Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 19785 — Common Biometric Exchange Formats Framework (CBEFF) Series
Information technology — Common Biometric Exchange Formats Framework (2015/2010 edition series)
🧬 BS ISO/IEC 19785 is the British Standard series adopted by BSI from the ISO/IEC 19785 international standard, defining the Common Biometric Exchange Formats Framework (CBEFF). Developed by ISO/IEC JTC 1 Subcommittee SC 37 (Biometrics), with UK participation through Technical Committee IST/44, CBEFF defines a unified data structure framework for the exchange of biometric data such as fingerprints, faces, irises, and vascular patterns, enabling biometric data from different vendors and applications to be shared in a standard format. It is a key standard for advancing biometric interoperability.
💡 The significance of CBEFF is “a format above formats”: it does not prescribe the specific record content of a given biometric modality, but rather defines the unified envelope structure that carries these records, so that a receiver can correctly parse the data source, format, and security information.
1. Series Overview and Positioning 📌
This batch covers three parts of the BS ISO/IEC 19785 series: Part 1: Data element specification (2015 edition), Part 3: Patron format specifications (2015 edition), and Part 4: Security block format specifications (2010 edition). Parts 1 and 3 are second editions of 2015 (superseding the 2006/2007 editions), while Part 4 is the first edition of 2010. Together they form the complete CBEFF framework.
CBEFF adopts an “envelope (CBEFF structure) + biometric identifier + data record” packaging approach: the CBEFF header carries the biometric information record (BIR) header, data elements, and security block, while the interior carries the concrete biometric data records conforming to standards such as ISO/IEC 19794. This packaging makes data self-describing, so exchanging parties can correctly parse it without prior agreement.
⚠️ The CBEFF series is revised frequently: Parts 1 and 3 were replaced by the 2015 editions, while Part 4 remains the 2010 edition. Verify the year and amendment status of each part when referencing to keep documents consistent.
2. Series Structure and Part-Level Points 🔧
| Standard Number | Subject | Edition | Core Content |
|---|---|---|---|
| BS ISO/IEC 19785-1:2015 | Data element specification | 2nd ed., 2015-08-01 | Defines CBEFF data structures, biometric identifiers, and data element assignment |
| BS ISO/IEC 19785-3:2015 | Patron format specifications | 2nd ed., 2015-09-01 | Defines ASN.1 type definitions and domain-specific Patron formats |
| BS ISO/IEC 19785-4:2010 | Security block format specifications | 1st ed., 2010-08-15 | Defines the CBEFF security block format |
3. Part 1: Data Element Specification Core Content 🔍
Part 1 defines the core CBEFF data structures and the Biometric Identifier. Content includes the overall layout of the CBEFF data structure, the data elements of the header (such as format identifier, assignment of the biometric identifier, and CBEFF version number), conformance requirements, and relevant terminology. The specification also gives the conceptual framework of the BIR, explaining how data elements are assigned, registered, and used, providing the basis for Patron formats in various domains.
ISO/IEC 19785-1:2015 expanded and refined the structure and content relative to older editions, strengthening the linkage with concrete data format standards such as ISO/IEC 19794 (biometric data interchange formats) so that the mapping between the CBEFF header and concrete data records is clearer.
4. Part 3: Patron Format Specifications 📦
Part 3 defines the CBEFF Patron formats. A “Patron” is an organization or industry body that adopts the CBEFF framework to define its own biometric data format. The specification provides ASN.1 type definitions to describe CBEFF data elements and abstract values, and defines concrete Patron format instances for different application domains such as government, enterprise, and border control. Patron formats allow each industry to customize its own biometric exchange format within the unified CBEFF framework.
💡 In large identity management projects, different subsystems often require different data fields. Patron formats preserve CBEFF uniformity while allowing industries to extend fields as needed, balancing interoperability with flexibility.
5. Part 4: Security Block Format Specifications 🔐
Part 4 defines the CBEFF Security Block format. The security block applies integrity protection, authenticity authentication, and confidentiality protection to biometric data, and may carry digital signatures, message authentication codes (MACs), encryption information, and authentication tokens. The specification defines the structure, data elements, and format requirements of the security block, so biometric data has verifiable security attributes during exchange, a key element in safeguarding the information security of biometric systems.
The security block works in concert with security standards such as ISO/IEC 24745 (biometric information protection) to provide standardized support for biometric template protection. In deployment, encryption, signing, and auditing mechanisms can be embedded in the CBEFF security block to achieve end-to-end security.
6. Application Practice and Selection 🛠️
- 📋 Cross-system data exchange: in identity authentication, border control, and e-government scenarios requiring biometric data exchange between systems, use CBEFF to package a unified data format.
- 🔗 Use with 19794: use 19785 for the envelope structure and 19794 for the concrete biometric records (fingerprint, face, etc.); together they provide a complete data exchange solution.
- 🛡️ Security design: use the Part 4 security block to carry signatures and encryption information, enforcing integrity, authenticity, and confidentiality at the data source, during transmission, and at rest.
- 🌐 Standard evolution tracking: monitor new editions of the CBEFF series and the rules of the Registration Authority to ensure use of the latest valid version.
🚨 Biometric data exchange must balance “format compliance” with “security compliance”: using only the CBEFF structure without a security block still leaves data vulnerable to tampering and leakage during transmission and storage; combine compliance assessment with full-chain protection.
7. Frequently Asked Questions ❓
❓ Q: What is the difference between CBEFF and ISO/IEC 19794?
A: 19794 defines the concrete data record formats for various biometric modalities (fingerprint, face, etc.); 19785 (CBEFF) defines the generic envelope structure and data elements carrying these records. The relationship is “container vs. content.”
A: 19794 defines the concrete data record formats for various biometric modalities (fingerprint, face, etc.); 19785 (CBEFF) defines the generic envelope structure and data elements carrying these records. The relationship is “container vs. content.”
❓ Q: What is a Patron format?
A: A Patron format is a biometric data format defined by a specific industry or organization using the CBEFF framework, extending industry-needed fields within the unified framework.
A: A Patron format is a biometric data format defined by a specific industry or organization using the CBEFF framework, extending industry-needed fields within the unified framework.
❓ Q: What does the security block do?
A: The security block applies digital signatures, MACs, encryption, and other protections to biometric data, achieving integrity, authenticity, and confidentiality and preventing tampering and unauthorized access.
A: The security block applies digital signatures, MACs, encryption, and other protections to biometric data, achieving integrity, authenticity, and confidentiality and preventing tampering and unauthorized access.
❓ Q: Must the series be used with BioAPI?
A: Not necessarily. CBEFF focuses on data exchange format, while BioAPI (ISO/IEC 19784) focuses on the application interface; they can be used independently or together in a complete biometric system.
A: Not necessarily. CBEFF focuses on data exchange format, while BioAPI (ISO/IEC 19784) focuses on the application interface; they can be used independently or together in a complete biometric system.
🔍 Q: How do I implement CBEFF?
A: First study Part 1 to understand the data structure, then select or define a Patron format (Part 3) per application domain, configure the security block (Part 4) per security needs, and finally combine with 19794 data records for end-to-end implementation.
A: First study Part 1 to understand the data structure, then select or define a Patron format (Part 3) per application domain, configure the security block (Part 4) per security needs, and finally combine with 19794 data records for end-to-end implementation.