Biometrics

Year 13 Computer Science Lesson - Thanks for information shared by Philip Craiger Professor and Principal Investigator at Advanced Cyberforensics Education Consortium & Professor, Daytona State College

Transcript

1. BIOMETRICS IDENTIFICATION AND AUTHENTICATION
2. WHAT ARE BIOMETRICS? • Any human characteristic which may be used for biometric authentication and identification • The automatic identification or identity verification of living, human individuals based on behavioural or physiological characteristics
3. BIOMETRICS INCLUDES • Physiological Characteristics • Fingerprint • Palm print • Face • Iris • Behavioral Characteristics • Signature • Gestures • Typing
4. INTRODUCTION • Authentication & Identification • Fundamental components of HCI • Identification • Determine if someone is known to the system • Authentication • Verifying the identity of that person
5. TRADITIONAL TECHNIQUES • Identification • Username • Bank card • Authentication • Password • PIN code
6. AUTHENTICATION - THREE BASIC METHODS • Something you have – smart card/secure ID key • Something you know – simplest (username/password) • Something that you are - physiological
7. STRONG AUTHENTICATION • Strong authentication • Two-factor authentication • Requires two separate forms of ID • Something you have and something you know e.g.. bank card and PIN # • Username and password is NOT strong authentication • Just two things you know
8. THE THIRD FACTOR • Something you are • This is what biometrics is a measurement of • In recent years biometrics has become an increasingly feasible solution • Avoids remembering masses of passwords • Reduced cost • Reduced size • Increased accuracy • Increased ease-of-use
9. PROBLEMS WITH THINGS YOU KNOW • Making sure that no one else knows it • Easy to remember passwords are easy to guess • Hard to guess passwords are hard to remember • Unless you write them down • They can be read by others
10. PROBLEMS WITH THINGS YOU HAVE • Making sure they stay something you have • Can be stolen • Can be lost • Can be broken
11. THINGS YOU ARE • Can’t be lost • Well, not easily at least • Can’t be guessed or read by someone else • Though perhaps it can be duplicated (fingerprint impression, picture of a face, recording of a voice) • Difficult to uniquely identify
12. WHY WE WIN WITH BIOMETRICS • Biometrics have their problems, just like other forms of authentication • The key is where the problems can be addressed • It is out of the hands of the user and in the hands of the system developer • We have much more control at this level!
13. AUTHENTICATION & IDENTIFICATION • Biometrics can be used for both authentication and identification • Both uses present unique challenges • Iris scan for instance is expensive and a scan takes between 5-10 seconds • Different advantages arise form each use as well
14. AUTHENTICATION • Increased security • Increased convenience • Increased accountability
15. IDENTIFICATION • Fraud detection • Fraud deterrence
16. HOW IT WORKS • Process flow of biometric verification and identification • Enrollment • User provides biometric data to the system • Biometric system translate this to a template • This template is then stored http://youtu.be/JAKB6o17pfo
17. TEMPLATE • Fundamental to biometrics • Small file derived from the distinctive features of a user’s biometric data • Used to perform biometric matches • Templates are often vendor specific, depends on the algorithm employed by the vendor
18. TEMPLATE • Facts • Most occupy less than 1KB • Template sizes differ from vendor to vendor • Fingerprint, iris, face etc., cant be reconstructed from a template • A unique template is generated every time a user presents biometric data! • An index of similarity must be calculated which must meet a threshold
19. SCORING • Match decisions between templates based on a score • Correlation resulting from the match between two templates • Biometric apps use proprietary algorithms to generate scores (some better than others) • Biometric systems do not render an absolute match, only the probability of a match
20. HOW IT WORKS - AUTHENTICATION • User provides biometric data to the system • Biometric system translates this to a template • The system begins comparing the template to stored templates • Templates will usually not match exactly • The score or ‘closeness’ of a match is given • If the score is above some threshold, the user is authenticated
21. HOW IT WORKS - ENROLMENT • Process of taking biometric data and converting it to a simplified form • Subsequent authentication is done against a template • User may be required to enroll several times to get a clean template • Presentation: process by which a user provides biometric data to an acquisition device
22. IDENTIFICATION/AUTHENTICATION • 1:1 Systems • Acquire ‘identification’ • Acquire biometric data, simplify to template • Match template against the template of the users ID in the system • 1:n Systems • Acquire biometric data, simplify to a template • Match template against all other templates, searching for the highest scoring template
23. SECURITY ISSUES • Privacy • Keeping templates safe from unauthorised users • Security • Keeping templates secure so that one cannot be exchanged for another
24. FINGERPRINT • Strengths • Proven technology capable of a high level of accuracy • Range of deployment environments • Ergonomic, easy-to-use device • Weaknesses • Inability to enroll some users • Performance deterioration over time • Need to deploy specialised devices
25. BIOMETRIC HACKS • Two German hackers say they have developed a technique to defeat biometric fingerprint scanners used to authenticate electronic purchasing systems • Unlike an earlier fingerprint attack developed by the pair last year, this system creates latex fingertip patches designed to be used while under observation
26. BIOMETRIC HACKS • The past technique used graphite powder and adhesive tape to lift fingerprints off surfaces and fool scanners into accepting them as genuine • This new method involves taking a digital picture of the fingerprint image produced by the graphite powder and adhesive tape. This image is enhanced with special graphic filters– worked 80% of the time
27. BIOMETRIC HACKS • A Japanese cryptographer demonstrated how to fool a fingerprint recognition device using gelatine (as found in Haribo etc.) and a plastic mould to create a fake finger which he used to fool detectors 4 out of 5 times.
28. BIOMETRIC HACKS • Took a latent fingerprint from a glass, which he enhanced with cyanoacrylate adhesive (superglue fumes) and photographed with a digital camera. • Used Photoshop to enhance contrast of image • Etched fingerprint into copper using a photo-sensitive printed-circuit board • Made a gelatin finger using the print on the PCB • Worked approximately 80% of the time
29. OTHER HACKS? • Cut-off finger! • Supposedly works • Now check to make sure the temperature of the subject presenting is within range • Obtain fingerprint DIY
30. PALM PRINT • Strengths • Established reliable core technology • Relatively stable physiological characteristic as basis • Combination of convenience and deterrence • Weaknesses • Inherently limited accuracy • From factor that limits scope of potential – larger acquisition device • Price
31. FACE – HOW IT WORKS • Facial landmarks as nodal points • There about 80 nodal points on a human face • Here are a few of the nodal points that are measured by software • Distance between the eyes • Width of nose • Cheekbones • Jaw line • Chin • Template created
33. FACE • Strengths • Ability to leverage existing image processing equipment • Ability to operate without physical contact or user complicity • Ability to enroll static images • Weaknesses • Acquisition environment effect on matching accuracy – lighting etc. • Changes in physiological characteristics that reduce matching accuracy e.g.. facial hair • Potential for privacy abuse due to non-cooperative enrollment and identification
34. FACIAL RECOGNITION - USES • Facial recognition technology has previously been used to scan crowds and identify criminals with outstanding warrants without any user complicity whatsoever.
35. LATEST TECHNOLOGIES • Use of an individual’s unique heart pattern to quickly and securely verify identity, one of the most secure and robust internal biometrics currently available. • With ECG being an internal biometric to the body, dynamic, utilising a live signal for both liveness detection and accuracy and not requiring expensive equipment, ECG biometric authentication offers incredible flexibility and the opportunity for a highly-secure and cost-effective solution, to tackle the growing threat of cyber- crime in today’s world. • http://www.b-secur.com/
36. LATEST TECHNOLOGIES • ECG data can be acquired through a range of devices including mobile phones • Next generation vehicle access and engine ignition solutions