ISO 24745 “Biometric Information Protection”
BioHASH® complies with the ISO/IEC International standard 24745 (in progress) for Biometric Information Protection. This international standard provides guidance for the protection of biometric information under various requirements for confidentiality, integrity and renewability/revocability during storage and transfer. Also this standard provides requirements and guidelines for the secure and privacy-compliant management and processing of biometric information. The following figure shows the ISO reference architecture for Biometric Information Protection.
Reference architecture for Biometric Information Protection showing the enrollment, feature extraction and matching based on BioHASH® templates (source ISO 24745 standard, Figure 5).
Enrollment and Verification work like traditional biometric systems
priv-ID’s BioHASH® solution complies with the ISO reference architecture for Biometric Information Protection. During enrollment, a BioHASH® template is generated from a biometric sample (a fingerprint image or a minutiae template), resulting in two components; a Pseudonymous Identifier (PI) and Auxiliary Data (AD). The PI information is protected with a SHA-256 cryptographic hash function, whereas the AD contains random salting information to allow for renewable anonymous templates. In addition to the biometric information, also other information like biographic information, application identifiers, terminal identifiers etc. may be included in the hash-protected version of PI.
In the verification process, the live fingerprint measurement is combined with the Auxiliary Data to derive a candidate PI*, again protected with a SHA-256 (possibly combined with other information that is included in the hash). If the PI from the enrollment and the PI* in the verification are identical, there is a positive match.
ISO 19794 – Template Format
ISO 19794 is a standard that describes data exchange formats for fingerprints. BioHASH® can work with standardized Image data (ISO 19794-4), as well as with minutiae templates (ISO 19794-2) in Fingerprint Minutiae Record (FMR), Fingerprint Minutiae Card (FMC), or Fingerprint Compact Card (FCC) format. BioHASH® also complies with MINEX II, which is a subset of the ISO minutiae template format. For “greenfield” applications the use of ISO 19794-4 images is recommended, as this further improves the matching quality without creating undue load on the Smart Card resources.
