Zachary Olson and Yukari Hagio CIS 4360 Computer Security November 19, 2008

A definition Biometrics is a branch of computer security centering on authenticating a person’s identity based on some physiological or behavioral characteristic unique to that person Authentication system: verifies the identity of a user before allowing them access to the internal system

Stages of Operation Enrollment Biometric data is collected for a known identity Reference template is created and stored Authentication Identification: comparison of biometric data to all available data files in a database Verification: comparison of biometric data to previously stored version

A Better Approach to Security… Biometrics is seen as more secure than traditional methods: Biometrics vs. Passwords Biometrics vs. Tokens

Types of Biometric Authentication Fingerprints Retina / Iris Scans Facial Recognition Hand Recognition DNA Matching Keystroke Recognition

Fingerprints Ridges vs. Valleys Scanning Mechanisms Optical Scanner Capacitance Scanner

Fingerprints (contd.) Analyzing a Fingerprint - Minutiae

Retina Scans Small surface Detailed Scan Slow scan and compare procedure

Iris Scans More than 250 unique spots Compares trabecular meshwork of the iris Fast scans Requires a human eye

Facial Recognition Uses a video image to look at distances between features and overall structure Requires a human face Difficulties in finding the features in images

Hand Recognition Hand geometry not as unique as fingerprints Uses hand features and measurements increases uniqueness Measures up to 90 different points on the hand including characteristics of the finger and features on the skin Seen as less invasive than fingerprints

DNA Matching Comparison of a sample of a user’s DNA with a stored sample of the real person’s DNA DNA is readily available to collect Comparison process is slow and not completely automated

Keystroke Recognition Uses rhythm and manner in which characters are typed into a keyboard Typing characteristics are unique to individuals Indicators Speed in words per minute Delays Specific sequences of characters Typing errors Seek time and hold time

Issues / Concerns Data Storage Accuracy Physical Danger Privacy

Data Storage Permanence of Biometric data Re-issue is not possible Biometric data theft is permanent Possible solution: decentralization of data storage Store part of each record in the central database and the rest on a smart card with the individual user Complete records become inaccessible to hackers

Accuracy No perfect matches in biometrics Acceptance range of comparison algorithms Types of errors False positives: accepting wrong identity False negatives: rejecting correct identity Algorithm cut-off level is a compromise between the two error types

Physical Danger Thieves might target property owners to bypass biometric security measures Example: in 2005, car thieves in Malaysia cut off a man’s finger to bypass the fingerprint reader on his Mercedes Benz S Class

Privacy Questions Should organizations or individuals control biometric information? Can biometric information be used without individual consent? Can law enforcement agencies demand biometric data from individuals for forensic purposes? Answers ISO Department of Health, Education, and Welfare

Examples of Biometrics Usage Governments worldwide use biometrics for passports and airport security. Police agencies use fingerprints and DNA for identification and forensics. Financial institutions use palm/finger vein authentication to secure ATMs. Companies use biometrics to keep time records, secure locations and improve user convenience.

The Future of Biometrics September 11, 2001 resulted in unprecedented growth for the large-scale deployment of biometrics. Biometrics is being incorporated into national passports worldwide. Because of its advantages over traditional authentication methods, biometrics will continue to helm the endeavor for increased computer security.

References system.JPG

References (contd.) Langenderfer, J. & Linnhoff, S. (2005). The Emergence of Biometrics and Its Effect on Consumers. The Journal of Consumer Affairs, 39, Retrieved 9 November 2008 from H.W. Wilson database. Barton, B., Byciuk, S., & Harris, C. (2005). The Emerging Cyber-Risks of Biometrics. Risk Management, 52, 26-8, Retrieved 6 November 2008 from H.W. Wilson database. Gates, K. (2006). Biometrics and Access Control in the Digital Age. NACLA Report on the Americas, 39, Retrieved 12 November 2008 from H.W. Wilson database.