Biometric Security Derek Foster

Overview What is Biometric Security? How it Works –Comparisons Types –Fingerprints –Iris Vs. Retina scans –Palm Vein –Facial patterns ProsConsUses Security Issues Conclusion

Biometrics Definition: The study of automated methods for uniquely recognizing humans based on one or more intrinsic physical or behavioral traits Biometric Authentication: Technologies that measure and analyze human physical and behavioral characteristics for authentication

Uses Identification –Determining who a person is, i.e. trying to find a match for a person's biometric data in a database –Requires time and a large amount of processing power, especially for large databases Verification –Determining if a person is who they say they are by comparing their biometric data to previously recorded data. –Requires less processing power and time, and is used for access control

Physical Vs. Behavioral Physical characteristics –Fingerprints –Retinas and irises –Facial patterns and hand measurements Behavioral characteristics –Signature –Gait –Typing patterns Most biometric traits are a mix of physical and behavioral characteristics

Comparison Hamming distance –Measurement of how similar two bit strings are –Two identical bit strings have a Hamming Distance of zero; two entirely dissimilar ones have a Hamming Distance of one –Measures the percentage of dissimilar bits out of the number of comparisons made Current technologies have widely varying Equal Error Rates, varying from as low as 60% and as high as 99.9%.

Basics: How Biometrics Works Person registers by providing the system with physical and behavioral characteristics Information is processed by a numerical algorithm and entered into a database Algorithm creates a digital representation of the obtained biometric Each subsequent attempt to use the system requires the biometric to be captured again and processed into a digital template Template then compared to those existing in the database to determine a match

Fingerprints Made of ridges (upper skin layer segments) and valleys (lower segments) Ridges form minutiae points which are processed and stored –Ends and splits, size, empty space, joining or crossing ridges, and more… Uniqueness determined by the pattern of ridges, furrows, and minutiae points Five basic fingerprint patterns: –Arch –tented arch –Left/right loop –whorl

How Does Fingerprinting Work? Image Capturing Technologies –Optical Durable and temperature-resistant must be large enough to achieve quality images (not well suited to embedded desktop solutions and embedded wireless handheld solutions) –Silicon Uses electrical or thermal properties of the skin surface to detect fingerprint ridge and valley pattern Produces quality images with less surface area Better suited for use in compact devices –Ultrasound Uses acoustic waves to measure density of a finger Very precise, and very expensive

Issues with Fingerprint Systems Ridge patterns affected by cuts, dirt, wear and tear Acquiring high-quality images of ridges and minutiae is complicated (smudges) People with no or few minutia points can’t enroll Some scanners can't distinguish between a picture of a finger and the finger itself –Can sometimes be fooled by a mold or even a photocopy of a fingerprint A criminal could cut off somebody's finger to get past a scanner security system –Some scanners have pulse and heat sensors to verify that the finger is alive and not a fake

Benefits of Fingerprint Biometrics Fingerprints are unique, with no two fingers having the exact same dermal ridge characteristics Easy to use Cheap Small size Low power Non-intrusive

Applications of Fingerprint Biometrics Best for low-price, small sized devices such as cell phones, USB flash drives, notebook computers Fingerprint biometric systems are used for law enforcement, background searches to screen job applicants, healthcare and welfare, and credit card authentication

Applications of Fingerprint Biometrics

Iris Scanning Iris: the elastic, pigmented, connective tissue that controls the pupil The iris has a unique pattern from eye to eye and person to person Once fully formed, the texture is stable throughout life

How it Works A simple CCD digital camera uses both visible and near-infrared light to take a clear, high- contrast picture of the iris Place your eye 3 to 10 inches from the camera. When the camera takes a picture, the computer locates –The center of the pupil –The edge of the pupil –The edge of the iris –The eyelids and eyelashes

How it Works (continued) An iris scan analyzes over 200 points of the iris –Rings –Furrows –Freckles –Corona With near-infrared light, a person's pupil is very black, making it easy for the computer to isolate the pupil and iris Then analyzes the patterns in the iris and translates them into code, which it compares against the code stored in the database

Benefits of Iris Scanning Highly accurate: No known case of a false acceptance for iris recognition –The chance of mistaking one iris code for another is 1 in 10 to the 78th power Not intrusive and hygienic - no physical contact required Glasses, contact lenses, and even eye surgery do not change the characteristics of the iris, nor do they change over time Has the capacity to discriminate between individuals with identical DNA, such as monozygotic twins

Weaknesses of Iris Biometric Systems The user must hold still while the scan is taking place An image/photo of the iris can sometimes be used to bypass security. However, some iris scanning systems will vary the light and check that the pupil dilates or contracts

Applications of iris biometrics Identity cards and passports, border control and other Government programs, prison security, database access and computer login, hospital security, schools, aviation security, controlling access to restricted areas, buildings and homes.

Iris Vs. Retina Scanning Retinal scans are an older technology that required a bright light to illuminate a person's retina; thus retinal scans are uncomfortable and invasive People's retinas change as they age, which could lead to inaccurate readings. Iris scanning is more precise and much faster

Palm Vein Biometrics The pattern of blood veins is unique to every individual, even among identical twins Palms have a broad and complicated vascular pattern and thus contain a wealth of differentiating features for personal identification. Will not vary during the person's lifetime Very secure; blood vein pattern lies under the skin, making it almost impossible for others to read or copy

How Does Palm Vein Biometrics Work? Vein pattern image is captured by radiating his/her hand with near-infrared rays The reflection illuminates the palm and captures the light given off by the region after diffusion Deoxidized hemoglobin in the vein vessels absorbs the infrared ray, reducing the reflection rate and causing the veins to appear as a black pattern This vein pattern is then verified against a pre-registered pattern for authentication This system is not dangerous; a near infrared is a component of sunlight and there’s no more exposure than when walking outside

Benefits of Palm Vein Biometric Systems As palm veins are inside the hand, they are protected and this system is not susceptible to minor trauma, cuts, etc (conversely to some fingerprint systems) Difficult to forge Contactless, hygienic and non-invasive Highly accurate

Applications of Palm Vein Biometrics Security systems: physical admission into secured areas Log-in control: network or PC access Banking and financial services: access to ATM, kiosks, vault The Fujitsu palm vein contactless biometrics system is already used by Bank of Tokyo-Mitsubishi (BTM) in Japan

Facial Patterns Nodal points - There are about 80 nodal points on a human face –Distance between eyes –Width of nose –Depth of eye sockets –Cheekbones –Jaw line –Chin To prevent an image/photo from being used, systems will require the user to smile, blink, or nod their head Facial thermography can be used to record the heat of the face (which won't be affected by a mask)

How it Works Detection –Searches the field of view of a video camera for faces –A multi-scale algorithm searches for faces in low resolution, switching to a high-resolution search after a head-like shape is detected Alignment –Once a face is detected, the system determines the position, size and pose (35 degrees) Normalization –Image is scaled and rotated so it can be registered and mapped into an appropriate size and pose (not impacted by light) Representation –The system translates facial data into a unique code Matching –The newly acquired facial data is compared to the stored data

Facial Patterns Benefits of face biometric systems –Not intrusive, can be done from a distance, even without the user being aware of it Weaknesses of face biometric systems –More suited for authentication than identification, as it is easy to change the proportion of one's face by wearing a mask, a nose extension, etc. –User perceptions/civil liberty: Most people are uncomfortable with having their picture taken

Applications of Face Scanning Biometrics Access to restricted areas and buildings, banks, embassies, military sites, airports, law enforcement.

Identity theft and privacy issues "Two-factor“ security –Something you know + something you have (e.g. debit card + PIN/biometric) –Ensure that static enrollment sample hasn’t been tampered with by using hash codes and encryption –Anti-hacking routines prevent "replay" attacks; since a biometric should be minutely different every time it’s scanned, a stolen biometric is easily detected because it is too perfect of a match If your biometric signatures are compromised, there is little you can do

Uniqueness – how well the biometric separates one individual from another Permanence – measures how well a biometric resists aging Collectability – how easy it is to acquire a biometric for measurement Performance – accuracy, speed, and robustness of the system capturing the biometric Circumvention – how easy it is to fool the authentication system

Conclusion Despite some misgivings, biometric systems have the potential to identify individuals with a very high degree of certainty Physical attributes are much harder to fake than identity cards When the data has been compromised, user only has a limited number of biometric features Not quite secure enough yet for widespread use

Sources 3/ratha.html etrics.asp scanner3.htm