Archive

Archive for the ‘Biometrics security’ Category

Malta issuing Biometrics Passport

December 10th, 2008

Times of Malta reports last month that the Maltese Passports Office has started issuing biometric passports, thus providing holders with a more secure travel document.

 

“timesofmalta.com” indicates that the launch was made last October by the Minister for Infrastructure, Transport and Communications, Austin Gatt, who said that the new passports were being produced in line with international requirements. 

Mr. Gatt explained that the new passports contain the same information as the old ones, but the information is held in a more secure manner in a chip embedded in the document. In the future, the chip will also carry an image of the holder’s fingerprint. 

The Minister added that the introduction of the new passports was also an important step made by Malta to meet US requirements for eligibility to the visa waiver programme. 

The Maltese Passports Office has also revised the tariffs for passports. A new passport for those aged over 16, valid for 10 years, now costs €70, a jump from just under €28. The minister explained that an empty passport previously used to cost the Passport Office €3 and it now costs €30. The Office has also invested over €12 million on the new equipment to input the details on the passports. 

Passports Office officials said that existing valid passports need not be replaced until they expire. 

Additional information may be found in the original article by “timesofmalta.com”.

Biometrics security ,

Biometrics devices must be accurate

November 7th, 2008

There are significant privacy and civil liberties concerns regarding the use of such devices that must be addressed before any widespread deployment. Briefly there are six major areas of concern:

Storage. How is the data stored, centrally or dispersed? How should scanned data be retained?

Vulnerability. How vulnerable is the data to theft or abuse?

Confidence. How much of an error factor in the technology’s authentication process is acceptable? What are the implications of false positives and false negatives created by a machine?

Authenticity. What constitutes authentic information? Can that information be tampered with?

Linking. Will the data gained from scanning be linked with other information about spending habits, etc.? What limits should be placed on the private use (as contrasted to government use) of such technology?

Ubiquity. What are the implications of having a electronic trail of our every movement if cameras and other devices become commonplace, used on every street corner and every means of transportation?

Biometrics security ,

Odour print is another kind of Biometrics

November 7th, 2008

Scientists from the Monell Center present behavioral and chemical findings to reveal that an individual’s underlying odor signature remains detectable even in the face of major dietary changes. The findings using this animal model support the proposition that body odors provide a consistent ‘odorprint’ analogous to a fingerprint or DNA sample,” said Gary Beauchamp, PhD, a behavioral biologist at Monell and one of the paper’s senior authors. “This distinctive odor can be detected using either an animal’s nose or chemical instruments.”

Mammals such as mice and humans are known to have unique genetically-determined body odors, called ‘odortypes.’ Thought to be identity biomarkers that help distinguish individuals from one another, odortypes are determined in part by genes of the major histocompatability complex (MHC). The same genes also are involved in the immune system.

Odortype information is transmitted through body fluids such as sweat and urine, which contain numerous airborne chemical molecules known as volatile organic compounds, or VOCs, many of which are odorous.

The type of food eaten also can influence an individual’s body odor; garlic, for example can be detected by smell when consumed in large amounts. As such, dietary changes potentially could obstruct detection of genetically-determined odortype and thus mask individual identity. To address this question, the researchers conducted a series of behavioral and chemical experiments.

In behavioral tests, ’sensor’ mice were trained to use their sense of smell to choose between pairs of test mice that differed in MHC genes, diet or both. Chemical analyses used instrumentation to examine the array of VOC’s in urine of mice having different MHC backgrounds and fed different diets.

The results indicate that genetically-determined odortypes persist regardless of diet, even though dietary changes do strongly influence odor profiles of individual mice. Changing diet ingredients did not obscure detection of underlying odortypes using either behavioral or chemical methods.

“These findings indicate that biologically-based odorprints, like fingerprints, could be a reliable way to identify individuals. If this can be shown to be the case for humans, it opens the possibility that devices can be developed to detect individual odorprints in humans,” said lead author Jae Kwak, PhD, a Monell chemist.

According to Beauchamp, similar approaches are being used to investigate body odor differences associated with disease. Such research could lead to the development of electronic sensors for early detection and rapid diagnosis of disorders such as skin and lung cancer and certain viral diseases.

This research is published in the October 31 issue of the online journal PLoS ONE. Also contributing to the study were Monell researchers Koichi Matsumura, Maryanne Curran Opiekun, Weiguang Yi (currently at the University of Georgia), George Preti, and Kunio Yamazaki, and Alan Willse (Battelle – Pacific Northwest Division, currently at Monsanto Company).

Biometrics security ,

Does using biometrics increase likelihood of capture, coercion or

September 30th, 2007

Users may be concerned that the use of biometric authentication will increase the
danger that they will find themselves targeted by ruthless criminals who are intent on
gaining entry to the assets protected by the biometric. With non-biometric
authentication, cards, keys, and passwords could be stolen and used by criminals
without the presence of the user. If biometrics are employed so that the physical
presence of the user is required, this may place the user at more risk.
It is hard to produce a definitive analysis of the situation, in the absence of any long
term experience with widely deployed biometric systems. One is left to a speculative
consideration on likely scenarios and outcomes. Nowadays, even low grade crimes
are frequently accompanied with physical assault (e.g. muggings) for small gains such
as cash, mobile phones or credit cards. If biometrics were used to provide
authentication for (say) credit card transactions and mobile phone calls, would this
increase or decrease the likelihood or degree of violence employed? It could
reasonably be argued that petty criminals usually go for “hit and run” attacks and don’t
want to hang around forcing victims to go to ATM machines and withdraw cash etc.
For this type of crime, it seems likely that biometric authentication would act as a
deterrent.
Biometric Security Concerns produced for the UK Biometric Working Group. Last updated September
2003
23
For serious, organised crime, violence is endemic and may be used directly against
victims or their families and friends. Again, it is not clear that the use of biometrics
would make a significant difference to the frequency or degree of coercion and
violence used.
Solutions
Contrary to the concern expressed, the use of biometrics may actually serve to reduce
the likelihood of coercion, because in many cases it would be likely to increase the risk
of arrest for the perpetrator.
Effective liveness checks would act as a countermeasure to the successful use of
cadavers or severed limbs etc. and hence to the motivation for such attempts.
The use of biometrics (and other electronic authentication) provides an opportunity for
the use of duress codes to allow a transaction to take place but alert the authorities
that it is involuntary.

Biometrics security , , , , , , , ,

Does publicising countermeasures make the systems less secure?

September 30th, 2007

If details of countermeasures employed in biometric systems are publicised, it may
help attackers to avoid or defeat them. Similarly, if attackers know what
countermeasures are not employed, this will help them identify potential weaknesses
in the system, and direct attacks towards those weak areas.
The counter-argument is that public exposure of countermeasures and vulnerabilities
will lead to a more mature and responsible attitude from the biometrics community and
promote the development of more secure systems in the future. Generally, achieving
security through obscurity is not seen as a viable policy as it depends on the assumed
difficulty of analysis which is a hostage to fortune. For example the design of a “secure”
Biometric Security Concerns produced for the UK Biometric Working Group. Last updated September
2003
18
mechanism may fall into the hands of an attacker and, if the underlying security is not
adequate, compromise will result. Certainly in the traditional area of cryptography, the
philosophy that is normally adopted is to assume that an opponent will have knowledge
of the design of the cryptographic algorithm, but that knowledge should not
compromise the cryptographic security.
That is not to say that obscurity cannot provide any protection, rather that the protection
is invariably unpredictable and may be short-lived. If we wish to make biometric
devices and applications secure it is necessary to understand the threats and put in
place effective countermeasures, technical and procedural. A parallel may be drawn
with the field of IT vulnerabilities where the world has had time to come to terms with
the idea and not seek to suppress knowledge. Rather, the approach is to report
problems to the developers so that they can be fixed and patches issued. The balance
between (excessive) publicity and suppression has been struck, founded on pragmatic
principles based on experience. If and when biometrics are widely deployed, a similar
approach can be expected to be adopted.
Whatever the merits of the arguments, they are likely to be overtaken by events.
Suppression by governments or companies will not inhibit individual researchers and
consumer magazines from investigating the subject. Already in the biometrics area, a
number of ad-hoc security evaluations have been conducted and the results published.
The following table lists some of them.

Biometrics security , , , , , , , ,

Biometric algorithms are proprietary and not validated

September 30th, 2007

Many encryption algorithms are publicly available to allow cryptographers to analyse
and verify the strength of the encryption. Biometric algorithms are not readily available
for review and are thus an unknown factor.
Biometric algorithms do not generally fulfil the same purpose as cryptographic
algorithms. Rather, they represent the encoding rules for the biometric feature set to
derive a template in order to provide a means of distinguishing between the features
of enrolled users of the system. The purpose of the biometric algorithm is functional
rather than security related, though there may be security connotations
If an analyst (or an attacker) wishes to understand the working of the algorithm, then the
task is likely to be easier if the algorithm is publicly available. An impostor might wish
to examine the algorithm to determine how the biometric ? template mapping works,
and what elements are more and less important to the authentication process. This
knowledge could aid the construction of an artefact intended to spoof the system,
particularly if the approach was to be that of an artificially constructed image rather
than a copy of a known legitimate image. An undisclosed algorithm would make this
process more difficult (security through obscurity) but is unlikely to resist a determined
attack that might involve reverse engineering of the algorithm. Conversely, a publicly
available algorithm may help to highlight potential weaknesses and thereby assist in
their eradication (i.e. as for the case of password algorithms)

Biometrics security , , , , , , , , , ,

Biometrics should only be stored on smart-cards

September 29th, 2007

This is a sometimes heard expression of concern about the potential misuse of
biometric data stored on central databases. It refers to the threat to privacy that such
centralised collections of personal data could pose if compromised.
Biometric data are regarded as personal data and hence subject to the controls
appropriate to personal data. There is a perceived fear that biometric data may be
shared between applications, perhaps without the knowledge or consent of the
subjects. This concern may be amplified if biometric images are stored, rather than the
coded template data only, particularly for large-scale public applications where there
may be perceived Orwellian overtones. This area is addressed in the UK by the Data
Protection Act -1998 (DPA), which applies to biometric data just as much as to other
personal data. Codes of conduct may be needed to provide specific interpretation of
the DPA for biometric applications.
Biometric data are not usually held in isolation. They are typically associated with other
personal data that may form part of the identification and authentication process itself,
or subsequently for access control permissions. Associated data is normally not
Biometric Security Concerns produced for the UK Biometric Working Group. Last updated September
2003
15
unique to biometric authentication systems, and is commonly stored centrally on nonbiometrics
applications, not apparently eliciting equivalent concern.
Solutions
A potential solution is seen in the storing of personal data on secure tokens or smart
cards that are held by the users themselves. The assumption is that this will obviate the
need for a central database of biometric data, and therefore negate any privacy
concerns. This is attractive because it promotes the idea of anonymous authentication.
However, anonymous authentication has its limits and may not be tenable in many
circumstances. For example in government applications, it will typically not be
sufficient to know that the person applying for the benefit payment/passport/driving
licence is who they claim to be. It will also be necessary to check that they are entitled
to the service or payment requested and not enrolled multiple times under different
identities. To do this a central database of claimants will almost certainly be needed,
even if a token or smart card is used as part of the authentication process. In these
cases, the privacy protection advantage ascribed to user-held tokens or smart cards
will be largely illusory.
To mitigate the risk of functional creep, the biometric data can be bound to the
application through the use of cryptographic signature techniques.

Biometrics security , , , , , , , , ,

How do we know when the system is becoming less secure?

September 28th, 2007

Biometric systems may be initially adequately secure, but become less so with
passing time. This could be because critical security parameters such as threshold
settings become maladjusted, or sloppy enrolment procedures lead to poor enrolment
quality. Some biometric systems are self-adaptive which means that the templates are
updated each time a user accesses the system. This feature is intended to maintain
the system performance (essentially to stop the false rejection rate increasing) if the
users’ biometric characteristics change over time. Such updating may result in the
reference templates becoming weaker (easier for an impostor to attack) without
supervisors being aware of anything untoward. The problem may be exacerbated if
coupled with sloppy user behaviour which results in poor quality images that translate
into weaker templates.
An impostor, working in collusion with an enrolee, could gradually “train” the system
away from the enrolee’s template onto the impostor’s template.
Solutions
The risks can be countered through system audit and testing. If security relevant events
are logged, then changes in security parameters can be audited. Suspicious events
such as persistent authentication failures can also be checked. If the system is
capable of checking its own performance, then it could monitor the template
separation of enrolled users and flag conditions where the separation becomes
inadequate. Clearly, these measures are likely to be more difficult to apply in large
distributed systems where logs and templates may also be distributed.

Biometrics security , , , , , , , , , , ,

Will I know when and how my biometric has been used?

September 27th, 2007

This is related to the covert use of biometrics (see “Can my biometric be collected
covertly?” previously), and to functional creep in applications. It is important to realise
that authentication does not necessarily imply consent, and it is consent which is the
issue of concern here. Any application could be affected though the concern will grow
with wider deployment of biometric systems and the opportunities and motivation for
sharing biometric data increase.
It is unlikely that biometric applications using different technologies could share
biometric data between them which will act as one limiting factor. Depending on future
template and image standards, applications using similar technologies from different
vendors may or may not be able to share data. The desire for integration and
interoperability of biometric systems is likely to grow and will act as a driver for
standardisation.
Functional creep and data sharing are not concerns that are limited to biometric
systems. They are common experiences in the modern world with interconnection of
systems, and address and lifestyle information is routinely traded as marketing
commodities. Biometric data may therefore be seen as just one more example, but its
intrinsically personal nature coupled with its role in defining and authenticating identity
may render it peculiarly sensitive.
Biometric Security Concerns produced for the UK Biometric Working Group. Last updated September
2003
22
This is likely to become an increasing problem with the growth in use of biometrics for
authentication. With the widespread use of networked applications, the opportunities
for sharing data will increase and controls will be harder to enforce.
Solutions
Legal and procedural constraints are the first line of defence against functional creep
and covert capture. The Data Protection Act requires that applications storing and
processing personal data adhere to the principles and that the purpose and operation
of the system is declared, not only to the Information Commissioner, but also to the
users. Changes in functionality are not allowed unless approved by the resubmission
and registration of the system.
Audit trails can provide users with evidence of proper implementation of the system
privacy policy and any violations that may have occurred.
Technology can provide solutions by cryptographic binding of templates to specific
applications, but successful employment will also depend on strict procedural
enforcement. It should be noted that, typically, biometric data will exist (transiently) in
clear form within the biometric system to allow the matching process to take place.

Biometrics security , , , , , , , , ,

Valuable assets are traditionally protected by secrecy

September 27th, 2007

Valuable assets are traditionally protected by secrecy, typically secret passwords.
Biometric features are often readily observed and do not possess equivalent secrecy.
They may also be captured with varying degrees of difficulty.
This is a variation on the spoofing concern. It is certainly true that the source biometric
features are not secret, but the argument as expressed is based on an incorrect
premise. In fact, biometric security does not depend on the secrecy of the basic
biometric features (people readily rely on biometric identification in its human form in
day-to-day use). Rather, it depends on the integrity of the authentication mechanism
which, in the context of issue raised here, translates into the difficulty of capturing the
biometric features of a target and then constructing an artefact that will spoof the
system. This can be contrasted with a password which, once disclosed, is trivial to
exploit.

Biometrics security , , , , , , , , ,

Biometrics do not provide absolute identification

September 26th, 2007

There is sometimes a misapprehension that biometrics can provide absolute
identification (e.g. of terrorists, criminals etc) as though the implementation of
biometric systems will somehow solve the problem of a major terrorist attack.
Of course biometric systems can, at best, only identify/verify individuals who have been
previously enrolled. Applications can use this functionality in various ways, for example
to provide an alert when a stranger is detected (i.e. biometric features captured that do
not correspond to an enrolled user). The feasibility and effectiveness of the application
will depend on the technology, environment and other details of the implementation.
Biometric authentication only addresses part of the overall authentication framework.
Non-biometric elements (pre-enrolment) are needed to establish absolute identity with
the assurance standards needed for the application using acceptable credentials (e.g.
birth certificate, peer endorsement etc)

Biometrics security , , , , ,

capture replay attacks

September 25th, 2007

Capture/replay is the name given to attacks where the biometric signals from an
enrolled user are captured at one place and time and replayed later (usually at the
same place) in an attempt to fool the system that the enrolled used is present. Although
this can arguably occur at many points in the biometric system, the terminology usually
applies to electrical signals captured between the capture device and the rest of the
system. It may be a particular problem where there is a large and unsupervised path
between the 2 components such as a network connection.
Solutions
A number of technical and procedural solutions are available including:
· Physical security (tamper resistance and detection, guards, inspections etc)
· Data encryption with unique session keys/time stamping for communications paths
· Access control to stored reference templates
· Reference templates marked and signed

Biometrics security , , , , ,