1. Biometric Cryptosystems Presenters: Yeh Po-Yin Yang Yi-Lun

2. Cryptosystem User authentication Cryptographic keys Login password RSA Public keys

3. Cryptographic Keys Long and random Stored somewhere Computer Smart card Released base on user password

4. User password Short and simple Easily guessed “password” Same as account Birth date Tel # Use the same password everywhere

5. What if? A single password is compromised while user uses the same password across different applications? A complex password is written down some easily accessible locations? The device which stores the cryptographic keys had been cracked?

6. Traditional cryptosystems Base on secret keys Forgotten Lost Stolen Repudiation

7. Biometric authentication More reliable Can not be lost or forgotten Difficult to copy, share, and distribute Hard to forge Unlikely to repudiate Relatively equal security level

8. Biometric No biometric is optimal Depends on the requirement of the application

9. Comparison of biometrics Properties Universality Distinctiveness Permanence Collect ability Attributes Performance Acceptability Circumvention

11. Biometric signal variations Inconsistent presentation Irreproducible presentation Imperfect signal acquisition

14. Biometric Matcher Exact match is not very useful Aligning Matching score Fingerprint Identify minutiae neighbors

16. Performance Two type of errors False match ( false accept ) False non-match ( false reject ) Error rates False match rate ( FMR ) False non-match rate ( FNMR ) Tradeoff relation

17. Biometric keys Biometric-based authentication User authentication Biometric component Cryptographic system Key release on positive match

18. Biometric key database Cryptographic key User name Biometric template Access privileges Other personal information

19. What if? The theft of biometric data crack into the biometric key database?

20. Hacking Attack

21. Definition Hacker Cracker Attack Disturbance Block Incursion

22. Attacking Step Decide target Easy Worth Purpose Gain information Firewall System

23. Detect path Ping Traceroute Hopping site Bot Make incursion

24. Types of attack Interruption attack on availability Interception attack on confidentiality Modification attack on integrity Fabrication attack in authentication

25. Reference 資安演習防護講義 資安演習防護講義

26. Common form of attack Denial of Service (DoS) attacks Distributed Denial of Service (DDoS) attacks Trojan Horse Virus Websites Worm

27. Sniffing Spoofing Bug Buffer overflow

28. Protection Firewall Antivirus program Update Close non-necessary program Close non-necessary internet service Scan computer

29. Back to biometric keys Is it possible to issue a new biometric template if the biometric template in an application is compromised? Is it possible to use different template on different applications? Is it possible to generate a cryptographic key using biometric information?

30. Solving Q1 and Q2 Store H(x) instead of x H is the transform function x is the original biometric signal

31. Solving Q3 Hide the key within the user’s biometric template Biometric key generation or binding Bind a private key into the user biometric information Both key and biometric are inaccessible to attacker No biometric matching at all

32. Conclusion Combining difficulties Existing biometric authentication technologies is not perfect Difficult to align the representations in the encrypted domain Should not have systematic correlation between the identity and the key

33. Reference Umut Uludag, Sharath Pankanti, Salil Probhakar, and Anil K. Jain “Biometric Cryptosystems: Issues and Challenges”, Proceedings of IEEE, 2004 Uludag U, Anil Jain “ Securing Fingerprint Template: Fuzzy Vault with Helper Data”, Computer Vision and Pattern Recognition Workshop, 2006 Conference on http://www.crucialp.com/resources/tutorials/website-web- page-site-optimization/hacking-attacks-how-and-why.php 資安演習防護講義 http://www.hacker.org.tw/?c=articles_show&articleid=882 http://www.gamez.com.tw/viewthread.php?tid=58607 http://www.symantec.com/region/tw/enterprise/article/todays_ hack.html