Security Implications of Biometrics

1
Security Implications of Biometrics

• Colin Dougherty

2
What is it?

• Oldest form of identification
• Unique identifiersnot secrets!

3
Examples of Biometrics

• Physiological
• Face
• Fingerprint
• Iris and Retinal
• Hand Veins
• DNA
• Behavioral
• Voice
• Signature

4
Comparison of Biometrics

• Uniqueness
• Permanence
• Collectability
• Performance
• Circumvention

5
Facial Recognition Primer

• Principal components analysis
• Viisages EigenFaces

6
Real World

• Error Rates
• False Positives
• False Negatives
• Airport Biometrics
• Face Recognition

7
Fujistus Palm Vein Biometric

• Infrared Rays
• False Negative 0.01
• False Positive 0.00008

8
Attacks and More Problems

• Verify accuracy and input correctly
• Replay Attacks
• Human Risk
• Poor Failure
• Cancelable Biometrics

9
MythBusters

• Defeat a Fingerprint Scanner
• Copy of the fingerprint etched in latex.
• Ballistics gel copy of the fingerprint.
• Paper copy the fingerprint.

10
Summary

• Security is in layers
• Biometrics have strengths
• Biometrics have weaknesses
• Biometrics are unique identifiers not secrets!

11
Sources

• Secrets Lies, Digital Security in a Networked
  World. Bruce Schneier. John Wiley Sons, 2000
• Jonathan Kent. BBC News, Kuala Lumpur
  http//news.bbc.co.uk/2/hi/asia-pacific/4396831.st
  m
• Worcester Polytechnic Institute. Viisage
  http//www.wpi.edu/News/Transformations/2002Spring
  /recognition.html

12
Questions

• What are two ways of comparing different
  Biometrics?
• Fill in the blank Biometrics are unique
  identifiers not ___________!

13
Security Implications of Biometrics

• Colin Dougherty