Biometrics Angela Sasse – Dept of Computer Science

Biometrics

Angela Sasse – Dept of Computer Science

GA10 Authentication 3: Biometrics

Goals of this lecture

1. What are biometrics?2. How they are applied3. Usability and security issues

• biometric = biological or behavioural property of an individual that can be measured and from which distinguishing, repeatable biometric features can be extracted for the purpose of automated recognition of individuals

• biometric sample = analog or digital representation of biometric characteristics prior to biometric feature extraction process and obtained from a biometric capture device or biometric capture subsystem (raw data)

• biometric template = stored biometric features, applied to the biometric features of a recognition biometric sample during a comparison to give a comparison result.

See http://www.bromba.com for a good FAQ on Biometric jargon

Some basics

• Enrolment = capture of biometric feature and generation of biometric sample and/or template

• Full images or templates– templates are more efficient– Images can be used to

reverse-id/create new templates• Verification using ID + biometric, or• identification (biometric compared to

database

Physical/behavioural

Physical • Fingerprint• Finger / Palm Vein• Hand geometry• Face recognition• Iris• Retina• Earshape

Behavioural• Voice print• Dynamic Signature

Recognition (DSR)• Typing pattern• Gait recognition • Heart rate analysis

Enrolment

• Crucial for security and subsequent performance– In some context, identity of enrolee needs to be

checked– Biometrics enrolled need to be

• genuine (see attacks)• good enough quality to work

• Enrolment procedure needs to be formalised – Staff need to be trained– Staff need to be trustworthy or closely checked

• Time taken to carry out enrolment often under-estimated

• FTE (failure to enrol) rate = proportion of people who fail to be enrolled successfully

• FTAs: users can be enrolled but biometric sample too poor quality to verify

• Reasons for FTE/FTA– Biometric not present or temporarily inaccessible– Biometric not sufficiently prominent or stable

• Problem for Universal Access – may exclude- Older users- Disabled- Equipment may be too difficult to use

FTE in UKPS enrolment trial

Face Iris Finger

Quota 0.15% 12.30% 0.69%

Disabled 2.73% 39% 3.91%

UKPS (UK Passport Service) enrolment trial 2004

FAR & FRR

• FAR (False Acceptance Rate)– accepting user who is not registered– mistaking one registered user for another– High security: FAR of .01% acceptable

• FRR (False Rejection Rate)• – rejecting legitimate user • High FRRs reduce usability, high FARs reduce

security– customer-based applications tend to raise FAR

Performance

• User performance depends on – frequency of use:

• Frequent users complete faster and with fewer errors, infrequent users need step-by-step guidance and detailed feedback

– Degree of cooperation– Total usage time (not just for matching)

• Quality of enrolled and presented samples has key impact (e.g. fingerprints 1 or 10 at a time?)

• Different performance for identification and verification (1-1 verification or 1-many identification)

"We were aiming for it to scan 12 pupils a minute, but it was only managing 5 so has been temporarily suspended as we do not want pupils' meals getting cold while they wait in the queue."

Careful balancing of business process requirements and security requirements needed

Total Usage Process• Time quoted by suppliers often only refer to capture

of live image & matching– Walk up to machine– Put down bags, remove hats, etc.– Find token (if used)– Put on token (if used)– Read token– Wait for live image to be captured & matched– Walk away & free machine for next user– Plus average number of rejections & re-tries

Average 12-20 seconds, longer with infrequent users

FRR in UKPS enrolment trial

Face Iris Finger

QuotaTime:

30.82%39 sec

1.75%58 sec

11.70%1 min 13 sec

DisabledTime:

51.57%1 min 3 sec

8.22%1 min 18 sec

16.35%1 min 20 sec

Performance: Smartgate Sydney Airport

• Problem: speedy & secure immigration• Technology: Face recognition system• Users: Quantas air crew (2000)• Performance:

– FAR “less than 1%” – FRR 2% – “could be faster” (average 12 secs)

• Several re-designs necessary, including updating of image templates

Example: BKA face recognition trial

• Railway station with 20,000 passengers/day• 2 month trial of 3 systems• 200 people on watch list, who passed through every day, making no

effort to conceal their identity• FAR fixed at .1% (= 23 false alarms/day)• Best performing system at under most favourable detected caught

60% (down to 20%)

Usability Issues: Finger

• Which finger?• How to position

– Where on sensor?– Which part of finger?– Straight or sideways?

• Problems: arthritis, long fingernails, handcreme, circulation problems

Which finger?

Finger position?

Usability Issues: Iris

• What is it – iris or face?• One or both eyes?• One eye: how to focus?• Distance adjustment • Positioning

– “rocking” or “swaying”• Glasses and contact lenses

– about half of population wear them– Target area difficult to see when glasses are removed

Example: Project IRIS at Heathrow

Focussing

Height adjustment

• Often not sufficient for very short (under 1.55 m) or very tall (over 2.10) people, or wheelchair users

• Need to use hand to adjust– If card needs to be held, other things users carry or hold

need to be put down

Height adjustment

… but users may not realise this

… or be reluctant to touch equipment, or think it takes too long

Usability Issues: Face

• What is it?• Where do I stand?• Where do I look/what am I looking at?• Standing straight, keeping still• “Neutral expression”• Hats, changes in (facial) hair, makeup

Distance

“Neutral expression”

User Acceptance Issues –Finger

• Hygiene, Hygiene, Hygiene

• Association with forensics/criminals

• Finger chopped off

Liveness detection

• Detects movement, pulse, blood flow• Fitted to several systems, but tends to increase

FRR• Users: fine, but do the criminals know about it?

User Acceptance Issues - Iris

• Iris– Risk to health

(e.g. damage to eyes, triggering epilepsy)– Covert medical diagnosis

• Illnesses (iridology)• Pregnancy• Drugs

• “Minority Report” attacks

User Acceptance Issues - Face

• Covert identification• Surveillance/tracking

– Direct marketing

User Acceptance –General Issues• Data protection – threat to privacy• Abuse by employer, commercial organisations, state, or malicious individuals

– Mission creep – Increasing capability of technology – e.g. iris recognition at a distance– Integration with other technologies – e.g. RFID

• Doubts about reliability– Sophisticated attackers– Can government really keep systems secure?– Cheap systems and successful attacks erode confidence

• Simple– Activate latent prints:

breathing, bag with warm water

• Sophisticated– Lift print with tape or

photograph• Gelatine print

(gummy bear attack) – lasts 1x

• Silicone print

Attacks - Finger

CCC strikes again

• Pay-by-touch system in German supermarket chain

• Superglue• Plastic bottle cap• Digital camera• PC with laser printer• Plastic foil• Wood glue

• Published fingerprint of German Home Secretary

Attacks - Iris

• Simple– Picture of eye stuck on

glasses• Sophisticated

– Coloured contact

Attacks - Face

• Simple– Replay attack (Photo or

video of person)– Glasses with strong

frames• Sophisticated

– Mask (Mission Impossible attack)

http://www.heise.de/ct/english/02/11/114/bild7.jpg

Biometrics Angela Sasse – Dept of Computer Science

Documents

Transcript of Biometrics Angela Sasse – Dept of Computer Science

Voice Biometrics for Information Assurance Applications · Voice Biometrics for Information Assurance Applications 3 Navy Biometrics Programs SPAWAR PMW-161 leads the Navy biometrics

The Good, the Bad and the Muffled: the Impact of Different Degradations on Internet Speech Anna Watson and M. Angela Sasse Dept. of CS University College.

sassebooks.comsassebooks.com/media/Maloof_Beyond_90.pdf · An American 'Woodworker by Gene Sasse A limited edition, handcrafted hook. beyond An American Woodworker by Gene Sasse M

Biometrics Hiroki Morimoto. Overview Definition Definition Advantages/Disadvantages and Ideal Biometrics Advantages/Disadvantages and Ideal Biometrics.

2012 Dr. Kent Sasse Media Placements

Jens Riegelsberger 1 M. Angela Sasse John D. McCarthy 2 November 2006 University College London Human-Centred Systems Group Department of Computer Science.

Usable Security – Are we nearly there yet? M. Angela Sasse Head of Information Security Research Director, Research Institute in Science of Cyber Security.

BiomETRICS -

DOI:10.1145/1646353.1646363 M. Angela Sasse privacy and ...rja14/shb10/angela1.pdf · carried out the failed 7/21 “copycat” bombing attempts in 2005. The still images from these

The integration of Retail Management Students into SASSE

SoK:DelegationandRevocation, theMissingLinksintheWeb ...SoK:DelegationandRevocation, theMissingLinksintheWeb’sChainofTrust Laurent Chuat ∗, AbdelRahman Abdou†, Ralf Sasse , Christoph

UNDERSTANDING BIOMETRICS’ IG OBLIGATIONS · Multimodal Biometrics Multimodal biometrics refers to a fusion of biomet-rics. These tend to be visual and spatial biometrics, such as

Evans, Nick and Hans-Jürgen Sasse. “Searching for meaning ...

Biometrics. Outline What is Biometrics? Why Biometrics? Physiological Behavioral Applications Concerns / Issues 2.

Angela’s Top 10 Reasons Why Users Bypass - OWASP · Busting The Myth Of Dancing Pigs: Angela’s Top 10 Reasons Why Users Bypass Security Measures M. Angela Sasse Professor of Human-Centred

c 2012 Ralf Sasse - University of Illinois Urbana-Champaign

Projectblad PG Van Sasse UK 20120601

Clean Rivers, Clean Lake 8 -- Pike River Restoration Success -- Bill Sasse

ph4003 Sasse pregnancy yoga essay Gillian Kiely

Usability and Security – Why we need to look at the big picture M. Angela Sasse Professor of Human-Centred Technology Department of Computer Science University.