Re: [bws-discuss] RE: XCBF Token & Related work

["Phillip H. Griffin" <phil@phillipgriffin.com>]

X9F worked with NIST on their initial CBEFF standards effort, along with BioAPI, who had a C-based API but no formal schema. Both BioAPI and X9.84 formats were included as approved formats in the first CBEFF standard. When NIST took that work to ISO/IEC, the X9.84 format was dropped as an approved format, and not included in the standards. Only BioAPI went forward. X9F only found out about this development some time later.

As I recall from way back, when they asked, the X9F committee was told that they would need to formally apply (somehow) to get their format approved by the ISO/IEC biometrics committee. Meanwhile the X9.84 schema became input to XCBF in OASIS, and changes in XCBF were later incorporated into an X9.84 revision. Since X9F is the tag to ISO TC68/SC2, and does not have a channel into ISO/IEC or any formal way to submit work or to comment on work in ISO/IEC, X9.84 was taken into ISO and much of it's management capabilities standardized as ISO 19092. This was without any schema, as 19092 is purely an information security management standard.

This year, X9.73 CMS and X9.96 XML CMS were merged to form X9.73:2010 CMS - ASN.1 and XML, since the two earlier standards shared a common XML schema. A revision of X9.84 incorporated what we had learned doing ISO 19092, included all of its information security management aspect, and simplified the messaging to rely on the new X9.73:2010 CMS - ASN.1 and XML standard. At the same time, the committee was able to provide cryptographic protection, not only the ISO/IEC template formats, but to any biometric data format, including samples, collections of templates, or other data formats, either proprietary or future versions of any follow on ISO/IEC work. Effectively, X9.84:2010 is independent of the format and type of the biometric payloads that it protects.

One notable new feature of X9.73:2010 CMS is that attributes were defined for SAML and XACML content that can be cryptographically bound to biometric information, such as reference templates. X9.84 defines many other important attributes, such as modality, biometric information security policy (BP), biometric practice statements (BPS), and privacy policy.

Phil




On 10/21/2010 8:59 AM, Mangold, Kevin C. wrote:

D7A0423E5E193F40BE6E94126930C49307D0D5831E@MBCLUSTER.xchange.nist.gov" type="cite">

All,

 

I apologize for the late response. Going through the documents you referenced, Phil, was actually pretty interesting! I’ve been working with Ross on recommendations to ISO to update their CBEFF patron format, specifically the XML schema. A few of the recommendations are irrelevant to the XCBF schema. The remaining is a matter of taking advantage of XML Schema-provided types (instead of creating another replica of a certain data type) when converting the ASN.1 to XML Schema.

 

I’m curious why ISO didn’t build off of the XML Common Biometric Format when working on their CBEFF schemas; seems like it would have been a good place for them to start.

 

---

Kevin Mangold

National Institute of Standards and Technology

Information Technology Lab / Information Access Division / Image Group / Biometrics Clients Lab

Office: 301-975-5628

 

From: Micheals, Ross J.
Sent: Tuesday, October 05, 2010 11:33
To: bws-discuss@lists.oasis-open.org
Cc: Mangold, Kevin C.
Subject: RE: XCBF Token & Related work

 

Phil:

 

Thank you for the excellent idea! Kevin, can you comment on how Phil’s idea relates (or doesn’t) to the CBEFF schema update we’re working on?

 

-Ross

 

From: Phillip H. Griffin [mailto:phil@phillipgriffin.com]
Sent: Tuesday, October 05, 2010 10:00 AM
To: Micheals, Ross J.; Stapleton, Jeff; Michael McCormick
Subject: Re: [bws-discuss] Welcome (again!)

 

Hi Michael,

You may wish to consider http://xml.coverpages.org/WSS-XCBF-Token.pdf as a useful input document to this work, which is based on this: http://xml.coverpages.org/xcbf.html. Old work now and its basis has now evolved into http://webstore.ansi.org/RecordDetail.aspx?sku=ANSI+X9.84-2010 (ANSI X9.84-2010, Biometric Information Management and Security), which we revised and this year.

This latest X9.84 standard relies on X9.73 2010 which defines SOAP extensions (see Annex B) to provide Web services for information objects such as those defined in X9.84 that may be represented in either binary or XML formats (http://webstore.ansi.org/RecordDetail.aspx?sku=ANSI+X9.73-2010).

Phil



On 10/5/2010 9:00 AM, Micheals, Ross J. wrote:

Dear bws-discuss participants:

 

I hope everyone is well rested from the biometric conference season!

 

I’d like to a welcome message to those who recently the discussion list, and ask again for comments/thoughts/feedback/edits on the draft TC charter (attached).

 

I’d also like to call the group’s attention to a quote from the NAS’s report on “Biometric Recognition: Challenges and Opportunities” report (http://www.nap.edu/catalog/12720.html).

 

“Biometric systems should be designed to anticipate the development and adoption of new advances and standards, modularizing components that are likely to become obsolete, such as biometric sensors and matcher systems, so that they can be easily replaced.”

 

I would argue that ‘BIAS’ abstracts over the ‘matcher system’ and web services for biometric devices would cover the ‘biometric sensors’ part of this assertion. Perhaps a reference to this document belongs in the charter?

 

--

Ross J. Micheals

National Institute of Standards and Technology

http://www.nist.gov/cgi-bin/wwwph/cso.nist.gov?Query=Ross+Micheals

 

 

 

 

---------------------------------------------------------------------

To unsubscribe, e-mail: bws-discuss-unsubscribe@lists.oasis-open.org

For additional commands, e-mail: bws-discuss-help@lists.oasis-open.org