Enhancing security and privacy in biometrics-based authentication systems

ABSTRACT

Because biometrics-based authentication offers several advantages over other authentication methods, there has been a significant surge in the use of biometrics for user authentication in recent years. It is important that such biometrics-based authentication systems be designed to withstand attacks when employed in security-critical applications, especially in unattended remote applications such as e-commerce. In this paper we outline the inherent strengths of biometrics-based authentication, identify the weak links in systems employing biometrics-based authentication, and present new solutions for eliminating some of these weak links. Although, for illustration purposes, fingerprint authentication is used throughout, our analysis extends to other biometrics-based methods.

REFERENCES

• 1: Benjamin Miller, Vital signs of identity, IEEE Spectrum, v.31 n.2, p.22-30, Feb. 1994 [doi>10.1109/6.259484]
• 2: 2. L. O'Gorman, "Practical Systems for Personal Fingerprint Authentication," IEEE Computer33, No. 2, 58-60 (2000).
• 3: Robert S. Germain , Andrea Califano , Scott Colville, Fingerprint Matching Using Transformation Parameter Clustering, IEEE Computational Science & Engineering, v.4 n.4, p.42-49, October 1997 [doi>10.1109/99.641608]
• 4: Anil Jain , Lin Hong , Sharath Pankanti, Biometric identification, Communications of the ACM, v.43 n.2, p.90-98, Feb. 2000 [doi>10.1145/328236.328110]
• 5: Bruce Schneier, Inside risks: the uses and abuses of biometrics, Communications of the ACM, v.42 n.8, p.136, Aug. 1999 [doi>10.1145/310930.310988]
• 6: 6. N. K. Ratha and R. M. Bolle, "Smart Card Based Authentication," in Biometrics: Personal Identification in Networked Society, A. K. Jain, R. M. Bolle, and S. Pankanti, Editors, Kluwer Academic Press, Boston, MA (1999), pp. 369-384.
• 7: 7. B. Schneier, "Security Pitfalls in Cryptography," Proceedings of the CardTech/SecureTech Conference, CardTech/SecureTech, Bethesda, MD (1998), pp. 621-626.
• 8: 8. B. Schneier, Applied Cryptography, John Wiley & Sons, Inc., New York (1996).
• 9: 9. J. W. Osterburg, T. Parthasarathy, T. E. S. Raghavan, and S. L. Sclove, "Development of a Mathematical Formula for the Calculation of Fingerprint Probabilities Based on Individual Characteristics," Journal of the American Statistical Association 72, 772-778 (1977).
• 10: 10. S. L. Sclove, "The Occurrence of Fingerprint Characteristics as a Two Dimensional Process," Journal of the American Statistical Association74, 588-595 (1979).
• 11: 11. D. A. Stoney, J. I. Thronton, and D. Crim, "A Critical Analysis of Quantitative Fingerprint Individuality Models," Journal of Forensic Sciences31, No. 4, 1187-1216 (1986).
• 12: 12. WSQ Gray-Scale Fingerprint Image Compression Specification, IAFIS-IC-0110v2, Federal Bureau of Investigation, Criminal Justice Information Services Division (1993).
• 13: Nasir Memon , Ping Wah Wong, Protecting digital media content, Communications of the ACM, v.41 n.7, p.35-43, July 1998 [doi>10.1145/278476.278485]
• 14: 14. F. A. Petitcolas, R. J. Anderson, and M. G. Kuhn, "Information Hiding--A Survey," Proceedings of the IEEE87, No. 7, 1062-1078 (1999).
• 15: W. Bender , D. Gruhl , N. Morimoto , Aiguo Lu, Techniques for data hiding, IBM Systems Journal, v.35 n.3-4, p.313-336, 1996
• 16: 16. M. D. Swanson, M. Kobayashi, and A. H. Tewfik, "Multimedia Data Embedding and Watermarking Technologies," Proceedings of the IEEE86, No. 6, 1064-1087 (1998).
• 17: 17. C.T. Hsu and J. L. Wu, "Hidden Digital Watermarks in Images," IEEE Transactions on Image Processing8, No. 1, 58-68 (1999).
• 18: 18. M. Yeung and S. Pankanti, "Verification Watermarks on Fingerprint Recognition and Retrieval," Journal of Electronic Imaging 9, No. 4, 468-476 (2000).
• 19: 19. C. M. Brislawn, J. N. Bradley, R. J. Onyshczak, and T. Hopper, "The FBI Compression Standard for Digitized Fingerprint Images," Proceedings of SPIE 2847, 344-355 (1996).
• 20: Martin Vetterli , Jelena Kovačevic, Wavelets and subband coding, Prentice-Hall, Inc., Upper Saddle River, NJ, 1995
• 21: 21. T. Rowley, "Silicon Fingerprint Readers: A Solid State Approach to Biometrics," Proceedings of the CardTech/SecureTech Conference , CardTech/SecureTech, Bethesda, MD (1997), pp. 152-159.
• 22: 22. G. Wolberg, "Image Morphing: A Survey," The Visual Computer 14, 360-372 (1998).
• 23: Thaddeus Beier , Shawn Neely, Feature-based image metamorphosis, Proceedings of the 19th annual conference on Computer graphics and interactive techniques, p.35-42, July 1992

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Authentication

Additional Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Unauthorized access (e.g., hacking, phreaking); Authentication

General Terms:
Algorithms, Performance, Security