.
The requirements and test methods address biometric authentication for AACS that: (i) operate in an internal environment constituting part of a larger site, access to which is restricted and controlled by a separate access control system; and (ii) use biometrics as a second authentication factor to a token or proximity card.
This document does not consider access by the general public, e.g. passengers in an airport, or visitors to a hospital.
Products that meet the requirements of this document will comprise (i) a biometric sensor(s) external to the secured area, which reads the biometric characteristics of the user at the point of access; and (ii) a biometric server system performing biometric enrolment, signal processing, storage of biometric references and biometric comparison within a secured area.
This document does not address AACS or AACS portals (turnstiles) but is only concerned with the biometric components which integrate with the AACS. Other standards address requirements and testing of the non-biometric parts of the AACS.
Biometrische Authentifikation für die Zugangskontrolle zu kritischen Infrastrukturen - Anforderungen und Evaluierung
Authentification biométrique pour le contrôle d'accès aux infrastructures critiques - Exigences et évaluation
Biometrična avtentikacija za nadzor kritične infrastrukture - Zahteve in ovrednotenje
Tehnična specifikacija
i) določa zahteve glede zasnove, zmogljivosti in odpornosti proti napadu za biometrične sisteme, ki se uporabljajo kot del avtomatiziranega sistema za nadzor dostopa, ki varuje dostop do kritične infrastrukture (opredeljeno v direktivi Sveta 114/2008/ES),
ii) opisuje metodologije za ocenjevanje izdelkov z biometričnim nadzorom dostopa v povezavi s temi zahtevami.
General Information
Standards Content (Sample)
SLOVENSKI STANDARD
01-februar-2019
%LRPHWULþQDDYWHQWLNDFLMD]DQDG]RUNULWLþQHLQIUDVWUXNWXUH=DKWHYHLQ
RYUHGQRWHQMH
Biometric authentication for critical infrastructure access control - Requirements and
Evaluation
Biometrische Authentifikation für die Zugangskontrolle zu kritischen Infrastrukturen -
Anforderungen und Evaluierung
Authentification biométrique pour le contrôle d'accès aux infrastructures critiques -
Exigences et évaluation
Ta slovenski standard je istoveten z: CEN/TS 17261:2018
ICS:
35.240.15 ,GHQWLILNDFLMVNHNDUWLFHýLSQH Identification cards. Chip
NDUWLFH%LRPHWULMD cards. Biometrics
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
CEN/TS 17261
TECHNICAL SPECIFICATION
SPÉCIFICATION TECHNIQUE
December 2018
TECHNISCHE SPEZIFIKATION
ICS 35.240.15
English Version
Biometric authentication for critical infrastructure access
control - Requirements and Evaluation
Authentification biométrique pour le contrôle d'accès Biometrische Authentifikation für die
aux infrastructures critiques - Exigences et évaluation Zugangskontrolle zu kritischen Infrastrukturen -
Anforderungen und Evaluierung
This Technical Specification (CEN/TS) was approved by CEN on 10 September 2018 for provisional application.
The period of validity of this CEN/TS is limited initially to three years. After two years the members of CEN will be requested to
submit their comments, particularly on the question whether the CEN/TS can be converted into a European Standard.
CEN members are required to announce the existence of this CEN/TS in the same way as for an EN and to make the CEN/TS
available promptly at national level in an appropriate form. It is permissible to keep conflicting national standards in force (in
parallel to the CEN/TS) until the final decision about the possible conversion of the CEN/TS into an EN is reached.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2018 CEN All rights of exploitation in any form and by any means reserved Ref. No. CEN/TS 17261:2018 E
worldwide for CEN national Members.
Contents Page
European foreword . 3
Introduction . 4
1 Scope . 5
2 Normative references . 5
3 Terms and definitions . 6
4 Symbols and abbreviations . 8
5 Conformance . 8
6 Typical use-case . 8
7 Requirements and recommendations . 9
7.1 General . 9
7.2 Design . 9
7.2.1 General . 9
7.2.2 Protection of access to biometric server, biometric data and functions of the
biometric subsystem . 9
7.2.3 Operator/Administrator control and authentication . 9
7.2.4 Door unit . 10
7.2.5 Biometric enrolment, re-enrolment and deletion . 10
7.2.6 Biometric recognition . 10
7.3 Operation . 10
7.3.1 General . 10
7.3.2 Identity assurance for enrolment . 10
7.3.3 Enrolment process . 10
7.3.4 Fallback authentication . 11
7.4 Technical performance . 11
7.4.1 General . 11
7.4.2 Failure to enrol rate . 11
7.4.3 Enrolment transaction duration. 11
7.4.4 False accept rate . 11
7.4.5 False reject rate . 12
7.4.6 Verification transaction duration . 12
7.5 Attack resistance . 12
7.5.1 General . 12
7.5.2 Resistance to tamper . 12
7.5.3 Resistance to presentation attack . 13
7.6 Performance and attack resistance requirements . 13
8 Testing and reporting . 14
8.1 System information and documentation . 14
8.2 Configuration of system for testing . 14
8.2.1 Scenario AACS . 14
8.2.2 Configuration of biometric systems under test . 15
8.3 Outline of test processes . 15
8.3.1 Pretesting . 15
8.3.2 Scenario performance evaluation . 15
8.3.3 Attack resistance evaluation . 17
Bibliography . 18
European foreword
This document (CEN/TS 17261:2018) has been prepared by Technical Committee CEN/TC 224 “Personal
identification and related personal devices with secure element, systems, operations and privacy in a
multi sectorial environment”, the secretariat of which is held by AFNOR.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
According to the CEN-CENELEC Internal Regulations, the national standards organisations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia,
Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France,
Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands,
Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and
the United Kingdom.
Introduction
This document is concerned with the performance-based testing of biometric authentication for
automated access control systems (AACS), in particular for physical access control to controlled areas of
Critical Infrastructure as defined by the European Council Directive 2008/114/EC [7].
It is assumed that biometric recognition constitutes a second authentication factor alongside token-based
authentication and that the AACS requires the results of the biometric and token-based authentication of
the same individual before authorizing access. The biometric+token combination emulates a biometric
verification system. The token presentation constitutes the biometric claim that the capture subject is the
bodily source of the biometric reference associated with the token ID. Accordingly, technical performance
of the biometric authentication is assessed in terms of verification metrics, i.e. False Accept Rate, False
Reject Rate, Failure-to-Enrol Rate and throughput rates. Technical performance requirements and
evaluation methods should be identical irrespective of the biometric technology.
Biometric subsystems should also be evaluated in terms of their vulnerability to defeat. This is to be
assessed through measuring a system’s capacity to resist a direct attack on it or detect an intrusion
attempt by a knowledgeable attacker intent on defeating the biometric authentication. Since method of
attack is dependent on the biometric technology, vulnerability to defeat is assessed in a technology-
specific manner.
The results of an evaluation performed using this document relate to the system’s performance in that
the evaluation should not be used as a guarantee of the performance that would be expected on any other
site.
1 Scope
This document addresses biometric recognition systems that are used as part of an automated access
control system to provide a second and independent authentication factor of the individual using the
AACS to access secured areas of critical infrastructure.
This document:
— specifies requirements for biometric recognition systems to be used as part of an AACS for critical
infrastructure,
— describes a methodology for the evaluation of biometric authentication for AACSs against the
specified requirements.
The requirements and test methods address biometric authentication for AACS that: (i) operate in an
internal environment constituting part of a larger site, access to which is restricted and controlled by a
separate access control system; and (ii) use biometrics as a second authentication factor to a token or
proximity card.
This document does not consider access by the general public, e.g. passengers in an airport, or visitors to
a hospital.
Products that meet the requirements of this document will comprise (i) a biometric sensor(s) external to
the secured area, which reads the biometric characteristics of the user at the point of access; and (ii) a
biometric server system performing biometric enrolment, signal processing, storage of biometric
references and biometric comparison within a secured area.
This document does not address AACS or AACS portals (turnstiles) but is only concerned with the
biometric components which integrate with the AACS. Other standards address requirements and testing
of the non-biometric parts of the AACS.
2 Normative references
The following documents are referred to in the text in such a way
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.