D5.2b: ID-related Crime: Towards a Common Ground for Interdisciplinary Research

Title: AUTHENTICATION TECHNOLOGIES

Authentication technologies

In the following sub sections we discuss three general technologies that affect authentication in different ways: 

• Biometrics 

• Identity management  

• Trusted platform module  

Biometrics

All biometric authentication systems involve two steps: (a) an enrolment process and (b) a matching process. The first step is the most critical as it involves the binding of the individual to a digital identity. Initially, the person provides evidence of their identity and after the verification of the provided identity against an existing ID document, such as a passport for instance, they present the required biometric information by using a device (camera, scanner, etc). The specific distinctive features presented to the biometric scanner is next parameterized by a function or converted into a mathematical template. The template may be, or should be, encrypted and stored in a database linked to the individual’s identity and/or a smart card (the last one provides a combination of the mentioned methods) and constitutes the reference data to which the respective biometrics data captured during the “matching” phase are compared. 

The enrolment process is substantial for the operation of a biometrics authentication system, and thus preventing identity theft during this process is critical. An identity thief, who may have obtained the necessary identification means for enrolment (for instance a passport), and who, if necessary, has forged some information on this ID (such as replaced the victim’s photograph with one matching the culprit), may enrol his or her own biometrics with the stolen identity before the victim becomes aware of the thief’s activity. This enables the identity thief to claim the victim’s identity.  

ID fraud may be detected during this process due to the uniqueness of many human characteristics. For instance, if the fraudster has already created a true or false identity and attempts to establish a second one through the same enrolment system, using the same biometric information (i.e., face image, fingerprint, iris scan, etc.), the system may detect that the biometric data presented already have been registered and thus notify about this activity.

After enrolment, authentication on the basis of the enrolled biometrics involves the user to provide her biometrics. These will be compared against the reference data stored into the repository. During this process the level of matching is determined taking into account the type of biometric and a threshold for the type of biometric used and the demands of the specific application. These parameters control the False Acceptance Rate (FAR), falsely accepting a biometric as belonging to the person who presents them, and the False Rejection Rate (FRR), falsely rejecting a person as being as being the proper holder of the biometric characteristics. Usually these are controllable parameters, although each technology has its baseline accuracy. An application requiring a high level of security during authentication would require a high threshold value, usually leading to a high FRR, too many people are rejected, whereas an application which includes low risk would be more flexible and would thus settle for a low matching score. The latter usually means a higher FAR; too many people are accepted, including possible imposters. 

As already mentioned in section , biometrics spoofing is a threat biometrics authentication systems should deal with. Especially since biometrics are not generally secret (voice is recorded, facial images can be easily captured, fingerprints are left at any place the persons touches) and there is the limitation of not having the opportunity to change one’s biometrics just like a password and the options are not many (two eyes, ten fingers). Hence anti-spoofing measures need to be implemented.

The performance of a biometrics authentication system – and thus its security - is affected by the accuracy of the technology itself, which varies from very accurate (DNA for instance), to fairly accurate (iris, fingerprints), and the quality of the enrolled biometric features. Enrolments of poor image quality or few biometric features probably raise the need of setting thresholds to rather insecure levels - so that the system performs “acceptably” for the registered persons – increasing its vulnerability in spoof attacks. Hence, enrolments of good quality lead to the optimization of all aspects of performance of a biometrics system. Supervised enrolment by trusted and suitably trained staff can further improve the quality and reliability of the enrolment data.

Systems designers that show no great interest in security (authentication techniques used in the context of entertainment systems for instance), and hence do not invest sufficient amount of money in this area, could reduce the possibility of biometrics spoofing by requiring the provision of multiple biometrics data to the system (for instance the use of 2 or 3 cameras acquiring simultaneously facial images of the person to be authenticated - both frontal and side views), or the combination of biometrics with another means of authentication (smart card, PIN, etc.).  

In cases of need for a high level of security, a supervised - by trained and trusted staff - system is likely to be much harder to spoof and also the risk of being presented false biometric features by the person to be authenticated is smaller. Nevertheless, significant research efforts are invested to make biometrics authentication systems smart in distinguishing between real and fake data provided to them. One example of the promising results of this kind of research is the implementation of checks based on distinguishing real faces from photographed faces by looking for typical reflection patterns of photographic paper in the camera image used for authentication. 

Aiming at preventing spoof attacks with the provision of biometrics from artificial equipment or even cadavers, companies and researchers develop techniques that perform "live-ness checks" - technological countermeasures to spoofing – that must be applied at the same time and place that the biometric features are captured. During these checks one or more checks on responses and measurements take place, such as the presence of pulse, thermal measurement, electrical measurement, etc. Recently, for cameras "live-ness detection" has been developed that makes use of intrinsic facial movements that the camera can "see", capture and analyze, and thus get clues that this is live skin and a live human being (looking for natural facial movements such as the closing and opening of eyelids).

Another anti-spoofing technique is based on an interactive biometrics authentication system with the use of challenge/response. This technique is most often met in voice recognition biometrics systems. The system asks the person to speak a number of words/numbers in random order, so that both the voice features and the order of repetition of the words/numbers can be checked.

Generally, biometric authentication systems strive to make computer systems and networks more secure, by eliminating the risks that follow the use smart cards, PINs and other normal authentication methods. And, as James Childers states: "Security is more than just creating and implementing an impenetrable system… It is a mind-set that every system is penetrable, all solutions are fallible and the only secure system is one that is diligent in its methods, rooted in the fundamentals of secure credential management and uses multiple methods of authentication."

Behavioural biometrics in prevention of ID fraud

Also behavioural characteristics can be used to prevent ID fraud. For instance, keystroke dynamics can be used for authentication purposes, as every user has unique typing characteristics on computer keyboards: the keystroke latencies – including the time intervals between keystrokes, hold times, typing error frequency and force keystrokes – form a digital signature of the user. This technology is based on the detection of an individual’s typing patterns on a keyboard and their comparison against patterns previously enrolled.

The main application of this biometric is in protecting passwords; in other words, in providing greater assurance that a password was actually typed by the person who enrolled it. As passwords can be guessed or stolen, their protection can be enhanced by this relatively simple: timing information concerning the user’s typing of their password as well as the password itself is logged by the system, and thus a newly entered password is classified by a pattern recognition system as matching or differing from the logged timing patterns. In this way any application able to reliably measure the timing of a user’s typing can also try to perform identification or verification of the user. This behavioural biometric can provide protection against external and internal attackers. Protection against internal attackers (within a given system) can be achieved through the encryption of the passwords stored in the database with the person’s biometrics – in this case the keystroke dynamics measurements during the password typing of the person owning the password. In online settings (external) the measurement of the typing characteristics has to be done on the client side. This possibly introduces inaccuracies due to dependency on the user’s hardware in an uncontrolled environment and hence introduces its own type of vulnerability: spoofing typing behaviour.

Physiological biometrics in prevention of ID theft

Facial recognition is among the primary human perceptual capabilities. An authentication system based on computerized facial recognition offers advantages, such as low cost, unobtrusiveness, easy access (the face is something you are never without!). The commonly accepted approaches use the eigenfaces or geometric transformations to perform the human identification task. However, the main drawback of these techniques is their demand in computational resources, which can be a limiting factor for real-time applications.

Face recognition systems attempt to perform measurements of some nodal points on the face (the distance between the eyes, the distance from eye to mouth, the width of the nose, etc) or use appearance-based classifiers. The presence of occluded faces/bodies, complex background and foreground, moving background, complex human movement, varying lighting conditions or strong resemblance between two people (e.g. twins) are factors that make the human detection, localization and identification processes a difficult, and thus challenging task. The enrichment of the human identification process with human body modelling information and the use of a stereoscopic camera system can lead to the improvement of the performance of these processes in complicated situations. A major advantage of face recognition technology is that the hardware required (a camera) is relatively simple compared to other kinds of biometric devices, and thus it may be added to any existing surveillance or multimedia system.

The reinforcement of security in mobile devices through face authentication of the owner of the device is an example of application of this biometric in preventing identity theft. Given the fact that the functionality of mobile devices has been enriched with a variety of new services, including personal data, such as address book, payment data, and schedules, increase the value of these devices for culprits, and hence the threats of identity theft increase. The protection of the information held by these devices has become essential. Camera equipped mobile devices can be supplemented with facial recognition software to increase their security.

Biometrics as explained in the preceding chapter, itself has vulnerabilities, and hence are not sufficient in their own right. Biometric technology can best be used in combination with other biometrics or with traditional security methods (passwords, identity cards, smart cards, etc). A smart card can be used to store all types of data; however it is mainly used to store encrypted data, human resources data, medical data, financial data, and biometric data.