ISO/IEC 30107-3:2023

INTERNATIONAL ISO/IEC
STANDARD 30107-3
Second edition
2023-01
Information technology — Biometric
presentation attack detection —
Part 3:
Testing and reporting
Technologies de l'information — Détection d'attaque de présentation
en biométrie —
Partie 3: Essais et rapports d'essai
Reference number
© ISO/IEC 2023
© ISO/IEC 2023
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
© ISO/IEC 2023 – All rights reserved

Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
3.1 Attack elements . 2
3.2 Metrics . 3
3.3 Test roles . 5
4 Abbreviated terms . 6
5 Conformance . 7
6 Presentation attack detection (PAD) overview . 7
7 Levels of evaluation of PAD mechanisms . 8
7.1 Overview . 8
7.2 General principles of evaluation of PAD mechanisms . 9
7.3 PAD subsystem evaluation. 9
7.4 Data capture subsystem evaluation . 10
7.5 Full system evaluation . 10
8 Artefact properties .11
8.1 Properties of PAIs in biometric impostor attacks . 11
8.2 Properties of PAIs in biometric concealer attacks .12
8.3 Properties of synthesized biometric samples with abnormal characteristics .12
9 Considerations in non-conformant capture attempts of biometric characteristics .13
9.1 Methods of presentation .13
9.2 Methods of assessment .13
10 Artefact creation and usage in evaluations of PAD mechanisms .13
10.1 General .13
10.2 Artefact creation and preparation . 13
10.3 Artefact usage . 14
10.4 Iterative testing to identity effective artefacts . 15
11 Process-dependent evaluation factors .15
11.1 Overview . 15
11.2 Evaluating the enrolment process . 15
11.3 Evaluating the verification process . 16
11.4 Evaluating the identification process . 16
11.5 Evaluating offline PAD mechanisms . 17
12 Evaluation using Common Criteria framework .17
12.1 General . 17
12.2 Common Criteria and biometrics . 18
12.2.1 Overview . 18
12.2.2 General evaluation aspects . 19
12.2.3 Error rates in testing . 19
12.2.4 PAD evaluation . 19
12.2.5 Vulnerability assessment . 20
13 Metrics for the evaluation of biometric systems with PAD mechanisms .21
13.1 General . 21
13.2 Metrics for PAD subsystem evaluation . 22
13.2.1 General .22
13.2.2 Classification metrics .22
13.2.3 Non-response metrics . 25
iii
© ISO/IEC 2023 – All rights reserved

13.2.4 Efficiency metrics .25
13.2.5 Summary . 25
13.3 Metrics for data capture subsystem evaluation . 25
13.3.1 General . 25
13.3.2 Acquisition metrics .26
13.3.3 Non-response metrics . 26
13.3.4 Efficiency metrics .26
13.3.5 Summary . 26
13.4 Metrics for full system evaluation . 27
13.4.1 General . 27
13.4.2 Accuracy metrics. 27
13.4.3 Efficiency metrics . 27
13.4.4 Generalized full-system evaluation performance .28
13.4.5 Summary . 30
Annex A (informative) Classification of attack types .32
Annex B (informative) Examples of artefact species used in a PAD subsystem evaluation
for fingerprint capture devices .36
Annex C (informative) Roles in PAD testing .37
Bibliography .38
iv
© ISO/IEC 2023 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work.
The procedures used to develop this document and those intended for its further maintenance
are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria
needed for the different types of document should be noted. This document was drafted in
accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or
www.iec.ch/members_experts/refdocs).
Attention is drawn to
...