D3.10: Biometrics in identity management

Title: FIDIS FINDINGS ON BIOMETRICS

Biometric systems have been treated as secondary topic in previous FIDIS deliverables which had their main focus on other themes. This deliverable builds upon the findings relating to biometrics in these FIDIS deliverables, in particular D3.2 and D3.6. First of all, basic terminology and biometric methods were introduced in the FIDIS deliverable 3.2, ‘A Study on PKI and Biometrics’. This deliverable also analysed legal principles relevant for the use of biometrics and for the resulting technical and organisational privacy aspects. In the FIDIS deliverable 3.6, ‘Study on ID Documents’, the use of biometrics in the context of Machine Readable Travel Documents (MRTDs) has been analysed with respect to security and privacy. This work also included a description of ISO standards for biometric raw data and templates concerning machine readable travel documents. Readers of this document are hence advised to also consult D3.2 and D3.6 which can be downloaded from the FIDIS website.

Both of the aforementioned reports discussed biometrics in a rather specific context, i.e. the use of biometrics in a Public Key Infrastructure (PKI) and the inclusion of biometrics in MRTDs. The aim of this document is to continue and update the analysis made in the previous documents, and to study in depth certain specific aspects of biometrics, such as quality factors of biometrics (in particular biometric system errors) and the uncertainty about health related information contained in biometric systems. It also attempts to place biometrics and its use in a broader context, i.e. in the context of specific public and private applications, from government controlled ID applications to purely private convenience applications, proposing hereby a classification of biometric systems which is useful for further discussions.  

This deliverable is also linked with the research on concepts of identity management done in FIDIS. Biometrics are often used for enhancing security and convenience of the authentication and authorisation of individuals, for example, to use a travel document, or to access a building. If we look at the overview of the types of identity management systems as developed in FIDIS deliverable 3.1 ‘Structured Overview on Prototypes and Concepts of Identity Management Systems’, we could reasonably say that biometrics can play a role in all three types of systems. It is likely that biometrics would most often be used in a Type 1 IMS for account management. This type of identity management system is designed to enhance the authentication, the authorisation and the accountability of an individual. Behavioural biometrics, i.e. the use of behavioural characteristics in biometric systems which may or may not identify a person and which will not be discussed in depth in this deliverable could probably also be used in a Type 2 IMS for profiling of user data. This type of identity management system analyses customer behaviour or supports personalised services to individuals. Finally, as the strict borders between the types of IMS are disappearing, it is correct to say that biometrics will also emerge in a Type 3 IMS for user-controlled context-dependent role and pseudonym management. In this type of identity management system, the use of biometrics may protect the access to personal identity assistants and therefore provide a valuable advantage for the individual who seeks privacy protection.