240 likes | 333 Views
UBC – Computer Security October 4, 2007 Gordon Ross – President VIRTUAL PERCEPTIONSYSTEMS INC. gordon@my-spy.com www.my-spy.com. Biometrics and Your Identity. Biometrics:
E N D
UBC – Computer Security October 4, 2007 Gordon Ross – President VIRTUAL PERCEPTIONSYSTEMS INC. gordon@my-spy.com www.my-spy.com Biometrics and Your Identity
Biometrics: A unique physical or behavioral characteristic which can practically be collected, stored, and compared against; for the purpose of positive identification. Biometrics and Your Identity
Behavioral and physiological Static and dynamic One to one compare One to many searching False Acceptance Rate (FAR) False Rejection Rate (FRR) Failure to Enroll (FTE) Biometric Terms
Fingerprint Facial recognition Iris Voice recognition Hand Geometry Various types of Biometrics
Keystroke dynamics Retinal Scan Palm Print Signature Additional types of Biometrics
Capture a Biometric-Enrollment • Process the Biometric-Algorithm • Store Result-Template • Compare-one to one • verification • Find-one to many • identification • Accept or Reject How does a biometric work?
Some Uses of Biometrics • Controlling access • Monitoring • Authentication • Identification • ATM applications
Open the door please. Is this the person on record? Who are you? Can this smart card log me in? Am I the rightful owner of this password? How could biometrics be used and For what purpose?
How could Biometrics be used and For what purpose? • Open doors-physical access • City of Baltimore-Department of Public Works uses Voice Authentication for Access Control
Or… • Is this the person on record? • Identification • State of Connecticut-Department of Social Services uses Finger Print Imaging to reduce welfare fraud-$23M savings
Or… • Who are you? • Nation Bank - TX • ATM application
Or… • Do we know you? • Facial recognition at Super Bowl in Florida. • Match against known image.
Or… • Am I the rightful owner of this password? • Login by: • Typing user name and password AND • Your unique Biometric.
Social Engineering Collusion Theft or Fraud How can a Biometric be Bypassed or Defeated?
Make an Artificial Finger Print **Making A Mold Final Mold. Soften Plastic Material with Hot Water Press Live Finger into Plastic. **From Tsutomu Matsumoto’s research..
Artificial Finger Print Make an Artificial Finger Print **From a Real Finger. Make the Liquid and Gelatin mix where the gelatin is at 50% wt. Add Boiling Water 30cc to 30g of gelatin and mix. Process takes approximately 20 minutes. **From Tsutomu Matsumoto’s research..
Make an Artificial Finger Print **From a Real Finger. Pour Liquid Into Mold. Refrigerate To Cool. Final Gummy Print. This Process takes approximately 10 Minutes. **From Tsutomu Matsumoto’s research..
Devices that were spoofed.. **From Tsutomu Matsumoto’s research..
Tsutomu Matsumoto tsutomu@mlab.jks.ynu.ac.jp http://www.cyberpunks.org/display/630/article/ • c’t Magazine from Germany http://www.heise.de/ct/english/02/11/114/ • Just “Google” - “Defeating Biometrics” for more information. How can a Biometric be Bypassed or Defeated?
Facial & Iris Recognition systems *FaceVACS-Logon can be outfoxed with a short video clip of a registered person. Once Live-Check has been activated all attempts at deception with stills are foiled. A short .AVI video clip with the webcam in which a registered user was seen to move his head slightly to left and right. The program did in fact detect in the video sequence played to it a moving 'genuine' head with a known facial metric, whereupon it granted access to the system. *c’t magazine – Germany
ROI on biometric projects • Quantify likelihood of previous cases • Costs • Technology Acquisition (HW & SW) • User training-hard enrollment • FTR • Deployment-configuration check • Process change • Help desk calls • Hardware product lifecycle
Summary • Biometrics field is old, industry is new • Entire industry was $65M in 1999 • Global Industry Analysts Inc. states biometric sales are to exceed $6.48 billion by 2010… (July 2007) • Not a technology issue but a people issue • Due diligence is key. • Privacy is also a concern. • Biometrics helps with authentication • Nothing is absolute!
www.bioapi.org www.ibia.org www.biometricgroup.com www.biodigest.com Biometric resources
QUESTIONS? Gordon Ross – BScEE – CET – HSG VIRTUAL PERCEPTION SYSTEMS INC. gordon@my-spy.com www.my-spy.com Thank you…