Match On Card Technology and its use for

Match On Card Technology and its use for PKI Mgr. Miroslav Valeš Sales Manager Eastern Europe mvales@veridicom. cz May 9, 2001 CATE 2001 Security and Protection of Information Sales-rev 1

Presentation Outline u u The problem of adding biometrics to smartcards How Match On Card (MOC) solves it • • • u u The Potential Impact of MOC specifications MOC in PKI applications Alternatives to MOC Summary and Conclusions CATE 2001 - Security and Protection of Information Slide 2

The Problem of Adding Biometrics to Smartcards u u Biometric data cannot be kept private PC is not secure PIN still necessary to unlock card No way to add stronger security than PIN Smart Card Private ROM Data Host PC Match Y/N Operating System SC Reader FP Processing SW Enrolled Biometric Data Readable Public Data FP template CATE 2001 - Security and Protection of Information FP template Slide 3

Fingerprint Background Scan raw image Locate minutiae Template showing geometric relationship between minutia points is stored Minutiae data are unique and are the fingerprint processing standard CATE 2001 - Security and Protection of Information Slide 4

Recognition Technology Minutiae detection • • • Bifurcation 2 fingers not more than 7 matching min. Usual fingerprint has around 30 -40 min. Comparison - relative position of minutiae Allows rotation and translation 2, 5 Kb template created (50 bytes per minutiae) Ridge Ending CATE 2001 - Security and Protection of Information Slide 5

MOC System using PC u Template generated on PC is matched on card u Fingerprint template never leaves the smart card u u u Card not unlocked unless finger matches Can be PIN supplement or replacement Still need to trust the reader or PC Smart Card Private ROM Data Host PC FP template MOC Operating System SC Reader Enrolled Biometric Data Private FLASH Data CATE 2001 - Security and Protection of Information Slide 6 FP Processing SW

The Potential Impact of MOC u u u Smart cards become easier to use (PIN replacement) Finally have a way to securely tie the card to its owner The user privacy is secured (user’s biometric data will never leave the card) CATE 2001 - Security and Protection of Information Slide 7

MOC Specifications u u Software program running on smartcard Designed for 8 -bit low-cost smart cards • • • u Verification time • • u u 120 lines of C-code Object code < 2 Kbytes RAM < 64 bytes 0. 5 sec / successful match 2 sec / unsuccessful match Templates use about 2. 5 Kbytes / finger Uses non-proprietary input features (minutiae) CATE 2001 - Security and Protection of Information Slide 8

Standalone MOC System All fingerprint processing on card with FP sensor on reader “Smart” SC & FP Reader Smart Card Private ROM Data Signed FP template MOC Operating System Challenge/Response Enrolled Biometric Data Private FLASH Data CATE 2001 - Security and Protection of Information Slide 9 Host PC FP Processing Firmware

MOC in PKI Applications: PKI + Smartcards + Biometry u Smartcard securely stores: • • u User’s digital certificates Associated private keys The biometry guarantees who is using the smartcard Fingerprint used to authorize operations with the user’s private key CATE 2001 - Security and Protection of Information Slide 10

Alternatives to MOC: u PIN only (current systems) • • u u Benefit: status quo costs nothing to implement Drawbacks: Can’t tie user to card. Does not provide strong security. Process-On-Card Everything-On-Card CATE 2001 - Security and Protection of Information Slide 11

Alternative to MOC: PROC u u Process-On-Card: all fingerprint software, including image processing, runs on card Signed FP images are sent into card from the reader Higher cost (likely needs 16 or 32 bit card to work reliably) Not much more secure than MOC (still have to send in signed biodata) CATE 2001 - Security and Protection of Information Slide 12

Alternative to MOC: EVOC u u u Everything-On-Card: sensor and all FP software runs on card Very secure but very expensive All sorts of production issues • Smartcard durability, flexibility, etc. CATE 2001 - Security and Protection of Information Slide 13

Summary and Conclusions u u MOC is the first secure way of adding fingerprint security to smart cards MOC can replace or supplement the PIN MOC adds encryption capabilities and PKI to the biometrics Thanks to the encryption support biometry can now be integrated into complex security applications: • File encryption, digital signatures, remote authentication, VPNs, … CATE 2001 - Security and Protection of Information Slide 14