Biometric enrollment registers a person’s fingerprint, face, iris, voice, or similar characteristic on a device so it can support later authentication. The device captures distinctive features, converts them into a mathematical template, and stores that representation in a trusted execution environment rather than saving raw biometric data. section 15.1.5
A biometric login typically follows three steps:
- Enroll the user by registering biometric data on the device. section 15.1.5
- Request authentication when the user logs in or attempts a sensitive action. section 15.1.5
- Verify the new biometric input against the stored template; a match allows the system to generate a cryptographic authentication token. section 15.1.5
Approving a payment
A user enrolls a fingerprint on a phone. Later, the app requests biometric authentication before approving a payment. The device compares the scan with the enrolled representation and, if it matches, permits the sensitive action. section 15.1.5
Figure 15.1 Biometric authenticatation is a three-step process. First, a user registers their data. Then the user tries to authenticate and be verified by the system.
Follow the three-stage flow from registration through authentication and verification. section 15.1.5
Enrollment improves convenience but does not eliminate risk. Privacy concerns and false rejections remain possible, while improperly secured biometric transmission or storage can expose data to replay attacks. section 15.1.5 section 15.1.6
