D3.10: Biometrics in identity management

Title:
SECURITY ASPECTS OF A BIOMETRIC SYSTEM

Security aspects of a biometric system

In the previously presented reference model (see above figure 3) of a biometric system, we can identify a number of potential points of attack. These attack points vary in function of the operation mode (identification or verification) and the control model. The main risks of a biometric system have been compiled by several IT security and certification organisations. An example of such a compilation can be found in the ISACA auditing guidelines G36 Biometric controls. An extract of such a risk list is presented in the table below. The references in the 4th column refer to :

Regardless of any details of a specific biometric system, it is always true that general design principles to make a system more secure also apply to biometric systems. Such concepts are compartmentalisation, defence in depth, shared control, tamper resistant devices, security audits and certifications and other methods and techniques.

Risks	Examples	Possible Countermeasures
Spoofing and mimicry attacks	Artificial finger used on fingerprint biometric device	Multimodal biometrics, vitality detection, interactive protocol	1,2, 8
Fake reference template risk	Fake reference template stored in server or supplied during enrolment	Encryption, intrusion detection system (IDS), supervised enrolment	1,2, 6,7,8,
Transmission risk	Data intercepted during transmission during enrolment or data acquisition	Interactive recognition, rejection of identical signals, system integration	1-7
Component alternation risk	Malicious code, Trojan, etc.	System integration, wellimplemented security policy	5,6,9
Enrolment, administration and system use risk	Data altered during enrolment, administration or system use	Well-implemented security policy	1-7
Similar template/similar characteristics risk	An illegitimate user has a template similar to a legitimate user.	Technology assessment, multimodal access, calibration review	1-6
Brute-force attack risk	An intruder uses brute force to deceive the system.	Account lock after number of unsuccessful attempts	1
Injection risk	Captured digital signal injected into authentication system	Secure transmission; heat sensor activated scanner (warm body present); date/time stamps in digital representation of images	4
Users’ rejection	The invasive nature of biometrics techniques could cause users to reject using the system.	Training and awareness of users and the selection of the least intrusive technique possible	1
Changes in physical characteristics	Some techniques depend on face or hand characteristics, but these human aspects change with the years.	Monitoring of template evolution during use of system	4,5,6
Cost of integration with other legacy systems	Coherence with other techniques used for legacy systems than have to be integrated	Cost-benefit analysis	9
Risk of loss of data	Hard disk/hardware failure	Data backup and restoration	6,9
Risk of biometric data dissemination	Exchange of biometric data between operators without consent of data subjects	No storage of raw data, limit for the lifetime of a biometric template, encapsulated storage of biometric data in the hand of the data subject	2,3,4,6

Table 6: Main risks of a biometric system

Figure : Fault sensitive points of a biometric system:

1. 1. Spoofing of biometric identifier by physical entity
  2. Spoofing of biometric identifier data by electronic data manipulation
  3. Alteration of captured data
  4. Alteration of template
  5. Manipulation of matching algorithm or policy
  6. Alteration or dissemination of reference template
  7. Error introduction in transmission of identity claim (verification mode)
  8. False identity claim during query or enrolment step)
  9. Manipulation of system components, DoS

The problem of impostors spoofing biometric credentials of another person, however, is not an intrinsic problem of biometrics only. There are certainly much easier and therefore more frequent attacks on secret based credentials (PIN, password, passphrase etc). But the issue of biometric spoofing is often discussed in the community of security professionals. In this report we will discuss the threats and methods of impostors to biometric systems more in depth in section .

16 / 40