Biometrics in Information Security - Revision history

24.57.207.170 at 05:26, 30 January 2008

2008-01-30T05:26:19Z

← Older revision		Revision as of 05:26, 30 January 2008
Line 14:		Line 14:


-	~~''Physiological''~~

-	[[Image:Thermograph_face.png‎ \|~~right~~\|thumbnail\|250px\|A [http://en.wikipedia.org/wiki/Thermograph thermographic] image of a face<sup>[E3]</sup>]]	+	[[Image:Thermograph_face.png‎ \|left\|thumbnail\|250px\|A [http://en.wikipedia.org/wiki/Thermograph thermographic] image of a face<sup>[E3]</sup>]]
		+
		+	''Physiological''

	'''Eyes''' - Images of the [http://en.wikipedia.org/wiki/Iris_scan iris] or retina		'''Eyes''' - Images of the [http://en.wikipedia.org/wiki/Iris_scan iris] or retina

Goesc at 17:15, 9 December 2007

2007-12-09T17:15:42Z

← Older revision		Revision as of 17:15, 9 December 2007
Line 1:		Line 1:
-	[[Image:Airport_Iris_Scan.png\|right\|thumbnail\|250px\|By registering their biometric data ahead of time, travelers at Heathrow Airport in London, UK can go through an automated check in, using [http://en.wikipedia.org/wiki/Project_IRIS IRIS]<sup>[2]</sup>]]	+	[[Image:Airport_Iris_Scan.png\|right\|thumbnail\|250px\|By registering their biometric data ahead of time, travelers at Heathrow Airport in London, UK can go through an automated check in, using [http://en.wikipedia.org/wiki/Project_IRIS IRIS]<sup>[E2]</sup>]]

-	The word '''biometric''' originally comes from ancient Greek, “bios” – life + “metron” – measurement<sup>[1]</sup>. The classic definition of biometrics refers to the measurement of biological traits (i.e. the growth rates of bacteria) however this field of study is now referred to as [http://en.wikipedia.org/wiki/Biostatistics Biostatistics]. The contemporary field of biometrics refers to measurements of unique physical or behavioral traits in humans. In the vernacular of information security, biometrics falls mainly under confidentiality and availability because of its applications in identification and authentication.	+	The word '''biometric''' originally comes from ancient Greek, “bios” – life + “metron” – measurement<sup>[R1]</sup>. The classic definition of biometrics refers to the measurement of biological traits (i.e. the growth rates of bacteria) however this field of study is now referred to as [http://en.wikipedia.org/wiki/Biostatistics Biostatistics]. The contemporary field of biometrics refers to measurements of unique physical or behavioral traits in humans. In the vernacular of information security, biometrics falls mainly under confidentiality and availability because of its applications in identification and authentication.


-	In the process of biometric authentication, a mathematic model of a measurable trait (see '''Types of Measurements''' below) is converted into a unique signature, similar to the [http://en.wikipedia.org/wiki/Checksum checksum] of a file. This process refers to the identification phase of authentication, where an identity is bound to a subject. When the physical trait is measured again, the same signature should be produced and authentication of the subject is successful.	+	In the process of biometric authentication, a mathematic model of a measurable trait (see '''Types of Measurements''' below) is converted into a unique signature, similar to the [http://en.wikipedia.org/wiki/Checksum checksum] of a file. This process refers to the identification phase of authentication, where an identity is bound to a subject. When the physical trait is measured again, the same signature should be produced and authentication of the subject is successful<sup>[R2]</sup>.


Line 11:		Line 11:

	== Types of Measurements ==		== Types of Measurements ==
-	Biometric measurements can usually be divided into two main branches, '''Physiological''' - patterns in physical appearance or structure, and '''Behavioral''' - patterns in how something is done.	+	Biometric measurements can usually be divided into two main branches, '''Physiological''' - patterns in physical appearance or structure, and '''Behavioral''' - patterns in how something is done<sup>[R2]</sup>.


	''Physiological''		''Physiological''

-	[[Image:Thermograph_face.png‎ \|right\|thumbnail\|250px\|A [http://en.wikipedia.org/wiki/Thermograph thermographic] image of a face<sup>[3]</sup>]]	+	[[Image:Thermograph_face.png‎ \|right\|thumbnail\|250px\|A [http://en.wikipedia.org/wiki/Thermograph thermographic] image of a face<sup>[E3]</sup>]]

	'''Eyes''' - Images of the [http://en.wikipedia.org/wiki/Iris_scan iris] or retina		'''Eyes''' - Images of the [http://en.wikipedia.org/wiki/Iris_scan iris] or retina
Line 49:		Line 49:
	== Problems with Biometric Systems ==		== Problems with Biometric Systems ==

-	'''Replay Attacks''' - a replay attack occurs when an attacker captures a piece of secret data (i.e. a password, or a fingerprint) and uses that data to make subsequent accesses to the system. Biometric systems are vulnerable to replay attacks because by capturing authentication data, an attacker can produce the same signature stored in the database. By compromising a fingerprint or iris scan, an attacker can reuse that information to gain access to the system.	+	'''Replay Attacks''' - a replay attack occurs when an attacker captures a piece of secret data (i.e. a password, or a fingerprint) and uses that data to make subsequent accesses to the system. Biometric systems are vulnerable to replay attacks because by capturing authentication data, an attacker can produce the same signature stored in the database. By compromising a fingerprint or iris scan, an attacker can reuse that information to gain access to the system<sup>[R2]</sup>.

-	'''Identity Theft''' - Identity theft is always a consideration when considering an authentication system, however with biometric systems, the problem has larger repercussions. Normally, when an account has been compromised, the user name or password for the account can be reset. A fingerprint in a biometric system serves as the password, so when this information is compromised, the fingerprint cannot be changed (without cosmetic surgery). This means that once an identity is stolen, it has been stolen forever.	+	'''Identity Theft''' - Identity theft is always a consideration when considering an authentication system, however with biometric systems, the problem has larger repercussions. Normally, when an account has been compromised, the user name or password for the account can be reset. A fingerprint in a biometric system serves as the password, so when this information is compromised, the fingerprint cannot be changed (without cosmetic surgery). This means that once an identity is stolen, it has been stolen forever<sup>[R1]</sup>.

	'''Dystopia''' - Many science fiction stories have addressed the problem of a society with an entrenched biometric infrastructure. As the technology becomes more widely used for quickly identifying people, more places will be gathering, storing and tracking biometric information. This may put true anonymity in the world in danger of extinction, which would have many political and social repercussions (Watergate would not exist without the anonymous "[http://en.wikipedia.org/wiki/Deep_throat Deep Throat]").		'''Dystopia''' - Many science fiction stories have addressed the problem of a society with an entrenched biometric infrastructure. As the technology becomes more widely used for quickly identifying people, more places will be gathering, storing and tracking biometric information. This may put true anonymity in the world in danger of extinction, which would have many political and social repercussions (Watergate would not exist without the anonymous "[http://en.wikipedia.org/wiki/Deep_throat Deep Throat]").
Line 71:		Line 71:
	==External Links==		==External Links==

-	[1] http://en.wikipedia.org/wiki/Biometrics	+	[E1] http://en.wikipedia.org/wiki/Biometrics

-	[2] http://edition.cnn.com/2007/BUSINESS/07/25/biztrav.iris/index.html	+	[E2] http://edition.cnn.com/2007/BUSINESS/07/25/biztrav.iris/index.html

-	[3] http://www.wescanu.com/	+	[E3] http://www.wescanu.com/


Line 81:		Line 81:
	== References ==		== References ==

-	~~- Bishop, Matt~~. ~~Introduction to Computer Security. Boston: Addison-Wesley, 2006~~.	+	[R1] http://en.wikipedia.org/wiki/Biometrics

-	~~- http://en~~.~~wikipedia~~.~~org/wiki/Biometrics~~	+	[R2] Bishop, Matt. Introduction to Computer Security. Boston: Addison-Wesley, 2006.

-	- http://biometrics.org/	+	[R3] http://biometrics.org/

-	- http://dictionary.reference.com/	+	[R4] http://dictionary.reference.com/


	--[[User:Goesc\|Goesc]] 12:07, 9 December 2007 (EST)		--[[User:Goesc\|Goesc]] 12:07, 9 December 2007 (EST)

Goesc at 17:07, 9 December 2007

2007-12-09T17:07:58Z

← Older revision		Revision as of 17:07, 9 December 2007
Line 1:		Line 1:
-	[[Image:Airport_Iris_Scan.png\|right\|thumbnail\|250px\|By registering their biometric data ahead of time, travelers at Heathrow Airport in London, UK can go through an automated check in, using [[http://en.wikipedia.org/wiki/Project_IRIS IRIS]]<sup>[2]</sup>]]	+	[[Image:Airport_Iris_Scan.png\|right\|thumbnail\|250px\|By registering their biometric data ahead of time, travelers at Heathrow Airport in London, UK can go through an automated check in, using [http://en.wikipedia.org/wiki/Project_IRIS IRIS]<sup>[2]</sup>]]

	The word '''biometric''' originally comes from ancient Greek, “bios” – life + “metron” – measurement<sup>[1]</sup>. The classic definition of biometrics refers to the measurement of biological traits (i.e. the growth rates of bacteria) however this field of study is now referred to as [http://en.wikipedia.org/wiki/Biostatistics Biostatistics]. The contemporary field of biometrics refers to measurements of unique physical or behavioral traits in humans. In the vernacular of information security, biometrics falls mainly under confidentiality and availability because of its applications in identification and authentication.		The word '''biometric''' originally comes from ancient Greek, “bios” – life + “metron” – measurement<sup>[1]</sup>. The classic definition of biometrics refers to the measurement of biological traits (i.e. the growth rates of bacteria) however this field of study is now referred to as [http://en.wikipedia.org/wiki/Biostatistics Biostatistics]. The contemporary field of biometrics refers to measurements of unique physical or behavioral traits in humans. In the vernacular of information security, biometrics falls mainly under confidentiality and availability because of its applications in identification and authentication.
Line 11:		Line 11:

	== Types of Measurements ==		== Types of Measurements ==
		+	Biometric measurements can usually be divided into two main branches, '''Physiological''' - patterns in physical appearance or structure, and '''Behavioral''' - patterns in how something is done.
		+
		+
		+	''Physiological''
		+
		+	[[Image:Thermograph_face.png‎ \|right\|thumbnail\|250px\|A [http://en.wikipedia.org/wiki/Thermograph thermographic] image of a face<sup>[3]</sup>]]
		+
		+	'''Eyes''' - Images of the [http://en.wikipedia.org/wiki/Iris_scan iris] or retina
		+
		+	'''Face''' - Electromagnetic or [http://en.wikipedia.org/wiki/Thermography thermal scans]
		+
		+	'''Hand/Fingers''' - [http://en.wikipedia.org/wiki/Fingerprint Fingerprints], vein and palm geometry
		+
		+	'''DNA''' - [http://en.wikipedia.org/wiki/Noncoding_DNA Noncoding DNA] pattern matching
		+
		+
		+	''Behavioral''
		+
		+	'''Signature''' - Combinations of specific features of a signature (i.e. size of lines and loops in letters)
		+
		+	'''Voice''' - Patterns in tones and frequencies when a specific words are spoken
		+
		+	'''Keystroke''' - Patterns in how specific text is typed in (i.e. relative delays in different keystrokes)
		+
		+	In all biometric measurements, an original sample of the data is recorded as a digital signature and linked to an identity. This signature is stored, and used to compare to future signatures to ensure that the person giving the new sample matches the identity for the originally recorded data.



	== Applications ==		== Applications ==
		+	Biometric technology has two closely related applications, '''identification''' and '''authentication'''.

		+	In the Identification stage, an existing identity (or person) is linked to a piece of stored biometric information. Identification is usually used as a deterrent against fraud, or as the first stage in authentication. An example of this is at the entrance gates in Disney Land. Along with their ticket, patrons are asked to provide a fingerprint scan which is linked to the ticket, so that only that person can use the ticket for re-entry. In this example, the biometric information of the person is linked to their ticket, and not their actual identity, which maintains anonymity while still preventing unwanted accesses to the park.
		+
		+	In the Authentication stage, a person provides a biometric sample which is compared to a database of signatures. If a match is made, the person is successfully authenticated with the identity linked to the biometric information. An example of this is a military system which has biometric information on all of its officers on file. In order to enter a specific room, an officer must provide fingerprints and an iris scan to confirm his identity. In this example, the officer's fingerprints and iris scans are being compared to original samples which he would have initially provided.


	== Problems with Biometric Systems ==		== Problems with Biometric Systems ==

		+	'''Replay Attacks''' - a replay attack occurs when an attacker captures a piece of secret data (i.e. a password, or a fingerprint) and uses that data to make subsequent accesses to the system. Biometric systems are vulnerable to replay attacks because by capturing authentication data, an attacker can produce the same signature stored in the database. By compromising a fingerprint or iris scan, an attacker can reuse that information to gain access to the system.

		+	'''Identity Theft''' - Identity theft is always a consideration when considering an authentication system, however with biometric systems, the problem has larger repercussions. Normally, when an account has been compromised, the user name or password for the account can be reset. A fingerprint in a biometric system serves as the password, so when this information is compromised, the fingerprint cannot be changed (without cosmetic surgery). This means that once an identity is stolen, it has been stolen forever.
		+
		+	'''Dystopia''' - Many science fiction stories have addressed the problem of a society with an entrenched biometric infrastructure. As the technology becomes more widely used for quickly identifying people, more places will be gathering, storing and tracking biometric information. This may put true anonymity in the world in danger of extinction, which would have many political and social repercussions (Watergate would not exist without the anonymous "[http://en.wikipedia.org/wiki/Deep_throat Deep Throat]").
		+
		+
		+	== See Also ==
		+
		+	[http://www.cas.mcmaster.ca/wiki/index.php/Biometric_systems_regarding_security_design_principle Biometric Systems Regarding Security Design Principle]
		+
		+	[http://www.cas.mcmaster.ca/wiki/index.php/Identity_Theft Identity Theft]
		+
		+	[http://www.cas.mcmaster.ca/wiki/index.php/Electronic_Voting_Systems Electronic Voting Systems]
		+
		+	[http://www.cas.mcmaster.ca/wiki/index.php/Payment_Card_Industry_Data_Security_Standard Payment Card Industry Data Security Standard]
		+
		+	[http://www.cas.mcmaster.ca/wiki/index.php/Smart_Card_technology_to_prevent_fraud Smart Card Technology to Prevent Fraud]
		+
		+
		+	==External Links==

-	~~== References ==~~
	[1] http://en.wikipedia.org/wiki/Biometrics		[1] http://en.wikipedia.org/wiki/Biometrics

	[2] http://edition.cnn.com/2007/BUSINESS/07/25/biztrav.iris/index.html		[2] http://edition.cnn.com/2007/BUSINESS/07/25/biztrav.iris/index.html

-	== ~~See Also~~ ==	+	[3] http://www.wescanu.com/
		+
		+
		+
		+	== References ==
		+
		+	- Bishop, Matt. Introduction to Computer Security. Boston: Addison-Wesley, 2006.
		+
		+	- http://en.wikipedia.org/wiki/Biometrics
		+
		+	- http://biometrics.org/
		+
		+	- http://dictionary.reference.com/
		+

-	--[[User:Goesc\|Goesc]] 22:52, 2 December 2007 (EST)	+	--[[User:Goesc\|Goesc]] 12:07, 9 December 2007 (EST)

Goesc at 03:52, 3 December 2007

2007-12-03T03:52:29Z

← Older revision		Revision as of 03:52, 3 December 2007
Line 28:		Line 28:

	== See Also ==		== See Also ==
		+
		+	--[[User:Goesc\|Goesc]] 22:52, 2 December 2007 (EST)

Goesc: New page: [[Image:Airport_Iris_Scan.png|right|thumbnail|250px|By registering their biometric data ahead of time, travelers at Heathrow Airport in London, UK can go through an automated check in, usi...

2007-12-03T01:02:13Z

New page: [[Image:Airport_Iris_Scan.png|right|thumbnail|250px|By registering their biometric data ahead of time, travelers at Heathrow Airport in London, UK can go through an automated check in, usi...

New page

[[Image:Airport_Iris_Scan.png|right|thumbnail|250px|By registering their biometric data ahead of time, travelers at Heathrow Airport in London, UK can go through an automated check in, using [[http://en.wikipedia.org/wiki/Project_IRIS IRIS]]<sup>[2]</sup>]]

The word '''biometric''' originally comes from ancient Greek, “bios” – life + “metron” – measurement<sup>[1]</sup>. The classic definition of biometrics refers to the measurement of biological traits (i.e. the growth rates of bacteria) however this field of study is now referred to as [http://en.wikipedia.org/wiki/Biostatistics Biostatistics]. The contemporary field of biometrics refers to measurements of unique physical or behavioral traits in humans. In the vernacular of information security, biometrics falls mainly under confidentiality and availability because of its applications in identification and authentication.

In the process of biometric authentication, a mathematic model of a measurable trait (see '''Types of Measurements''' below) is converted into a unique signature, similar to the [http://en.wikipedia.org/wiki/Checksum checksum] of a file. This process refers to the identification phase of authentication, where an identity is bound to a subject. When the physical trait is measured again, the same signature should be produced and authentication of the subject is successful.

Despite its wide use as a quick and fairly reliable means of identification (see '''Applications''' below), there remains some criticism over biometric systems. Problems include susceptibility to replay attacks, and identity theft with more permanent consequences than a compromised password (see '''Problems with Biometric Systems''' below).

== Types of Measurements ==

== Applications ==

== Problems with Biometric Systems ==

== References ==
[1] http://en.wikipedia.org/wiki/Biometrics

[2] http://edition.cnn.com/2007/BUSINESS/07/25/biztrav.iris/index.html

== See Also ==