1. By: Brad Brosig

2.  Introduction  Types of Biometric Security  The Installation Process  Biometric Authentication Errors  The Necessity of Mobile Device Security  Current Mobile Security Options  Implementation on Mobile Devices  Potential Biometric Options  Problems with Biometric Mobile Security  Conclusion

3.  What is Access Control? › The “policy-driven control of access to systems, data and dialogues.” › Ex: Physical Barriers, Passwords, and Biometrics

4.  Three Requirements: › Something You Possess  Photo Access Card › Something You Know  Pin Number › Something About You ****  Biometric Trait

5.  What is Biometric Security? › The “method of identifying unique human characteristics as a mean of authenticating an individual’s identity.” › Key here is Unique characteristics › Unique characteristics are compared against database

6.  DNA Matching  Iris Recognition  Facial Recognition  Finger Geometry  Hand Geometry  Signature Recognition  Vein Recognition  Ear Shape  Retina Recognition  Fingerprint Recognition  Gait Recognition  Olfactory Recognition  Typing Recognition  Voice Recognition

7.  Each user must be scanned into database › Referred to as enrollment scan › Scanned data is searched for unique features › Unique features are processed with algorithm › Combination of these two compose user’s template  Subsequent scans are performed for entry › Referred to as supplicant scans

8.  False Acceptance › Scanned user is incorrectly matched to another user’s template  False Rejection › Scanned user is not matched to their template  Failure to Enroll › User lacks a well-defined, unique trait

9.  False Acceptance and False Rejection rates are inversely proportional  Ex: The head of security wishes to see an entry point’s false rejection rate subside due to user complaints of inconvenience. › The scanning algorithm will now allow less exact matches, thus raising false acceptance rates.

10.  About 15 years ago mobile devices were limited › Could make calls and text  Current Devices also access and utilize: › The Internet › Bank Accounts › Credit Card Transactions › Track GPS Locations › Etc.

11.  PIN Numbers  Passwords  Swipe Patterns  Facial Recognition  Fingerprint Recognition

12.  Generally slow  Must be remembered  Must be changed frequently  Are not as secure as biometric options

13.  Options: › Facial Recognition › Voice Recognition › Fingerprint Recognition  Positives: › Faster › Does not require complex passwords/patterns

14.  Requires five modules: › Biometric Sensor Module  Scans for identifying information › Feature Extractor Module  Extracts and creates user templates › Matching Module  Compares extracted template to stored templates  Verification Method – compares to specific template  Identification Method – compares to database for match  Verification is quicker

15. › Decision Making Module  Determines percentage of match between templates › System Database Module  Stores user templates made during enrollment

16.  2D Recognition › Uses a feature based approach › Algorithm determines relationship between features › Effected by background and pose  3D Recognition › Uses algorithm to determine facial surface geometry › Effected by facial expression  2D + 3D Based Recognition › Strengths of 2D and 3D, but only lab tested

17.  Automatic Speaker Recognition › Uses algorithm to process voice patterns › Broken into High-Level and Low-Level  High-Level – Dialect and Speaker Style  Low-Level – Voice Spectrum › Low-Level features are most reliable › High-Level features change with emotion

18.  Finger is scanned on smooth surface  Scanner looks for meeting points of ridges and valleys (minutiae)  Minutiae are used for comparison  Effected by inter/intra-class similarity › Inter – minutiae of difference individuals appear similar › Intra – minutiae of different fingers on same person appear similar

19.  Biometric scans harvest huge amounts of data › Strain mobile device RAM › Limits the ability for multi-biometric authorization which would allow for added security  Biometric scans require large amounts of processing power › Places further strain on device RAM › Limits complexity of algorithms  Increases probability of False Acceptance

20.  Security of biometric system and database is questionable › Must utilize encryption on various modules  Potential solution is being developed by UINT & Mereal Biometrics › Houses all modules, including scanner within a smart card

21.  Can biometrics fill the void between strong security and the inconvenience of current security offerings?  Biometrics provide better convenience  However require too much RAM to be highly effective  Simplification of algorithms creates large security risk

22.  Ben-David, S., Koved, L., Martino, J., Sign, K., Swart, C., & Trewin, S. (2012). Biometric authentication on a mobile device: A study of user effort, error and task disruption. IBM Research, http://researcher.ibm.com/researcher/files/us-kapil/ACSAC12.pdf.  Biometric Institute Limited. (2013). Types of biometrics. http://www.biometricsinstitute.org/pages/types-of-biometrics.html  Chcikowski, E. (2012, December 11). Mobile biometrics: The next phase of enterprise authentication?. http://www.networkcomputing.com/security/mobile-biometrics-the-next-phase-of- ente/240144178?pgno=1  Jangra, A., & Goel, S. (2013). Biometric based Security Solutions for MANET: A Review. International Journal of Computer Network & Information Security, 5(10), 44-50.  Kay, R. (2005, 04 05). Quick study: Biometric authentication. http://www.computerworld.com/s/article/100772/Biometric_Authentication  Panko, R. (2010). Corporate computer and network security. (2nd ed., pp. 149-183). Prentice Hall.  Shuo Wang and Jing Liu (2011). Biometrics on mobile phone, Recent Application in Biometrics, Dr. Jucheng Yang (Ed.). http://cdn.intechopen.com/pdfs/17035/InTech- Biometrics_on_mobile_phone.pdf  Uint & mereal biometrics launches biometric smart card with embedded fpc fingerprint touch sensor and processor. (2013, October 08). Security Dark Reading. http://www.darkreading.com/intrusion-prevention/uint-mereal-biometrics-launches- biometr/240162407  Xi, K. (2012). Biometric security system design: From mobile to cloud computer environment. (Doctoral dissertation) https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=8&ved= 0CHIQFjAH&url=http://unsworks.unsw.edu.au/fapi/datastream/unsworks:10849/SOURCE01&ei =RQl2UvzINPHIsASdqoLwAw&usg=AFQjCNEeit_iAJ0Z5st0u7qTJWD5MrWsKQ&bvm= bv.55819444,d.cWc&cad=rja.