Best practices for the security evaluation of biometric systems

This paper describes best practices for the security evaluation of biometric systems. This type of evaluation has been addressed in several documents. However, not all of these documents describe the complete evaluation methodology, or are focused on biometrics or do propose clear testing procedures. Therefore, this work defines the most proper way to carry out this evaluation methodology considering biometrics and the special characteristics of these kind of systems (i.e. biometrics is non-deterministic technology highly influenced by user behavior and the operational environment). In particular, this paper specifies how to select which attacks shall be studied, how to conduct such attacks and which is the most suitable method to report the evaluation results.