D3.10: Biometrics in identity management

Title: BEST PRACTICE: SOME EXAMPLES

Best practice: some examples

If biometrics are stored in central database, such databases will be subject to attacks. Such attacks may have several purposes, including identity theft. Identity theft with the use of biometric information, however, could also occur in other ways, such as theft of traces unknowingly left. In order to cope with this concern, it should be further researched how templates, which are used for a specific application and stored on a local or central place, and which are often linked with other personal data such as name and address, which permit linking of biometric information with a ‘civil’ identity, could be rendered unique by encryption in such way that if the (uniquely) encrypted biometric template is stolen, it could be rendered useless (much like revocation of a PIN). In fact, biometric data cannot be used to secure or to authenticate because it can be intercepted easily. The strength of biometrics could be based on the fact that it provides a convenient piece of unique information which someone always has. However, as it will always remain subject to a risk of misappropriation, it should in a particular system be combined with other authentication information (such as a secret knowledge of an access number), which will reinforce the authentication. The strengthening of the authentication procedure could in fact be considered as a main purpose of use of biometric characteristics in private applications. The use and storage of templates is only a very partial solution as templates can also be stolen, and once stolen, it could still be used by an impostor. Therefore, one area of further research (and standardisation) could be the use of biometrics to secure and authenticate in a reliable way through the use of uniquely encrypted templates, which, once stolen, can be revoked and replaced. This may solve the storage problem of reference tokens, but it does not solve the problem of leakage in the biometric processing from the capture to the comparison component. This could be solved only by making attacks unattractive: decentralisation of critical data, user control and encapsulation of the whole processing into a tamper resistant device.

From an application point of view, a further rule on best practice should be to evaluate the proportionality of the use and the used functionality of the biometric data. Biometrics will in general be used to enhance the security of an application. However, because of the risks associated with biometrics as explained above, in particular also in relation with the type of control that is exercised over the biometric system (central, divided, multilateral), the use of biometric data shall be carefully designed and biometric data will only be used in cases where no other means are available to guarantee the same level of security. Furthermore, for most applications, the verification function of a biometric system will do.