Factors Influencing the Adoption of Biometric Authentication in Mobile Government Security

Transcription

1 Factors Influencing the Adoption of Biometric Authentication in Mobile Government Security Thamer Omar Alhussain Bachelor of Computing, Master of ICT School of Information and Communication Technology Science, Environment, Engineering and Technology Group Griffith University Submitted in fulfilment of the requirements of the degree of Doctor of Philosophy June 2011

2 Abstract ABSTRACT This dissertation presents a new substantive theory that identifies and describes the factors that influence the adoption of biometrics in the security of m-government applications. The developed theory is specific to a particular context and area of the application of biometric authentication into mobile devices for government services in the Kingdom of Saudi Arabia (KSA). Given the continuing growth of mobile phone and Internet services, this dissertation is significant since it adds to current knowledge on how biometric authentication can play an integral role in providing secure m- government services. More specifically, this dissertation provides rich insight into understanding the adoption factors based on the concerns and perceptions of users, service providers, and network operators regarding the application of biometric authentication to mobile devices for government services. This dissertation is theoretically significant, because while the weakness of the current authentication method in mobile devices introduces additional demands to ensure that advanced authentication methods are used, no known research exists on the adoption of biometric authentication in mobile devices for government services, especially in Saudi Arabia. This dissertation addresses the gap in the literature by presenting an empirical study based on an analysis of the concerns and perceptions of mobile communication users, service providers, and mobile network operators regarding the application of biometric authentication to mobile devices for m-government services in Saudi Arabia. The research presented in this dissertation is based on the interpretivist paradigm of research which assumes that people generate their own subjective and intersubjective meanings about the world as they socially interact with the world around them. This interpretivist paradigm of research is carried out by the use of grounded theory methodology. Data collection processes include a questionnaire and semi-structured interviews. In particular, eleven face-to-face semi-structured interviews were conducted with the managers of online services and the IT security managers of mobile e-government service providers. Four semi-structured interviews were also conducted with managers and IT security providers in mobile communication network services. In addition, a survey questionnaire was distributed to mobile communication Page i

3 Abstract users in order to collect larger amounts of data on the users concerns and perceptions in a shorter time scale than would have been possible with interviewing mobile phone users. A total of 311 questionnaires with a response rate of 74% was included in this study and subjected to statistical analysis and procedures. As concepts and categories were developed based on the questionnaire results, the results were also involved in the application of grounded theory. The main findings presented in this dissertation consist of the development of a substantive theory for the adoption of biometric authentication for m-government applications in Saudi Arabia. These findings indicate that acceptance factors include relative advantage, compatibility, ease of use, trialability, observability, trust, and privacy, as well as contributory factors involving availability, awareness, legislation, economical aspects, and social and cultural aspects, which are the most important factors that will enable the KSA in achieving the adoption of biometric authentication in m-government security. The dissertation also identifies several needs, perceptions, and concerns of mobile phone users, service providers, network operators as well as system factors including requirements and procedural issues regarding the application of biometrics in m-government security. Furthermore, the analysis in this dissertation reveals a number of technical and non-technical challenges that would influence the adoption of biometrics in m-government. The identified technical challenges include infrastructure, growing a biometrics database, making mobile devices with biometric attachments available around the country, integrating biometrics along with a Public Key Infrastructure (PKI) in the smartcards of the mobile device, theft and penetrating possibility of biometric capture, and dealing with authentication errors in the system. The non-technical challenges include financial issues, registration and enrolment processes, lack of IT experts in the KSA, and lack of current relevant research. In this dissertation, a substantive theory is developed to explain the factors influencing the adoption of biometrics in m-government in Saudi Arabia. Therefore, the conclusions do not claim to be widely generalizable as the research is limited to a particular context and specific geographical area. However, future research in other geographical areas with different cultural backgrounds is recommended, as a number of substantive theories can help to create more general formal theory. This dissertation contributes to current knowledge by identifying and describing the factors that influence the adoption of biometric authentication in m-government Page ii

4 Abstract applications in the Saudi Arabian context. It improves understanding about the concerns and perceptions of mobile phone users, service providers, and network operators regarding the application of biometric authentication to mobile devices for government services. It further discovers the reasons why mobile communication users prefer the use of biometric authentication in their mobile devices to conduct government services. Moreover, it identifies the needs and requirements for service providers to adopt the use of biometrics for m-government services. In addition, this dissertation provides decision-makers with practical information regarding an appropriate authentication approach for the security of m-government services, as well as information on how biometric technology can be adopted for m-government applications. The practical contribution includes the design of an authentication system, based on the requirements of service providers and network providers, as appropriate for applying biometric technology in m-government security. Keywords M-government, biometric, authentication, adoption, qualitative study, grounded theory, Saudi Arabia. Page iii

5 Statement of Originality STATEMENT OF ORIGINALITY This work has not previously been submitted for a degree or diploma in any university. To the best of my knowledge and belief, the dissertation contains no material previously published or written by another person except where due reference is made in the thesis itself. Page iv

6 Acknowledgments ACKNOWLEDGEMENTS After sincerely thanking Allah for all blessings and for giving me the ability to fulfil this research, I would like to thank all the people who provided me with their assistance, support and guidance. First of all, I truly appreciate and wish to acknowledge my father and my mother for their enormous efforts and sacrifices to help, encourage, and support me. I would also like to express my deep gratitude to my wife and my son Omar. I am grateful to my wife for her kind encouragement and for marvellously providing the convenient atmosphere for me to complete my research. In addition, I would like to express my sincere gratitude and appreciation to my principal supervisor, Dr. Steve Drew, for his kind and valuable advice. His great help and positive support guided me immensely to accomplish my research. I would like to genuinely thank my Associate Supervisor, Associate Professor Liisa von Hellens, for her guidance, encouragement, and support along the way. I would also like to thank the Griffith School of Information and Communication Technology, in particular staff members and my PhD colleagues who provided me with useful knowledge throughout my academic journey. Finally, I would like to express my grateful thanks to my brothers and sisters and all my friends who supported me throughout this research, motivated me through their kind advice and encouraged me to pursue this degree. Page v

7 Publications PUBLICATIONS Based on this PhD dissertation, a number of peer-reviewed papers were produced as the follows. Journal Publications Alhussain, T and Drew, S 2010, Employees' Perceptions of Biometric Technology Adoption in E-Government: An Exploratory Study in the Kingdom of Saudi Arabia, International Journal of E-Adoption (IJEA), IGI Global, vol. 2, no. 1, pp Book Chapters Alhussain, T and Drew, S 2012, Developing a Theoretical Framework for the Adoption of Biometrics in M-Government Applications Using Grounded Theory, Information System, Kalloniatis, C (ed), InTech. ISBN Accepted Conference Papers Alhussain, T, Drew, S and von Hellens, L 2010, Qualitative Study on Implementing Biometric Technology in M-Government Security: a Grounded Theory Approach, 5th International Conference on Qualitative Research in IT & IT in Qualitative Research (QualIT2010), November 29-30, 2010 Brisbane, Australia. ISBN: Alhussain, T and Drew, S 2010, Towards Secure M-Government Applications: A survey study in the Kingdom of Saudi Arabia, International Conference on Intelligent Network and Computing (ICINC 2010), November 26-28, 2010, Kuala Lumpur, Malaysia. ISBN: Alhussain, T, Drew S and Alfarraj, O 2010, Biometric Authentication for Mobile Government Security, An application of grounded theory, 2010 IEEE International Conference on Intelligent Computing and Intelligent Systems (ICIS 2010), October 29-31, 2010, Xiamen, China, pp ISBN: Alhussain, T and Drew, S 2009, Towards User Acceptance of Biometric Technology in E-Government: A Survey Study in the Kingdom of Saudi Arabia, Software Services for e-business and e-society, IFIP Advances in Information and Communication Technology, Vol. 305, Springer, pp Page vi

8 Table of Contents TABLE OF CONTENTS ABSTRACT... i STATEMENT OF ORIGINALITY... iv ACKNOWLEDGEMENTS...v PUBLICATIONS... vi TABLE OF CONTENTS... vii LIST OF FIGURES... xii LIST OF TABLES... xiii CHAPTER ONE: INTRODUCTION Introduction Research Aims and Questions Research Approach and Method Research Contributions Justification for and Significance of the Research Outline of the Dissertation...9 CHAPTER TWO: LITERATURE REVIEW Introduction Electronic and Mobile Government M-Government Applications M-Government Benefits M-Government Requirements M-Government Challenges Information Security and M-Government Information Assurance Authentication Strategies Security for Mobile Devices Security for Network Operators Security for Service Providers Security for Users The Current Authentication System in M-Government Biometrics as a Security Solution...26 Page vii

9 Table of Contents 2.4 Overview of Biometric Technology Biometric Systems Performance Measures Properties of Biometrics Application Areas of Biometrics Types of Biometric Technology Disadvantages of Biometric Technology Privacy Concerns about the Use of Biometric Technology Information and Communication Technology in the Kingdom of Saudi Arabia Information on National Planning in the KSA E-Government in the Kingdom of Saudi Arabia Government Electronic Transactions System (Yesser) M-Government Applications in the KSA Locating this Dissertation Users Service Providers Network Operators Conclusion...50 CHAPTER THREE: ADOPTION OF TECHNOLOGY Introduction Current Biometric Applications Biometrics in E-Government The Use of Biometrics in the KSA Factors Influencing Adoption of Technology Technology Acceptance Model Unified Theory of Acceptance and Use of Technology Diffusion of Innovation Adoption Factors among Empirical Studies Biometric Adoption among Empirical Studies Related Issues to the Adoption of Biometrics in M-Government Comparing Biometrics for Mobile Devices Biometrics in Mobile Devices Biometrics and M-Government...63 Page viii

10 Table of Contents Public Key Infrastructure (PKI) Social and Cultural Aspects Summary of the most Relevant Literature Conclusion...68 CHAPTER FOUR: RESEARCH METHODOLOGY Introduction Research Questions and Outcomes Research Paradigm Research Assumptions Social Informatics Data Collection Techniques Interviews of Service Providers and Network Operators Questionnaire for Mobile Communication Users Method of Sampling Pilot Study Data Analysis Techniques Grounded Theory Substantive and Formal Theory Justification for Using Grounded Theory Application of the Grounded Theory Critique of Grounded Theory Rigor, Validity, and Reliability Ethical Consideration Conclusion...90 CHAPTER FIVE: SURVEY FINDINGS Introduction Survey Data of Mobile Phone Users Demographics of the Survey Participants ICT Experience Mobile Device and Government Services Mobile Device Security Biometrics and Mobile Government Services Page ix

11 Table of Contents 5.3 Distinguishing Survey Responses Based on Gender Exploring Relationships among Mobile Phone Users Perceptions Correlation between the Loss of Mobile Device and the Preferred Method of M-Government Authentication Correlation between the Risk of Disclosure of Personal Information and the Preferred Authentication Method of M-Government Correlation between the Risk of Disclosure of Personal Information and the Willingness to Pay more Money to have Biometrics in the Mobile Device Correlation between the Experience of Using Biometric Authentication and the Preferred Authentication Method of M-Government Correlation between the Importance of the Information Stored in a Mobile Device and the Preferred Authentication Method for a Mobile Device Correlation between the Importance of the Information Stored in a Mobile Device and the Consideration of Applying Biometrics to Protect the Information in a Mobile Device Correlation between the Trust in Biometrics and the Reasons for not Conducting any Government Service via a Mobile Device Conclusion CHAPTER SIX: GROUNDED THEORY DATA ANALYSIS Introduction Process and Procedure of Grounded Theory Open Coding Axial Coding Selective Coding Conclusion CHAPTER SEVEN: FACTORS INFLUENCING THE ADOPTION OF BIOMETRIC AUTHENTICATION IN M-GOVERNMENT Introduction Entities Factors Organisational Factors Users Factors System Factors Enabling Factors Acceptance Factors Contributory Factors Challenges Page x

12 Table of Contents Technical Challenges Other Related Challenges Conclusion CHAPTER EIGHT: THEORETICAL FRAMEWORK FOR THE ADOPTION OF BIOMETRIC AUTHENTICATION IN M-GOVERNMENT Introduction The Theoretical Framework Integrating Biometric Systems in M-Government Integrating Biometrics into Mobile Devices Authentication System for Biometrics in M-Government Issues for Consideration Conclusion CHAPTER NINE: CONCLUSIONS Introduction Fulfilment of Research Objectives Considerations for the Adoption of Biometrics in M-Government Contribution to Knowledge Theoretical Contribution Methodological Contribution Practical Contribution Evaluation of the Research Limitations Future Research Conclusion REFERENCES Appendix A: List of Open Codes Appendix B: Distinguishing Survey Data Based on Gender Appendix C: Interview Guide for Service Providers Appendix D: Interview Guide for Network Operators Appendix E: Questionnaire (English version) Appendix F: Questionnaire (Arabic version) Appendix G: Ethical Clearance Certificate Appendix H: Glossary of Terms Page xi

13 List of Figures LIST OF FIGURES Figure 1: McCumber INFOSEC Model (1991)...19 Figure 2: Information Assurance Model...20 Figure 4: Iris recognition...32 Figure 5: Hand recognition...33 Figure 6: The Saudi e-government program (Yesser)...42 Figure 7: Saudi Mobile Service Market Growth...46 Figure 8: Saudi Internet users...46 Figure 10: Technology Acceptance Model...57 Figure 11: Unified Theory of Acceptance and Use of Technology...58 Figure 12: Mobile AFIS...63 Page xii

14 List of Tables LIST OF TABLES Table 1: Summary of the most relevant literature on the research topic...68 Table 2: The links between research outcomes, techniques and questions...72 Table 3: Demographics...93 Table 4: ICT Experience...96 Table 5: Mobile Device and Government Services...99 Table 6: Mobile Device Security Table 7: Biometrics and Mobile Government Services Table 8: Correlation between the loss of a mobile device and the preferred method of m-government authentication Table 9: Correlation between the risk of disclosure of personal information and the preferred authentication method of m-government Table 10: Correlation between the risk of disclosure of personal information and the willingness to pay more money to have biometrics in the mobile device Table 11: Correlation between the experience of using biometric authentication and the preferred authentication method of m-government Table 12: Correlation between the importance of the information stored in a mobile device and the preferred authentication method for a mobile device Table 13: Correlation between the importance of the information stored in a mobile device and the opinion of applying biometrics to protect the information in a mobile device Table 14: Frequency for the trust in biometrics in m-government security and the reasons for not conducting any government service via a mobile device Table 15: Axial codes Page xiii