Document ID: chunk:federal_register_of_legislation:F2024L01435:reg:4:p1
Version: federal_register_of_legislation:F2024L01435
Segment Type: reg
Provision Reference: reg 4 (pt 1/2)
Character Range: 96422–103624

4                                                         Custom biometric capability:                                                                                    1.      an authenticated protected channel between the sensor and the accredited entity's information technology system must be set up before capturing the biometric information from the individual;
                                                                                                                                                                          1.     must use a biometric matching algorithm to conduct one‑to‑one biometric matching between the acquired image and the biometric template;
                                                                                                                                                                          2.      biometric matching must be conducted using the biometric matching algorithm:
                                                                                                                                                                              (i) locally on the individual's device; or
                                                                                                                                                                              (ii) centrally, being where the biometric information is transferred to the entity's information technology system and the biometric matching is conducted remotely by the entity from the individual's device;
                                                                                                                                                                          1.     if biometric matching is conducted centrally:
                                                                                                                                                                              (i) use of the biometric as an authentication factor must be limited to one or more specific devices that are identified using approved cryptography;
                                                                                                                                                                              (ii) a separate cryptographic key must be used for identifying the device, as distinct from the biometric factor;
                                                                                                                                                                              (iii) all transmission of biometrics must occur over the authenticated protected channel; and
                                                                                                                                                                              (iv) biometric template protection specified in ISO/IEC 24745:2022 must be implemented;
                                                                                                                                                                          1.      presentation attack detection must:
                                                                                                                                                                              (i) be based on data captured by both the data capture subsystem and through system level monitoring, as described by ISO/IEC 30107-1:2023; and
                                                                                                                                                                              (ii) include liveness detection;
                                                                                                                                                                          1.      the capture of the acquired image and presentation attack detection processes must be completed as part of the same process before submission of the acquired biometric for biometric matching;
                                                                                                                                                                          2.     the presentation attack detection determination (as to whether the biometric presentation passes as being genuine according to the PAD system) must be made either:
                                                                                                                                                                              (i) locally on the individual's device; or
                                                                                                                                                                              (ii) centrally (where the biometric information is transferred to the ISP's information technology system and the biometric matching is conducted remotely by the entity from the individual's device);
                                                                                                                                                                          1.     presentation attack detection must allow no more than 5 consecutive failed authentication attempts;
                                                                                                                                                                          2.       once the limit of consecutive failed attempts has been reached, the custom biometric capability must either:
                                                                                                                                                                              (i) impose a delay of at least 30 seconds before the individual's next attempt to authenticate using the custom biometric capability, increasing exponentially with each successive attempt (e.g., one minute before the following attempt, 2 minutes before the second following attempt); or
                                                                                                                                                                              (ii) disable the custom biometric capability for authentication and offer another authentication factor that is a different biometric modality or a PIN/passcode if not already a required factor;
                                                                                                                                                                          1.       subject to paragraph (k)—the presentation attack detection technology must be tested in accordance with section 2.3;
                                                                                                                                                                          2.     despite item 3 in the table in section 2.3 all presentation attack instrument species used in testing of the biometric algorithm must have an APCER of no more than 10%; and
                                                                                                                                                                          3.       the biometric matching algorithm must be