UBC – Computer Security October 4, 2007 Gordon Ross – President VIRTUAL PERCEPTIONSYSTEMS INC.

Biometrics: A unique physical or behavioral characteristic which can practically be collected, stored, and compared against; for the purpose of positive identification.

 Behavioral and physiological  Static and dynamic  One to one compare  One to many searching  False Acceptance Rate (FAR)  False Rejection Rate (FRR)  Failure to Enroll (FTE)

 Fingerprint  Facial recognition  Iris  Voice recognition  Hand Geometry

 Keystroke dynamics  Retinal Scan  Palm Print  Signature

 Capture a Biometric-Enrollment  Process the Biometric-Algorithm  Store Result-Template  Compare-one to one  verification  Find-one to many  identification  Accept or Reject

 Controlling access  Monitoring  Authentication  Identification  ATM applications

 Open the door please.  Is this the person on record?  Who are you?  Can this smart card log me in?  Am I the rightful owner of this password?

 Open doors-physical access  City of Baltimore-Department of Public Works uses Voice Authentication for Access Control

 Is this the person on record?  Identification  State of Connecticut-Department of Social Services uses Finger Print Imaging to reduce welfare fraud-$23M savings

 Who are you?  Nation Bank - TX  ATM application

 Do we know you?  Facial recognition at Super Bowl in Florida.  Match against known image.

 Am I the rightful owner of this password?  Login by:  Typing user name and password AND  Your unique Biometric.

 Social Engineering  Collusion  Theft or Fraud

**Making A Mold Soften Plastic Material with Hot Water Press Live Finger into Plastic. Final Mold. **From Tsutomu Matsumoto’s research..

Make the Liquid and Gelatin mix where the gelatin is at 50% wt. Add Boiling Water 30cc to 30g of gelatin and mix. Process takes approximately 20 minutes. Artificial Finger Print **From a Real Finger. **From Tsutomu Matsumoto’s research..

**From a Real Finger. Pour Liquid Into Mold. Refrigerate To Cool. Final Gummy Print. This Process takes approximately 10 Minutes. **From Tsutomu Matsumoto’s research..

Manufacturer/Selling AgencyTypeSensor Type Live Detection 1Compaq Computer Corp.DFR -200OpticalUnknown 2Mitsubishi Electric Corp.FPR-DTmk11OpticalUnknown 3NEC Corp.N , PK- FP002 OpticalUnknown 4OMRON Corp.FPS-1000OpticalUnknown 5Sony Corp.FIU-002-F11,FIU- 710 CapacitiveYes 6SecuGen Corp.SMB-800OpticalUnknown 7FUJITSU LimitedFS-200UCapacitiveUnknown 8Siemens AGEVALUATION- KIT CapacitiveUnknown 9Enthetica Inc.MS 3000OpticalUnknown **From Tsutomu Matsumoto’s research..

 Tsutomu Matsumoto  c’t Magazine from Germany  Just “Google” - “Defeating Biometrics” for more information.

*FaceVACS-Logon can be outfoxed with a short video clip of a registered person. Once Live-Check has been activated all attempts at deception with stills are foiled. A short.AVI video clip with the webcam in which a registered user was seen to move his head slightly to left and right. The program did in fact detect in the video sequence played to it a moving 'genuine' head with a known facial metric, whereupon it granted access to the system. *c’t magazine – Germany

 Quantify likelihood of previous cases  Costs  Technology Acquisition (HW & SW)  User training-hard enrollment  FTR  Deployment-configuration check  Process change  Help desk calls  Hardware product lifecycle

 Biometrics field is old, industry is new  Entire industry was $65M in 1999  Global Industry Analysts Inc. states biometric sales are to exceed $6.48 billion by 2010… (July 2007)  Not a technology issue but a people issue  Due diligence is key.  Privacy is also a concern.  Biometrics helps with authentication  Nothing is absolute!

   

QUESTIONS? Gordon Ross – BScEE – CET – HSG VIRTUAL PERCEPTION SYSTEMS INC.