Biometrics Authentication Bruce Maggs Biometric Identifiers Fingerprints palm

Biometrics Authentication Bruce Maggs

Biometric Identifiers • • Fingerprints, palm prints Palm veins Hand shape Facial image DNA Iris, retinal images Odor Etc. 2

Fingerprints https: //en. wikipedia. org/wiki/Fingerprint#/media/File: Fingerprints_taken_ by_William_James_Herschel_1859 -1860. jpg 3

Fingerprint Minutiae • Two classes of algorithms: minutaie matching and image comparison. https: //www. fbi. gov/about-us/cjis/fingerprints_biometrics/biometric-center-ofexcellence/files/fingerprint-recognition. pdf 4

FBI Database • “Integrated Automated Fingerprint Identification System” • What is included in IAFIS: Not only fingerprints, but • • • corresponding criminal histories; mug shots; scars and tattoo photos; physical characteristics like height, weight, and hair and eye color; and aliases. https: //www. fbi. gov/about-us/cjis/fingerprints_biometrics/iafis Includes fingerprints for over 70 million criminals and 34 million other civilians. 27 minute processing time for criminal inquiry, 72 minutes for civil 5

Creating Fake Fingerprints • Relatively easy to do given access to a • real fingerprint. But in 2014 Jan Krissler demonstrated that he could create a fake fingerprint from a high-resolution photograph of Germany’s Federal Minister of Defense Ursula von der Leyden! http: //www. ibtimes. com/hacker-demonstrates-how-fake-fingerprint-sensors-using-regular -photographs-1769408 6

Retinal Scans • More difficult to collect than fingerprints. https: //en. wikipedia. org/wiki/Retina#/media/File: Fundus_photograph_of_normal_left_eye. jpg 7

DNA • 99. 9% of DNA is identical in every • • • human! Tests focus on loci where differences are likely to occur. Original DNA is not compared directly: first, copies are made using Polymerase Chain Reaction (PCR) FBI estimates probability of a coincidental match at 1 in 108 trillion, but other estimates are much lower. https: //sasha 949. files. wordpres s. com/2010/05/3642508132_3 f 7 c 649 f 62_o. jpg http: //www. nij. gov/topics/forensics/evidence/dna/basics/pages/analyzing. aspx 8

Implanted Chips • RFID (Radio-Frequency Identification) chip https: //en. wikipedia. org/wiki/Radio-frequency_identification#/media/File: Microchip_rfid_rice. jpg https: //en. wikipedia. org/wiki/Microchip_implant_(human)#/media/File: RFID_hand_2. jpg 9

RFID Technologies • Electromagnetic induction: when a changing magnetic field • passes over the antenna, a current is induced on the chip. Inductive coupling: Chip adjusts its antenna, perturbing the magnetic field, which reader senses (up to about 10 cm). http: //rfid-handbook. de/downloads/images/hf-kommunikationsprinzip. png 10

More on RFID Technology • Reflective backscatter: chip alters reflection of a radio wave. • Active RFID: batteries in the chip are used generate a radio signal, boosting transmission range, e. g. , up to tens of meters. 11

Turing Test A test of a computer’s ability to behave in a way that is indistinguishable from a human being. Turing proposed natural language conversations. 12

“Reverse” Turing Test or “CAPTCHA” • A test that can distinguish a human from a computer. • CAPTCHA: Completely Automated Public Turing test to tell Computers and Humans Apart 13

“Captchas” http: //www. captcha. net/ Easy to generate, difficult for a computer to solve. U. S. Patent 6195698: Method for selectively restricting access to computer systems. Mark D. Lillibridge, Martin Abadi, Krishna Bharat, Andrei Z. Broder. Filed April 13, 1998, published February 27, 2001. von Ahn, Luis; Blum, Manuel; Hopper, Nicholas J. ; Langford, John (May 2003). CAPTCHA: Using Hard AI Problems for Security. EUROCRYPT 2003: International Conference on the Theory and Applications of Cryptographic Techniques 14

Polygraph / Lie Detector • Measures physiological responses to questions, such as heart rate, blood pressure, perspiration http: //abcnewspapers. com/2012/07/07/new-business-detects-between-truth-and-lies/ 15

Scientific Validity? • “CONCLUSION: Polygraph testing yields an unacceptable choice for DOE employee security screening between too many loyal employees falsely judged deceptive and too many major security threats left undetected. Its accuracy in distinguishing actual or potential security violators from innocent test takers is insufficient to justify reliance on its use in employee security screening in federal agencies. ” Ø The Polygraph and Lie Detection, Committee to Review the Scientific Evidence on the Polygraph. Division of Behavioral and Social Sciences and Education. Washington, DC: The National Academies Press. 2003 • Not admissible in court. • But accuracy is better than chance when focused on • specific incidents. Subject’s believe in validity may lead to truthfulness. 16