1. Security Architect & BS7799 Lead Auditor
“Biometrics”
Harj Singh CLAS CISSP
Security Architect & BS7799 Lead Auditor
Nov-18
Security Seminar

2. What does Biometrics mean?
Comes from the Greek words “Bios – life” and “Metron – to measure”.
Automated methods of verifying or recognising the identity of a living person based on physiological or behavioural characteristics
Nov-18
Security Seminar

3. Identification or Verification?
There are two ways of determining if you are you…
Identification
Establishing a persons identity – Who are you ?
One to many comparison
Biometric sample presented to a system which compares it against a database of samples in the hope of finding a match
Verification
Involves confirming or denying a person’s claimed identity - Are you who you claim to be?
One to one comparison
Biometric sample captured and compared with the previously stored template for that user (Reference template)
Nov-18
Security Seminar

4. Which Biometric? Fingerprint Hand Geometry Iris / Retina Scan
Facial Scan
Signature
Voice Recognition
Nov-18
Security Seminar

5. Fingerprint
Variety of fingerprint devices available (silicon & optical)
Template constructed by analysing patterns and/or points of interest that make up the fingerprint (minutia)
Advantages
Low cost
Size of device and multiple choices
Ease of integration
Accurate – low instances of false acceptance
Nov-18
Security Seminar

6. Hand Geometry
Measures the physical characteristics of the user’s hand and fingers
Low level infrared light and a camera used to capture an image
Suited to applications where there is a large user base or users access the system infrequently
Flexible performance tuning can accommodate a wide range of applications
Disadvantages
Large footprint of hand geometry devices
Only used for verification
Right hand use only
Nov-18
Security Seminar

7. Iris Captures the pattern of flecks on the iris
Pattern processed and encoded into 512 byte record
Uses conventional cameras
Average 2 seconds for identification
Less intrusive than retinal scanning
No physical contact between user and reader (unless very tall or very short)
Disadvantages
Ease of use
System integration
Cost
Nov-18
Security Seminar

8. Retina Scan
Unique patterns of the retina scanned by a low intensity infrared light
Image constructed from de-scanned reflected light
Extremely accurate
Fast enrolment process
Disadvantages
User acceptance – intrusive technology
Cost
Limited to high security applications
Does not perform well where user wears spectacles or has cataracts
Nov-18
Security Seminar

9. Facial
Based upon the geometric shape and position of features of the face
Performs equally well on all races and both genders
Resistant to changes in lighting, skin tone, facial hair, hair style, eyeglasses, expression and pose
No user participation required in order to perform identification/verification
Limited success in practical applications
1 – many matching
Disadvantages
Perceived to be invasive as covert system
Nov-18
Security Seminar

10. 2D Facial Relies on controlled lighting
One photograph per facial position
High failure rate
Can be ‘fooled’
Nov-18
Security Seminar

11. 3D Facial
3D technology enables the real-time capture of three-dimensional images of a subject’s face. The unique features of the subject’s cranio-facial structure are extracted and stored as a biometric template for automated human recognition. The method can be used either in identification or in verification..
Nov-18
Security Seminar

12. 3D Facial Face Capture Reconstruction Process
Uses structured light in near-infrared range
A projector shoots an invisible structured light pattern onto the face
The special pattern is distorted by the face’s surface geometry
The video camera precisely records the pattern distortion
Reconstruction Process
Real-time reconstruction of the 3D facial surface
The distorted pattern is input into a 3D reconstruction algorithm
A 3D mesh of the face is created by means of triangulation
The resulting face geometry is measurable in millimetres
The 3D reconstructed image is NOT stored in the database
Nov-18
Security Seminar

13. 3D Facial Feature extraction and matching
A biometric template is extracted from the 3D facial geometry (skull curvature, etc)
The template is based on the unique rigid tissues of the skull which are unchanging over time
The resulting numeric template is stored in an ordinary database
Identification is performed by matching the biometric template against the enrolment database
Verification is performed by matching the biometric template against a template stored on a smart card
Nov-18
Security Seminar

14. 3D Facial Advantages
Not affected by lighting conditions, background colours, facial hair or make-up
Provides higher performance at different view angles
Is of higher accuracy in real-life environments
Nov-18
Security Seminar

15. Signature
Based on analysis of the dynamics of a handwritten signature e.g shape, speed, stroke order, pen pressure
Generally use pressure sensitive tablets or wired pens
User friendly
Non intrusive – minimal public acceptance issues
Captured signature can be used for digitally signing documents
Disadvantages
Considered to be one of the least accurate biometrics
Only performs 1 – 1 verification
Nov-18
Security Seminar

16. Voice Recognition
Analyses voice patterns and characteristics of speech e.g. pitch, tone
High user acceptance - perceived as least intrusive biometric technology
Easy for end users to implement BUT the least secure biometric
Ideal for telephone systems/ mobile environments
Disadvantages:-
Affected by environmental factors – background noise greatly affects system performance
Problems if enrolment undertaken using mobile device then request verification from fixed land line.
Nov-18
Security Seminar

17. Biometrics – What are the drivers?
On October 26, 2001 The Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (the “USA Patriot Act”) was enacted.
On May 14, 2002, the President signed into law H.R. 3525, the "Enhanced Border Security and Visa Entry Reform Act of 2002."
Post 9/11…
Nov-18
Security Seminar

18. H.R.3525
“The border security bill makes reforms to our immigration system in response to the increased awareness of America’s vulnerability to terrorism after 9/11. It provides for calls for vital improvements in technology to provide more timely information to help with the battle against terrorism. Among the key features:
—Funds for increased border and State Department personnel and training, including 1,000new INS inspections personnel, and $150 million for INS border technology;
—A report, a plan, and protections for an interoperable information-sharing system;
—An interoperable information-sharing system with name-matching capacity;
—Machine-readable, tamper-resistant biometric travel documents and passports;
—Restriction on nonimmigrant visas for aliens from countries that sponsor terrorism;
—Reform of the visa waiver program;
—Requirement of passenger manifest information for commercial flights and vessels;
—Repeal of the 45-minute time limit on INS inspections of arriving passengers; and
—Enhanced foreign student monitoring program”
Nov-18
Security Seminar

19. What Does this mean to the UK?
By Oct 26th 2004 the UK must have introduced biometric enabled travel documents (or have in place advanced plans to do so).
National Institute of Standards and Technology given lead to evaluate biometric technologies.
International Civil Aviation Organisation laid down standard (9303).
Nov-18
Security Seminar

20. ICAO 9303
ICAO 9303 requires a digitised facial image of the document holder to be securely attached to the travel document and recommends the use of a Contact-less RF Proximity Smart Card as the carrier. Governments MAY optionally also embed fingerprint and/or iris images.
Nov-18
Security Seminar

21. What is UK Government Doing ?
UKPS
DVLA
Home Office
(ICU)
Biometric Enabled Passport Book (and maybe Passport Card) in 2005.
Establishing ‘Gold Identity’
Examining use of biometric in UK Driving Licence.
Planning for a National Id Card (long term). ?
Nov-18
Security Seminar

22. The Joint Contact Group
Unprecedented co-operation and sharing of intelligence between the UK and the USA was agreed at a meeting on Tuesday (1st April 2003) between Home Secretary David Blunkett and US Homeland Security Secretary Tom Ridge.
At the meeting, Mr Blunkett and Mr Ridge agreed the work should cover “closer working on the development of biometric technology such as iris and facial recognition.”
Nov-18
Security Seminar

23. UK Law Enforcement
Human identification is a key element in the reduction and investigation of crime and thus a key element in the provision of effective capabilities to assist the Police Service in meeting strategic objectives.
Dr Fred Preston, Director of Identification, PITO
Nov-18
Security Seminar

24. "... we will legislate this winter to upgrade our secure passport system, to create a new, clean database on which we will understand and know who is in or country, who is entitled to work, to services, to the something for something society which we value. As people renew their passports, they will receive their new identity card. The cost of biometrics and the card will be added to the total of passports."
David Blunkett
Labour Party Conference October 2004
Nov-18
Security Seminar

25. The Future Chip and Finger ? Facial recognition in cars ? Nov-18
Security Seminar

26. Questions
Nov-18
Security Seminar