Biometrics

What is Biometrics?

• 'Biometrics' comes from the ancient Greek bios (life) and metron (measure)

• It refers to measurable data that uniquely describes an individual's behavioural or physical traits

Example of Biometrics

• face
• fingerprint
• iris
• earprint
• voice
• signature

Biometric Authentication Systems

• Pattern recognition systems that can recognise highly distinctive patterns and associate them to a person

• Generally involves:

  • Enrolment process
  • Authentication process.

Advantage of Using Biometrics for Authentication

• Uniquely identify individuals
• Complex and random
• Always in user's possesion

Disadvantages of Using Biometrics for Authentication

• Sample collection process is influenced by environmental conditions
• Changes over time due to ageing, illness or injury

Combining Biometrics and Cryptography

Generic Public Key Cryptosystems

• The following pair of matching keys are generated:

  • Public key
  • Secret key

• Public key is used to encrypt a secret message

• Secret key is used to decrypt the encrypted message

Secret keys

• Cryptographically strong keys are rather large and random

• Generally,

  • Store the secret key in a smart card
  • Use a password to lock the secret key

Drawbacks

• Smart cards can be stolen

• The secret key is as secure as the password that was chosen to lock it

• The system is not able to differentiate between a legitimate person and an attacker

Combining Biometrics and Cryptography

• The password can be replaced by biometric authentication

• Add biometric authentication on top of exisiting password protection (2-factor authentication)

• Use biometric input directly to generate a cryptographic key or a biometric hash out of it

Key Release Scheme

Key Release Scheme

• Biometric data is used for authentication, if succeeded, then the key is released

• Secret keys and biometric data are independent of each other

• Can be extended to be multi-factor authentication

• Keys could easily be modified or be replaced at any time in case it is compromised (cancellable)

Drawbacks of Key Release Scheme

• Biometric matching process could be manipulated or by-passed by attackers

• False acceptance or false rejection might happen

Key Binding Scheme

Key Binding Scheme

• Secret key is directly derived from the user's biometric data

• Does not need to be stored anywhere

• Drawbacks:

  • Have to find ways to deal with noise in biometric data
  • Could not be changed if the secret key has been compromised once