Biometric SecurityWhat is biometrics?
Biometrics is the science of measuring physical properties of living beings.
(1) Biometric authentication is the automatical recognition of a living being using suitable body characteristics.
(2) By measuring an individual's physical features in an authentication inquiry and comparing this data with stored biometric reference data, the identity of a specific user is determined.
How it all began:
The concept of biometric probably began with the use of facial features to identify other people. It was in 1882 when Alphonse Bertillon, Chief of the Criminal Identification Division, Police Department in Paris, France, developed a detailed method identification based on a number of bodily measurements and physical descriptions. The Bertillon system of Anthropometric Identification gained wide acceptance before fingerprint identification suspended it.
It was Sir Francis Galton, a British scientist, who proposed the use of fingerprints for identification purpose in the late 19th century. He analysed the fingerprint patterns in detail, and finally presented a new classification system using prints of all ten fingers, which is the basis of identification systems even today. Subsequently, a British police official, Sir Richard Edward Henry, introduced fingerprinting as a means of identifying criminals.
What are the advantages of biometric systems for authentication?
Advancing automation and the development of new technological systems, such as the internet and cellular phones, have led users to more frequent use of technical means rather than human beings in receiving authentication. Personal identification has taken the form of secret passwords and PINs. Everyday examples requiring a password include the ATM, the cellular phone, or internet access on a personal computer. In order that a password cannot be guessed, it should be as long as possible, not appear in a dictionary, and include symbols such as +, -, %, or #. Moreover, for security purposes, a password should never be written down, never be given to another person, and should be changed at least every three months. When one considers that many people today need up to 30 passwords, most of which are rarely used, and that the expense and annoyance of a forgotten password is enormous, it is clear that users are forced to sacrifice security due to memory limitations. While the password is very machine friendly, it is far from user-friendly.
There is a solution that returns to the ways of nature. In order to identify an individual, humans differentiate between physical features such as facial structure or sound of the voice. Biometrics, as the science of measuring and compiling distinguishing physical features, now recognizes many further features as ideal for the definite identification of even an identical twin. Examples include a fingerprint, the iris, and vein structure. In order to perform recognition tasks at the level of the human brain (assuming that the brain would only use one single biometric trait), 100 million computations per second are required.
In the development of biometric identification systems, physical and behavioral features for recognition are required which:
• are as unique as possible, that is, an identical trait won't appear in two people: Uniqueness
• occur in as many people as possible: Universality
Biometric Trait Description
Fingerprint Finger lines, pore structure
Signature (dynamic) Writing with pressure and speed differentials
Facial geometry Distance of specific facial features (eyes, nose, mouth)
Iris Iris pattern
Retina Eye background (pattern of the vein structure)
Hand geometry Measurement of fingers and palm
Finger geometry Finger measurement
Vein structure of back of hand Vein structure of the back of the hand
Ear form Dimensions of the visible ear
Voice Tone or timbre
DNA DNA code as the carrier of human hereditary
Odor Chemical composition of the one's odor
Keyboard strokes Rhythm of keyboard strokes (PC or other keyboard)
What are the most well known biometric features used for authentication purposes?
• don't change over time: Permanence
• are measurable with simple technical instruments: Measurability
• are easy and comfortable to measure: User friendliness
Biometric traits develop:
• Through genetics: genotypic
• Through random variations in the early phases of an embryo's development: randotypic (often called phenotypic)
• Or through training: behavioral
Which biometric features are most constant over time?
Reasons for variation over time:
• Growth
• Wear and tear
• Aging
• Dirt and grime
• Injury and subsequent regeneration etc.
Biometric features, which are minimally affected by such variation, are preferred. The degree to which this is possible is shown in the following table. Easily changed effects such as dirt and quickly healing injuries such as an abrasion, are not taken into consideration.
The following table rates the relative importance of each factor (o is small, ooo is large)
Biometric Trait Permanence over time
Fingerprint (Minutia) oooooo
Signature(dynamic) oooo
Facial structure ooooo
Iris pattern ooooooooo
Retina oooooooo
Hand geometry ooooooo
Finger geometry ooooooo
Vein structure of the back of the hand oooooo
Ear form oooooo
Voice (Tone) ooo
DNA ooooooooo
Odor oooooo?
Keyboard strokes oooo
Comparison: Password ooooo
Which organizations attend to standardizing biometric systems?
• ISO/IEC JTC1 (world)
• DIN NI-AHGB & NI-37 (Germany)
What is the difference between identification and verification?
• In identification, the recorded biometric feature is compared to all biometric data saved in a system. If there is a match, the identification is successful, and the corresponding user name or user ID may be processed subsequently.
• In a verification, the user enters her/his identity into the system (e.g., via a keypad or card), then a biometric feature is scanned. The biometric trait must only be compared to the one previously saved reference feature corresponding to the ID. If a match occurs, verification is successful.
• If a system has only one saved reference trait, identification is similar to verification, but the user need not first enter his or her identity, as for example, access to a mobile phone which should only be used by its owner.
What are the advantages of verification over identification?
• Verification is much faster than identification when the number of saved reference features/users is very high.
• Verification shows a better biometric performance than identification, especially when the number of reference traits/users is very high.
What makes up a biometric authentication system?
A basic biometric system is made up of:
• a sensor to record the biometric trait
• a computer unit to process and eventually save the biometric trait
• an application, for which the user's authentication is necessary
Generally, computation speeds adequate for pattern recognition are required. This is about 100 million operations per second, which have only recently been attained by affordable hardware (PC, DSP).
Is biometrics more "secure" than passwords?
This question at least poses two problems: biometrics is not equal to biometrics, and the term "secure" is in fact commonly used, but it is not exactly defined. However, we can try to collect pros and cons in order to find at least an intuitive answer.
It is a matter of fact that the security of password protected values in particular depends on the user. If the user has to memorize too many passwords, he will use the same passwords for as many applications as possible. If this is not possible, he will go to construct very simple passwords. If this will also fail (e.g., if the construction rules are too complex), the next fall-back stage is to notify the password on paper. This would transform "secret knowledge" into "personal possession". Of course, not every user will react this way. Rather the personal motivation plays an important role: is he aware of the potential loss caused by careless handling of the password? It is easy if the user is the owner. But often foreign possession (e.g., that of the employer) has to be guarded, whose value one often can hardly estimate. If motivation is missing, any password primarily tends to be felt bothersome. In this case, and that seems to be the normal case, it is assumed that biometrics has considerable advantages.
Contrariwise, passwords feature unbeatable theoretic protection ability: an eight-digit password which is allowed to contain any symbol from an 8-bit alphabet offers 1020 possible combinations! This is a real challenge for any biometric feature. The requirements are obvious: such a password is maximally difficult to learn, it must not be written down, it must not be passed to anyone, the input must take place absolutely secret, it must not be extorted, and the technical implementations must be perfect. This leads us to the practical aspects: the implementation must be protected against replay attacks, keyboard dummies (e.g., false ATMs), wiretapping etc. Even biometric features have to cope with such problems. However, it can be assumed that the protection of biometric feature acquisition is not easier than the acquisition of the password, provided the implementation expense is comparable!
Conclusion: Surely, there are cases where passwords offer more security than biometric features. However, these cases are not common!
Information Sources:
• Biometrics site of Jan Krissler and Lisa Thalheim
(http://www.biometrische-systeme.org/)
• Avanti Biometrics Site
(http://www.avanti.1to1.org/)
• Biometrics Research Homepage at Michigan State University (http://biometrics.cse.msu.edu/)
• NIST National Institute of Standards and Technology (http://www.nist.gov/biometrics)
