ISO/IEC 27553-2:2025
(Main)Information security, cybersecurity and privacy protection — Security and privacy requirements for authentication using biometrics on mobile devices — Part 2: Remote modes
Information security, cybersecurity and privacy protection — Security and privacy requirements for authentication using biometrics on mobile devices — Part 2: Remote modes
This document provides high-level security and privacy requirements for authentication using biometrics on mobile devices, in particular, for functional components, communication, storage and remote processing. This document is applicable to remote modes, i.e. the cases where: — the biometric sample is captured through mobile devices, and — the biometric data or derived biometric data are transmitted between the mobile devices and the remote services in either or both directions. The following are out of scope of this document: — the cases where the biometric data or derived biometric data never leave the mobile devices (i.e. local modes), — the preliminary steps for biometric enrolment before authentication procedure, and — the use of biometric identification as part of the authentication.
Titre manque — Partie 2: Titre manque
General Information
Buy Standard
Standards Content (Sample)
International
Standard
ISO/IEC 27553-2
First edition
Information security, cybersecurity
2025-07
and privacy protection — Security
and privacy requirements for
authentication using biometrics on
mobile devices —
Part 2:
Remote modes
Reference number
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
3.1 Biometrics .2
3.2 Authentication .4
3.3 System .4
4 Abbreviated terms . 5
5 Security and privacy considerations . 6
5.1 General .6
5.2 Security challenges common to all biometric systems .6
5.3 Reasons for and implications of choosing a remote mode instead of local mode .7
5.4 Security and privacy challenges specific to remote modes .8
5.4.1 General .8
5.4.2 Sharing biometric information with remote services .8
5.4.3 Security heterogeneity of remote services information system .8
6 System description . 9
6.1 Generic architecture . .9
6.2 Entities and components .9
6.2.1 Biometric system .9
6.2.2 RP agent . .10
6.2.3 Authentication agent.10
6.2.4 RP server .10
6.2.5 Authentication server .10
6.3 Biometric system application models .10
6.4 Types of authentication workflow for remote mode . 12
7 Information assets .12
8 Threat analysis . 14
8.1 Threats related to the biometric system .14
8.2 Threats related to the authentication and RP agents . 15
8.3 Threats related to the authentication and RP servers .17
8.4 Threats to communication between agents and servers .17
9 Security requirements and recommendations .18
9.1 General .18
9.2 Biometric system .18
9.3 Mobile device - side . 20
9.4 Server-side.21
9.5 Communication between agents and server. 22
10 Privacy requirements and recommendations .22
Annex A (informative) Implementation example .24
Annex B (informative) Authentication assurance and assurance level .32
Bibliography .39
© ISO/IEC 2025 – All rights reserved
iii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection.
A list of all parts in the ISO/IEC 27553 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
© ISO/IEC 2025 – All rights reserved
iv
Introduction
As the computational and functional capabilities of mobile devices rapidly evolve, authentication technologies
using biometrics based on physiological or behavioural characteristics (e.g. fingerprint, face, voiceprint) have
been developed and widely adopted in various mobile applications. Compared to traditional authentication
methods on mobile devices such as passwords, patterns, or SMS messages, biometric characteristics are
easy to use and not shareable. Since authentication methods using biometrics can provide a secure, reliable
and more convenient solution, they have become an attractive topic for both industry and academia.
However, the fragmentation of computing environments for mobile devices (e.g. different operating
systems, different trusted environment implementations, different biometric system implementations,
open computation environments in mobile devices, and open communication networks between mobile
devices and servers) often results in inconsistent implementations, which can increase vulnerabilities and
attack risks against mobile devices. This fragmentation makes it even more necessary to analyse security
challenges, threats, and security frameworks for authentication using biometrics on mobile devices and
to specify the high-level security requirements that can mitigate the security risks for applications of
authentication using biometrics in mobile devices.
This document is the second part of the ISO/IEC 27553 series, which puts forward the security and privacy
requirements for authentication using biometrics on mobile devices. Biometrics in the ISO/IEC 27553 series
is used for authentication using mobile devices, whose result is consumed by relying parties. This document
is applicable to cases where the biometric data or derived biometric data are transmitted between the
mobile devices and the remote services in either or both directions. Those cases are called remote modes in
this document. A typical example of remote modes is the case where biometric processing is partially done
on the mobile device and partially done remotely, and the result of authentication is consumed by relying
parties.
Other typical examples include cases where:
— presentation attack detection is delegated to a remote service;
— a biometric reference (i.e. enrolled biometric data) is stored on an outsourced storage and sent
...
FINAL DRAFT
International
Standard
ISO/IEC
FDIS
27553-2
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection — Security
Voting begins on:
and privacy requirements for
2025-04-22
authentication using biometrics on
Voting terminates on:
mobile devices —
2025-06-17
Part 2:
Remote modes
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
ISO/IEC FDIS 275532:2025(en) © ISO/IEC 2025
FINAL DRAFT
ISO/IEC FDIS 27553-2:2025(en)
International
Standard
ISO/IEC
FDIS
27553-2
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection — Security
Voting begins on:
and privacy requirements for
authentication using biometrics on
Voting terminates on:
mobile devices —
Part 2:
Remote modes
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO/IEC 2025
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland Reference number
ISO/IEC FDIS 275532:2025(en) © ISO/IEC 2025
© ISO/IEC 2025 – All rights reserved
ii
ISO/IEC FDIS 27553-2:2025(en)
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
3.1 Biometrics .2
3.2 Authentication .4
3.3 System .4
4 Abbreviated terms . 5
5 Security and privacy considerations . 6
5.1 General .6
5.2 Security challenges common to all biometric systems .6
5.3 Reasons for and implications of choosing a remote mode instead of local mode .7
5.4 Security and privacy challenges specific to remote modes .8
5.4.1 General .8
5.4.2 Sharing biometric information with remote services .8
5.4.3 Security heterogeneity of remote services information system .8
6 System description . 9
6.1 Generic architecture . .9
6.2 Entities and components .9
6.2.1 Biometric system .9
6.2.2 RP agent . .10
6.2.3 Authentication agent.10
6.2.4 RP server .10
6.2.5 Authentication server .10
6.3 Biometric system application models .10
6.4 Types of authentication workflow for remote mode . 12
7 Information assets .12
8 Threat analysis . 14
8.1 Threats related to the biometric system .14
8.2 Threats related to the authentication and RP agents . 15
8.3 Threats related to the authentication and RP servers .17
8.4 Threats to communication between agents and servers .17
9 Security requirements and recommendations .18
9.1 General .18
9.2 Biometric system .18
9.3 Mobile device - side . 20
9.4 Server-side.21
9.5 Communication between agents and server. 22
10 Privacy requirements and recommendations .22
Annex A (informative) Implementation example .24
Annex B (informative) Authentication assurance and assurance level .32
Bibliography .39
© ISO/IEC 2025 – All rights reserved
iii
ISO/IEC FDIS 27553-2:2025(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection.
A list of all parts in the ISO/IEC 27553 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
© ISO/IEC 2025 – All rights reserved
iv
ISO/IEC FDIS 27553-2:2025(en)
Introduction
As the computational and functional capabilities of mobile devices rapidly evolve, authentication technologies
using biometrics based on physiological or behavioural characteristics (e.g. fingerprint, face, voiceprint) have
been developed and widely adopted in various mobile applications. Compared to traditional authentication
methods on mobile devices such as passwords, patterns, or SMS messages, biometric characteristics are
easy to use and not shareable. Since authentication methods using biometrics can provide a secure, reliable
and more convenient solution, they have become an attractive topic for both industry and academia.
However, the fragmentation of computing environments for mobile devices (e.g. different operating
systems, different trusted environment implementations, different biometric system implementations,
open computation environments in mobile devices, and open communication networ
...
ISO/IEC FDIS 27553-2:2025(en)
ISO/IEC JTC 1/SC 27
Secretariat: DIN
Date: 2025-01-2904-07
Information security, cybersecurity and privacy protection— —
Security and privacy requirements for authentication using
biometrics on mobile devices – —
Part 2:
Remote modes
FDIS stage
ISO/IEC FDIS 27553-2:2025(en)
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication
may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying,
or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO
at the address below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: + 41 22 749 01 11
Fax: +41 22 749 09 47
EmailE-mail: copyright@iso.org
Website: www.iso.orgwww.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
ISO/IEC FDIS 27553-2:2025(en)
Contents
Foreword . v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 6
5 Security and privacy considerations . 6
6 System description . 9
7 Information assets . 14
8 Threat analysis . 16
9 Security requirements and recommendations . 20
10 Privacy requirements and recommendations . 24
Annex A (informative) Implementation example . 27
Annex B (informative) Authentication assurance and assurance level . 39
Bibliography . 46
Foreword . v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 6
5 Security and privacy considerations . 6
5.1 General . 6
5.2 Security challenges common to all biometric systems . 6
5.3 Why one would choose to go for remote modes instead of local modes?. 7
5.4 Security and privacy challenges specific to remote modes . 8
5.4.1 General . 8
5.4.2 Sharing biometric information with remote services . 8
5.4.3 Security heterogeneity of remote services information system . 9
6 System description . 9
6.1 Generic architecture . 9
6.2 Entities and components . 10
6.2.1 Biometric system . 10
6.2.2 Relying Party agent . 11
6.2.3 Authentication agent . 11
6.2.4 Relying Party server . 11
6.2.5 Authentication server . 11
6.3 Biometric system application models . 11
6.4 Types of authentication workflow for remote mode . 13
© ISO/IEC 2025 – All rights reserved
iii
ISO/IEC FDIS 27553-2:2025(en)
7 Information assets . 13
8 Threat analysis . 15
8.1 Threats related to the biometric system . 15
8.2 Threats related to the authentication and relying party agents. 16
8.3 Threats related to the authentication and relying party servers . 17
8.4 Threats to communication between agents and servers. 18
9 Security requirements and recommendations . 19
9.1 General . 19
9.2 Biometric system . 19
9.3 Mobile Device - side . 21
9.4 Server-side . 22
9.5 Communication between agents and server . 23
10 Privacy requirements and recommendations . 23
Annex A (informative) Implementation example . 26
A.1 General . 26
A.2 Type 1 – example architectures and example workflow . 26
A.2.1 Example architectures . 26
A.2.2 Example of workflow . 28
A.2.2.1 Overview . 28
A.2.2.2 Authentication . 28
A.3 Type 2 – example architectures . 29
Annex B (informative) Authentication assurance and assurance level . 34
B.1 Introduction . 34
B.1.1 General . 34
B.1.2 Considerations for authentication assurance . 34
B.1.3 Assurance levels . 35
B.1.4 Achieving the required level of authentication assurance . 35
B.2 Mitigation of the threats of acquiring biometric data for use in mounting presentation
attacks . 36
B.2.1 General . 36
B.2.2 Threat mitigation by transformation of the BR and BP . 36
B.2.3 Threat mitigation against preparation of presentation attack . 36
B.3 Threat mitigations for authentication credentials . 37
B.4 Threat mitigations for proofs . 38
B.4.1 Need for proofs . 38
B.4.2 Mitigation of threats to the proof(s) . 38
B.5 Biometric authentication assurance levels vector . 39
Bibliography . 41
© ISO/IEC 2025 – All rights reserved
iv
ISO/IEC FDIS 27553-2:2025(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members
of ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of
document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC
Directives, Part 2 (see www.iso.org/directiveswww.iso.org/directives or
www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the use of
(a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any claimed
patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not received
notice of (a) patent(s) which may be required to implement this document. However, implementers are
cautioned that this may not represent the latest information, which may be obtained from the patent database
available at www.iso.org/patents and https://patents.iec.ch.www.iso.org/patents and https://patents.iec.ch.
ISO and IEC shall not be held responsible for ident
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.