ANSI-X9.84-2003.pdf
《ANSI-X9.84-2003.pdf》由会员分享,可在线阅读,更多相关《ANSI-X9.84-2003.pdf(148页珍藏版)》请在三一文库上搜索。
1、National Standard for Financial Services X9.84-2003 Biometric Information Management and Security for the Financial Services Industry Many changes, which may greatly affect its contents, can occur before this document is completed. The X9F4 working group may not be held responsible for the contents
2、of this document. Implementation or design based on this revised draft standard is at the risk of the user. No advertisement or citation implying compliance with a “Standard” should appear, as it is erroneous and misleading to so state. Copies of this revised draft proposed American National Standar
3、d will be available from the X9 Secretariat when the document is finally announced for two months public comment. Notice of this announcement will be in the trade press. Secretariat: Accredited Standards Committee X9, Incorporated Approved July 29, 2003: American National Standards Institute Copyrig
4、ht American National Standards Institute Provided by IHS under license with ANSI Licensee=IHS Employees/1111111001, User=OConnor, Maurice Not for Resale, 04/29/2007 12:50:35 MDTNo reproduction or networking permitted without license from IHS -,-,- ANS X9.84-2003 Foreword Approval of an American Nati
5、onal Standard requires verification by ANSI that the requirements for due process, consensus, and other criteria for approval have been met by the standards developer. Consensus is established when, in the judgment of the ANSI Board of Standards Review, directly and materially affected interests hav
6、e reached substantial agreement. Substantial agreement means much more than a simple majority, but not necessarily unanimity. Consensus requires that all views and objections be considered, and that a concerted effort be made toward their resolution. The use of American National Standards is complet
7、ely voluntary; their existence does not in any respect preclude anyone, whether he has approved the standards or not from manufacturing, marketing, purchasing, or using products, processes, or procedures not conforming to the standards. The American National Standards Institute does not develop stan
8、dards and will in no circumstances give an interpretation of any American National Standard. Moreover, no person shall have the right or authority to issue an interpretation of an American National Standard in the name of the American National Standards Institute. Requests for interpretations should
9、 be addressed to the secretariat or sponsor whose name appears on the title page of this standard. CAUTION NOTICE: This American National Standard may be revised or withdrawn at any time. The procedures of the American National Standards Institute require that action be taken to reaffirm, revise, or
10、 withdraw this standard no later than five years from the date of approval. Published by Accredited Standards Committee X9, Incorporated Financial Industry Standards P. O. Box 4035 Annapolis, MD 21403 www.x9.org Copyright 2002 by Accredited Standards Committee X9, Incorporated All rights reserved. N
11、o part of this publication may be reproduced in any form, in an electronic retrieval system or otherwise, without prior written permission of the publisher. Printed in the United States of America 2003 ASC X9, Inc. i Copyright American National Standards Institute Provided by IHS under license with
12、ANSI Licensee=IHS Employees/1111111001, User=OConnor, Maurice Not for Resale, 04/29/2007 12:50:35 MDTNo reproduction or networking permitted without license from IHS -,-,- ANS X9.84-2003 Contents Forewordi Introduction vi 1 Scope.1 2 Conformance and Organization.1 3 Normative References .2 4 Terms a
13、nd Definitions4 5 Symbols and Abbreviated Terms.9 6 Overview of Biometric Technology 11 6.1 Introduction 11 6.2 Fingerprint Biometrics11 6.3 Voice Biometrics 12 6.4 Iris Biometrics.12 6.5 Retina Biometrics.13 6.6 Face Biometrics .13 6.7 Hand Geometry Biometrics13 6.8 Signature Biometrics14 6.9 Techn
14、ology Considerations .14 6.9.1 Introduction to Consideration.14 6.9.2 Universality.14 6.9.3 Distinctiveness.15 6.9.4 Accuracy 15 6.9.5 Performance Evaluation.17 7 Basic Principles of Biometric Architectures19 7.1 Introduction 19 7.2 The Data Collection Subsystem.20 7.3 The Transmission Subsystem21 7
15、.4 The Signal Processing Subsystem21 7.5 Matching Subsystem22 7.6 The Decision Subsystem .23 7.7 The Storage Subsystem.23 8 Management and Security Requirements24 8.1 Introduction 24 8.2 Core Security Requirements24 8.3 Enrollment24 8.3.1 Initial Enrollment.25 8.3.2 Re-enrollment.26 8.4 Verification
16、 .26 8.5 Identification.28 8.6 Transmission and Storage.29 8.6.1 Transmission29 8.6.2 Central Data Base29 8.6.3 Tokens .30 8.7 Termination and Archive30 8.7.1 Termination30 8.7.2 Archiving 31 8.8 Compliance and the Event Journal31 9 Techniques.31 9.1 Biometric Information Objects31 9.2 ASN.1 Syntax.
17、36 9.2.1 Biometric Object.36 9.2.2 Biometric Header .36 9.2.3 Biometric Objects.39 2003 ASC X9, Inc. ii Copyright American National Standards Institute Provided by IHS under license with ANSI Licensee=IHS Employees/1111111001, User=OConnor, Maurice Not for Resale, 04/29/2007 12:50:35 MDTNo reproduct
18、ion or networking permitted without license from IHS -,-,- ANS X9.84-2003 9.2.4 Integrity Objects.39 9.2.5 Privacy Objects44 9.2.6 Integrity and Privacy Objects .47 9.2.7 Biometric Syntax Sets48 9.3 Cryptographic Techniques.49 9.3.1 Security Architecture49 9.3.2 Key Management.49 9.3.3 Digital Signa
19、tures.50 9.3.4 Message Authentication Codes (MAC)50 9.3.5 Encryption for Purposes of Privacy50 9.4 Physical Techniques51 Annex A: (Normative) Biometrics Syntax and Encoding Rules 52 A.1 Introduction 52 A.2 X9-84-Biometrics ASN.1 Module.52 A.3 X9-84-CMS ASN.1 Module57 A.4 X9-84-ObjectIdentifiers ASN.
20、1 Module60 A.5 Object Identifiers70 Annex B: (Informative) Bibliography .72 Annex C: (Informative) Data Flow Diagrams 73 Annex D: (Informative) Biometric Enrollment76 D.1 Identification Criteria for an Individual76 D.2 Quality Check and Verification of Matchability.76 Annex E: (informative) Security
21、 Considerations .78 E.1 Registration of individual using false identity78 E.2 Fraud Susceptibility within Data Collection “Synthetic Attack”.78 E.3 Protection of the data79 E.3.1 Injection of false/replayed biometric data79 E.3.2 Search for match between chosen sample and templates79 E.3.3 Search fo
22、r match between pairs of templates.80 E.4 Modification of verification result 80 E.5 False Match versus False Non-Match81 E.5.1 Improper Threshold Settings .82 E.5.2 Improper Device Calibration82 E.5.3 Illicit Device or System Performance.82 E.6 Scores and Thresholds.82 E.6.1 Hillclimbing Attack83 E
23、.6.2 Update and Adaptation83 E.7 Single versus Multi-Factor Authentication84 E.8 Testing85 E.9 Open Versus Closed Systems86 E.10 Compromise/loss of biometric data87 E.11 Data compression.88 E.12 System circumvention.88 Annex F: (Informative) Biometric Validation Control Objectives.89 F.1 Introductio
24、n 89 F.2 Environmental Controls89 F.2.1 Security Policy90 F.2.2 Security Organization.90 F.2.3 Asset Classification and Management.91 F.2.4 Personnel Security.91 F.2.5 Physical and Environmental Security.93 F.2.6 Operations Management94 F.2.7 System Access Management 95 F.2.8 Systems Development and
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- ANSI X9 84 2003
链接地址:https://www.31doc.com/p-3729409.html