authentication ii going beyond passwords. agenda announcements announcements biometrics biometrics...
Post on 22-Dec-2015
221 views
TRANSCRIPT
Authentication IIAuthentication II
Going beyond passwordsGoing beyond passwords
AgendaAgenda
AnnouncementsAnnouncements BiometricsBiometrics Physical devicesPhysical devices General authenticationGeneral authentication
BiometricsBiometrics
Biometrics is the comparison of live Biometrics is the comparison of live anatomical, physiological, or behavior anatomical, physiological, or behavior characteristics to the stored template characteristics to the stored template of a person.of a person.
Physiological:Physiological:– Fingerprint, hand or finger geometryFingerprint, hand or finger geometry– Patterns of retina, veins, irises, facesPatterns of retina, veins, irises, faces
Behavioral:Behavioral:– SignatureSignature– VoiceVoice– keypresseskeypresses
See http://www.biometrics.org/biomvendors.htm for lists of vendors
Potential AdvantagesPotential Advantages
Eliminates certain password Eliminates certain password problems – difficult to share, problems – difficult to share, misplace, and forgemisplace, and forge
Convenient and potentially easy to Convenient and potentially easy to useuse– no rememberingno remembering– nothing physical to forget or misplacenothing physical to forget or misplace
Improve access speedImprove access speed
AuthenticationAuthentication
IdentificationIdentification
vs.vs. VerificationVerification
Question: what’s the difference?Question: what’s the difference?
Biometrics processBiometrics process
EnrollmentEnrollment– AcquisitionAcquisition– Creation of templateCreation of template– Storage of templateStorage of template
UseUse– Acquisition(s)Acquisition(s)– ComparisonComparison– DecisionDecision
Performance metricsPerformance metrics
FTE – Failure To EnrollFTE – Failure To Enroll FTA – Failure To AcceptFTA – Failure To Accept FAR – False Acceptance RatesFAR – False Acceptance Rates FRR – False Reject RatesFRR – False Reject Rates
Common goal: FAR = FRR. Why?Common goal: FAR = FRR. Why?
FingerprintsFingerprints
Traditionally used in law Traditionally used in law enforcement and border control enforcement and border control for identificationfor identification
Many usesMany uses– Walt Disney WorldWalt Disney World– Payment systems – example: Payment systems – example: BioPayBioPay
in North Carolinain North Carolina Variety of cheap devices availableVariety of cheap devices available
RecognitionRecognition
Current technologyCurrent technology– OpticalOptical– UltrasonicUltrasonic– CapacitanceCapacitance
Identify patternsIdentify patterns– Loops, whirlsLoops, whirls
Or Identify minutaeOr Identify minutae– Ridge endings, etc.Ridge endings, etc.
FingerprintsFingerprints
AdvantagesAdvantages– Long history of useLong history of use– Unique and Unique and
permanentpermanent– Variety of cheap Variety of cheap
technologiestechnologies– Reasonable Reasonable
performanceperformance
DisadvantagesDisadvantages– Association with law Association with law
enforcementenforcement– Quality of prints vary Quality of prints vary
with race, age, with race, age, environmental environmental factorsfactors
– Dirt & grimeDirt & grime– Placement of finger Placement of finger
can be importantcan be important– Can be easy to Can be easy to
circumventcircumvent
Face recognitionFace recognition
Select facial features from images Select facial features from images and compareand compare
Variety of environmentsVariety of environments– Search for criminals in crowds Search for criminals in crowds
(airports, large events)(airports, large events)– Border control & passportsBorder control & passports– CasinosCasinos
Face recognitionFace recognition
AdvantagesAdvantages– UniversalUniversal– More acceptable?More acceptable?– Indoor and Indoor and
outdoor use outdoor use reasonablereasonable
– Easy to perform Easy to perform without without awarenessawareness
DisadvantagesDisadvantages– Requires straight Requires straight
on, neutral on, neutral expressionexpression
– Photos can Photos can circumventcircumvent
– Accuracy is still a Accuracy is still a problemproblem
Iris RecognitionIris Recognition
Unique patterns in the iris – iris Unique patterns in the iris – iris codecode
Currently lowest false accept ratesCurrently lowest false accept rates Can be used in Can be used in
variety of variety of environmentsenvironments
BUTBUT Requires good Requires good
image from image from cooperative usercooperative user
Voice RecognitionVoice Recognition
Speech input Speech input – FrequencyFrequency– Duration Duration – CadenceCadence
Easy deploymentEasy deployment– Microphones easy to installMicrophones easy to install– Gathering voice can be done Gathering voice can be done
unobtrusivelyunobtrusively
Voice recognitionVoice recognition
Background and ambient noise is Background and ambient noise is a huge problema huge problem
Templates are large compared to Templates are large compared to other biometricsother biometrics
Longer enrollment time (training)Longer enrollment time (training) Recording may be an issueRecording may be an issue
Keystroke biometricsKeystroke biometrics
Keypress timings or pressureKeypress timings or pressure Advantages:Advantages:
– Easily used in conjunction with computer-Easily used in conjunction with computer-based passwordsbased passwords
– Can be gathered automaticallyCan be gathered automatically Disadvantages:Disadvantages:
– Not very unique or permanentNot very unique or permanent– Can listen to keyboard typing to determineCan listen to keyboard typing to determine– Can be used to infer passwordCan be used to infer password
Other techniquesOther techniques
Hand geometryHand geometry Retinal scansRetinal scans SignatureSignature
Hand veinsHand veins OdorOdor GaitGait Ear Ear DNADNA
General requirementsGeneral requirements
UniversalityUniversality DistinctivenessDistinctiveness PermanencePermanence CollectabilityCollectability PerformancePerformance AcceptabilityAcceptability CircumventionCircumvention
Question: What other usability Question: What other usability requirements?requirements?
ComparisonComparison
FaceFace FingerprinFingerprintt
IrisIris VoicVoicee
KeyboardKeyboard
UniversalityUniversality
DistinctivenessDistinctiveness
CollectabilityCollectability
PerformancePerformance
AcceptabilityAcceptability
CircumventionCircumvention
Security Security ConsiderationsConsiderations
Biometrics are not secrets and Biometrics are not secrets and are therefore susceptible to are therefore susceptible to modified or spoofed modified or spoofed measurementsmeasurements
There is no recourse for revoking There is no recourse for revoking a compromised identifiera compromised identifier
Strategic SolutionsStrategic Solutions– Liveness testingLiveness testing– Multi-biometricsMulti-biometrics
Privacy ConsiderationsPrivacy Considerations
A reliable biometric system provides an A reliable biometric system provides an irrefutable proof of identityirrefutable proof of identity
Threatens individuals right to Threatens individuals right to anonymityanonymity– Cultural or religious concernsCultural or religious concerns– Violates civil libertiesViolates civil liberties
Strategic SolutionsStrategic Solutions– Biometric cryptosystemsBiometric cryptosystems– TransparencyTransparency
Other issuesOther issues
Exception handlingException handling Time consuming enrollmentTime consuming enrollment Sociological concernsSociological concerns
– Cause personal harm or endangerment?Cause personal harm or endangerment?– Cultural or religious oppositionCultural or religious opposition
Comparing systems in the real worldComparing systems in the real world User training User training
– Comfort with technology and methodsComfort with technology and methods– Experience of specific deviceExperience of specific device
QuestionsQuestions
Where would you like to see Where would you like to see biometrics used?biometrics used?
In what situations would it be In what situations would it be inappropriate?inappropriate?
How and when to offer user How and when to offer user training?training?
Physical devicesPhysical devices
““What you have…” piece of the What you have…” piece of the puzzlepuzzle
Typical example:Typical example:– ATM cardsATM cards– Public transportation cardsPublic transportation cards
TechnologiesTechnologies
Smart cardsSmart cards USBUSB Cell phonesCell phones OTP tokensOTP tokens
http://www.rsa.com/
ComparisonsComparisons
Advantages?Advantages? Disadvantages?Disadvantages?
User issues:User issues:– Acquiring the device (expense, time)Acquiring the device (expense, time)– Installing and connecting it properlyInstalling and connecting it properly– Loss or failure of deviceLoss or failure of device
Usability studyUsability study
Motivation: compare alternative forms Motivation: compare alternative forms of cryptographic smart cardsof cryptographic smart cards
Question: which device is faster and Question: which device is faster and easier to use in a mobile setting?easier to use in a mobile setting?
Method: Method: – Within subjects user study with 3 devicesWithin subjects user study with 3 devices– task adapted from Johnny Can’t Encrypttask adapted from Johnny Can’t Encrypt– Testing mobility by changing computersTesting mobility by changing computers– Debriefing questionnaire for user Debriefing questionnaire for user
impressionsimpressions
ResultsResults
USB tokens faster to useUSB tokens faster to use USB token users made fewer errorsUSB token users made fewer errors Smart card has poor feedback for Smart card has poor feedback for
inserting cardinserting card USB token means no separate USB token means no separate
installation – device already plugged installation – device already plugged inin
Added value helps users care about Added value helps users care about them morethem more
QuestionsQuestions
Is it possible to have authorization Is it possible to have authorization without identification?without identification?
How would you increase acceptance of How would you increase acceptance of biometric systems?biometric systems?
Are there any current password Are there any current password systems that you would like to replace systems that you would like to replace with a biometric or hardware scheme? with a biometric or hardware scheme? Why?Why?
How would you design a study to test How would you design a study to test the usability and utility of a laptop the usability and utility of a laptop fingerprint reader?fingerprint reader?
Let’s compareLet’s compare
Paypal:Paypal:– Email (user id) + strong password, Email (user id) + strong password,
challenge questions + email for challenge questions + email for password recoverypassword recovery
– Email + OTP, defaults to password if Email + OTP, defaults to password if token losttoken lost
– Email + fingerprint, defaults to Email + fingerprint, defaults to password if reader unavailablepassword if reader unavailable
EvaluationEvaluation
AccessibilityAccessibility MemorabilityMemorability
– Depth of processing, retrieval, meaningfulnessDepth of processing, retrieval, meaningfulness SecuritySecurity
– Predictability, abundance, disclosure, Predictability, abundance, disclosure, crackability, confidentialitycrackability, confidentiality
CostCost Environmental considerationsEnvironmental considerations
– Range of users, frequency of use, type of Range of users, frequency of use, type of access, etc.access, etc.