Emerging Biometric Applications Expectations and Reality in 25

Emerging Biometric Applications Expectations and Reality (in 25 minutes or less!)

An Emerging Technology

What are Biometrics? The term biometrics refers to a science involving the standard analysis of biological characteristics. A biometric is a unique, measurable characteristic or trait of a human being for automatically recognising or verifying identity.

Who are you? No, who are you, really? ? ?

Authentication Methods in Network & Internet Security Something you know Passwords PINs Mother’s maiden name Something you have ATM card Smart card Digital certificate Something you are Biometrics Positive identification Never lost or stolen

Biometrics Innate Iris Retina Ear Fingerprint Palm / hand Face (visual & heat) Skin detail / veins DNA / Blood / Saliva / anti-bodies Heart rhythm Footprint Lips Behavioral Gait Signature Typing style Mixed Voice Body odour

Why Biometrics? “Biometric identification (e. g. , fingerprints, face and voice) will emerge as the only way to truly authenticate an individual, which will become increasingly important as security and privacy concerns grow. ” - Gartner Group 26 th April 2000

How do Biometrics Work? Enrolment: Add a biometric identifier to a database Fingerprint, Voice, Facial or Iris Present biometric Capture Process Store IDENTIFIED Match Compare Verification: Match against an enrolled record Present biometric Capture Process No Match DENIED

Fingerprint Image Identification

Randomness

Accuracy v. Affordability v. Acceptability Affordability >> 0 1 2 3 4 Accuracy >> Courtesy, Veridicom Corp.

Benefits for the Consumer

Benefits of Biometrics link a particular event to a particular individual, not just to a password or token, which may be used by someone other than the authorized user

Business Scenarios The password problem Remote access Who is using our fee-based web-site? Challenge-response tokens Too many physical-access devices Protecting the single-sign-on vault

The Password Problem They’re either too easy or they’re written down somewhere! Users forget them! Help Desk has to sort out the mess!

The Password Problem Write it Down 47 28 8 16 % of respondents Never Source: CCH Occasionally Often Always

The Password Problem Resets per Year 4 62 29 5 % of respondents Zero Source: CCH 1 -2 3 -6 >6

The Password Problem Identifiable costs Lost productivity Flow-on productivity losses Support team Management and infrastructure US research - $340 per incident* Anecdotal – some incidents over $AU 10, 000 *Bio. Netrix Corp - www. bionetrix. com/inserts. pdf

Choosing Technologies and Partners

Privacy Concerns and Ethics Criminal stigma 3 rd party use of data Sold or given for other than intended purpose Provided to law enforcement Unauthorized access Identity theft “Tracking” of actions through biometrics Religious objections - “Mark of the Beast”

Australian Privacy Act NPP 4 – Data Security An organisation must take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure.

Privacy Policy Recommendations 5 basic principles Notice – disclose ALL data captured Access –anyone can view their stored data Correction Mechanism Informed Consent – no 3 rd-party involvement Reliability & Safeguarding

Who would use Biometrics Strong identification and authentication Medium – high data security Non-repudiation (I didn’t do it!)

Who would use Biometrics The last metre Fee-for-service web sites e-Commerce transaction verification

Selecting Biometric Technologies User / environment considerations Technology factors

Technology Comparison Iris Face Finger Signature Voice Accuracy Very High Medium Ease of Use Medium High Barrier to Attack User Acceptability Long Term Stability Interference Very High Medium Medium Very High Medium Coloured Contacts Lighting Aging, Glasses, Hair Dryness Changing Dirt, Signatures Age, Race Noise, Colds, Weather

Accuracy False rejection rate Measures how often an authorized user, who should be recognized by the system, is not recognized. I am not recognised as me! False acceptance rate Measures how often a non-authorized user, who should not be recognized by the system, is falsely recognized. You are pretending to be me!

Matching vs. Non. Matching Prints Non-matching prints d Matching Threshold Matching prints False non-matches False matches

Selecting a Biometric Solution Who can help?

Your Vendor / Consultant Existing relationship Ability to integrate biometrics into existing platform Ability to draw on other experience

Australian Biometric Testing Organisation Recently incorporated Impartial tester Education source Government & industry funded www. biomet. org/abto@biomet. org “Introduction to Biometrics” 1 -day course August 30 th

What problem are we solving? If biometrics is the answer, what’s the question?

Evaluation Strategy Define the requirements Testing & trialing Management buy-in Internal champion (not the IT Manager)

Who is using it? Connecticut Dept Social Welfare Health Application ABN-AMRO

What are some of the products?

Give Passwords the Finger!