Can my biometric be stolen?

Can the biometric template or biometric feature vector be stolen, and if so what are the
consequences?
If biometric template data are stolen, either:
· Directly, from the stored reference templates, or
· By capturing the data in transit within the system, or
· On a communication path between the biometric capture device and the rest of
the system,
then the template data could be reused by an impostor to recreate the identity of an
authorised user without the user being present. This would undermine the
authentication integrity and grant the impostor illegal access to the assets protected by
the biometric authentication.
If the stolen template includes associated data, then the associated data could be
used separately and independently of the biometric data. Any user credentials or
alternative authentication data (e.g. password) might be used to compromise the
system or the user without exploiting the biometric data. The degree of compromise
would depend on the data and the protective measures in place to prevent exploitation
of captured data.
If successful, this would be an example of identity theft (see separate concern), and all
the ramifications for identity theft would follow.
An additional threat may result if a captured biometric template can be reverseengineered.
The biometric “image” thus produced might be used to construct an
artefact or to discover (chance) zero-effort false matches in the criminal fraternity. This
Biometric Security Concerns produced for the UK Biometric Working Group. Last updated September
2003
21
threat could be exploited more easily if the system stores biometric images which can
be recovered to generate a ready supply of targets for such attacks.
Solutions
The solutions depend on the nature of the biometric data stolen. Stored images or
templates can be protected by encryption. Data intercepted between the capture
device and the rest of the system could also be protected by cryptography, but here
unique session keys would be necessary (e.g. through time-stamping) to prevent the
data being replayed successfully.
If the stolen image data is used to construct an artefact, then liveness testing could be
used to ensure that the biometric is actually being submitted from a person.
Stolen templates and template data can be rendered innocuous through the use of
cryptographically based integrity checking or encryption. Alternatively, template
transformation techniques have been mooted to circumvent the compromise of a
template by the legitimate substitution of a transformed version of the template for
matching against a similarly transformed feature vector.

Related posts:

1. Biometrics cannot be changed when compromised
2. Biometric algorithms are proprietary and not validated
3. Will I know when and how my biometric has been used?
4. Spoofing physiological biometric
5. Template integrity and confidentiality are distinctly different
6. How do we know when the system is becoming less secure?

Related posts brought to you by Yet Another Related Posts Plugin.