Digital Identity & Authentication Directions Biometric Applications Who is doing what? Academia, Industry, Government

Transcription

1 Digital Identity & Authentication Directions Biometric Applications Who is doing what? Academia, Industry, Government Briefing W. Frisch 1

2 Outline Digital Identity Management Identity Theft Management Digital Forensics Digital Watermarking Risk Analysis Economic Analysis Secure Electronic Voting Machines Biometrics Other Applications Lecture on Introduction to Biometrics 2

3 Digital Identity Management Digital identity is the identity that a user has to access an electronic resource A person could have multiple identities A physician could have an identity to access medical resources and another to access his bank accounts Digital identity management is about managing the multiple identities Manage databases that store and retrieve identities Resolve conflicts and heterogeneity Make associations Provide security Ontology management for identity management is an emerging research area 3

4 Digital Identity Management - II Federated Identity Management Corporations work with each other across organizational boundaries with the concept of federated identity Each corporation has its own identity and may belong to multiple federations Individual identity management within an organization and federated identity management across organizations Technologies for identity management Database management, data mining, ontology management, federated computing 4

5 Identity Theft Management Need for secure identity management Ease the burden of managing numerous identities Prevent misuse of identity: preventing identity theft Identity theft is stealing another person s digital identity Techniques for preventing identity thefts include Access control, Encryption, Digital Signatures A merchant encrypts the data and signs with the public key of the recipient Recipient decrypts with his private key 5

6 Digital Forensics Digital forensics is about the investigation of Cyber crime Follows the procedures established for Forensic medicine The steps include the following: When a computer crime occurs, law enforcement officials who are cyber crime experts gather every piece of evidence including information from the crime scene (i.e. from the computer) Gather profiles of terrorists Use history information Carry pout analysis 6

7 Digital Forensics - II Digital Forensics Techniques Intrusion detection Data Mining Analyzing log files Use criminal profiling and develop a psychological profiling Analyze messages Lawyers, Psychologists, Sociologists, Crime investigators and Technologists have to worm together International Journal of Digital Evidence is a useful source 7

8 Steganography and Digital Watermarking Steganography is about hiding information within other information E.g., hidden information is the message that terrorist may be sending to their pees in different parts of the worlds Information may be hidden in valid texts, images, films etc. Difficult to be detected by the unsuspecting human Steganalysis is about developing techniques that can analyze text, images, video and detect hidden messages May use data mining techniques to detect hidden patters Steganograophy makes the task of the Cyber crime expert difficult as he/she ahs to analyze for hidden information Communication protocols are being developed 8

9 Steganography and Digital Watermarking - II Digital water marking is about inserting information without being detected for valid purposes It has applications in copyright protection A manufacturer may use digital watermarking to copyright a particular music or video without being noticed When music is copies and copyright is violated, one can detect two the real owner is by examining the copyright embedded in the music or video 9

10 Risk Analysis Analyzing risks Before installing a secure system or a network one needs to conduct a risk analysis study What are the threats? What are the risks? Various types of risk analysis methods Quantitative approach: Events are ranked in the order of risks and decisions are made based on then risks Qualitative approach: estimates are used for risks 10

11 Economics Analysis Security vs Cost If risks are high and damage is significant then it may be worth the cost of incorporating security If risks and damage are not high, then security may be an additional cost burden Economists and technologists need to work together Develop cost models Cost vs. Risk/Threat study 11

12 Secure Electronic Voting Machines We are slowly migrating to electronic voting machines Current electronic machines have many security vulnerabilities A person can log into the system multiple times from different parts of the country and cast his/her vote Insufficient techniques for ensuring that a person can vote only once The systems may be attacked and compromised Solutions are being developed Johns Hopkins University is one of the leaders in the field of secure electronic voting machines 12

13 Biometrics Early Identication and Authentication (I&A) systems, were based on passwords Recently physical characteristics of a person are being sued for identification Fingerprinting Facial features Iris scans Blood circulation Facial expressions Biometrics techniques will provide access not only to computers but also to building and homes Other Applications 13

14 Biometric Technologies Pattern recognition Machine learning Statistical reasoning Multimedia/Image processing and management Managing biometric databases Information retrieval Pattern matching Searching Ontology management Data mining 14

15 Data Mining for Biometrics Determine the data to be analyzed Data may be stored in biometric databases Data may be text, images, video, etc. Data may be grouped using classification techniques As new data arrives determine the group this data belongs to Pattern matching, Classification Determine what the new data is depending on the prior examples and experiments Determine whether the new data is abnormal or normal behavior Challenge: False positives, False negatives 15

16 Secure Biometrics Biometrics systems have to be secure Need to study the attacks for biometrics systems Facial features may be modified: E.g., One can access by inserting another person s features Attacks on biometric databases is a major concern Challenge is to develop a secure biometric systems 16

17 Secure Biometrics - II Security policy for as biometric system Application specific and applicatyion independent policies Security constraints Security model for a biometrics systems Determine the operations to be performed Need to include both text, images and video/animation Architecure foe a biometric system Need to idenify securiy critical components Reference monitor Detecting intrusions in a biometric system 17

18 Other Applications security Encryption Filtering Data mining Benchmarking Benchmarks for secure queries and transactions Simulation and performance studies Security for machine translation and text summarization Covert channel analysis Robotics security Need to ensure policies are enforced correctly when operating robots 18

19 Introduction to Biometrics 19

20 Outline Introduction to Biometrics What is Biometrics? What is the Process? Why Biometrics? Biometrics Resources What is Secure Biometrics Revisiting Topics to be covered Some exploratory research areas Some useful reference books 20

21 What is Biometrics? Biometrics are automated methods of recognizing a person based on a physiological or behavioral characteristic Features measured: Face, Fingerprints, Hand geometry, handwriting, Iris, Retinal, Vein and Voice Identification and personal certification solutions for highly secure applications Numerous applications: medical, financial, child care, computer access etc. 21

22 What is the Process? Three-steps: Capture-Process-Verification Capture: A raw biometric is captured by a sensing device such as fingerprint scanner or video camera Process: The distinguishing characteristics are extracted from the raw biometrics sample and converted into a processed biometric identifier record Called biometric sample or template Verification and Identification Matching the enrolled biometric sample against a single record; is the person really what he claims to be? Matching a biometric sample against a database of identifiers 22

23 Why Biometrics? Biometrics replaces Traditional Authentication Methods Provides better security More convenient Better accountability Applications on Fraud detection and Fraud deterrence Dual purpose Cyber Security and National Security 23

24 Why Biometrics? (Continued) Authentication mechanisms often used are User ID and Passwords However password mechanisms have vulnerabilities Stealing passwords etc. Biometrics systems are less prone to attacks Need sophisticated techniques for attacks Cannot steal facial features and fingerprints Need sophisticated image processing techniques for modifying facial features 24

25 Why Biometrics? (Continued) Biometrics systems are more convenient Need not have multiple passwords or difficult passwords E.g., characters, numbers and special symbols Need not remember passwords Need not carry any cards or tokens Better accountability Can determine who accessed the system with less complexity 25

26 Why Biometrics? (Concluded) Dual Purpose Cyber Security and National Security Access to computer systems and networks Fraud detection Who has intruded the system? Who has entered the building Surveillance and monitoring Fraud Deterrence Because of biometrics systems, people are nervous to commit crimes Stealing from supermarkets and shops, etc. 26

27 Biometrics Resources Biometrics Consortium is the major resource Another Resource Has Information on Who is doing what Academia, Industry and Government White papers on Biometrics technologies Fingerprint detection, facial recognition, Iris scanning,

28 Biometrics Resources: What is academia doing? Michigan State University Developing algorithms for fingerprint detection, etc. West Virginia University Forensic identification initiative San Jose State University Mathematical concepts 28

29 Biometrics Resources: What is Industry doing? Focus is on building faster and cheaper devices More accuracy, less false positives and negatives Incorporating biometrics into mobile devices, Smartcards Biometrics in healthcare: delivering medication to correct patients Biometrics in child care: Children are picked up by those authorized Protecting digital content Ensuring that voice and video are not altered Vendors: 29

30 Biometrics Resources: What is Government doing? NSA (National Security Agency) Research on protecting critical information systems DoD (Department of Defense) Biometrics Management Office Provide Armed forces access to Biometrics systems for combat operations INS/DHS (Department of Homeland Security; Immigration and Nationalization Service) Biometrics technologies at Airports NIST (National Institute of Standards and Technologies) Major player in Biometrics 30

31 Activities of NIST Measurements, Testing and Standards is NIST s mission Focus on Biometrics Standards Activities Biometrics Consortium Common Biometric Exchange File Format Biometric Interoperability, Performance and Assurance Working Group BioAPI Consortium Various Standards 31

32 Activities of NIST (Continued) Biometrics Consortium is the Government focal point for research, development and testing of Biometric products and technologies Common Biometric Exchange File Format is a product of the consortium to develop common fingerprint template formats Biometrics Interoperability working group promotes common definitions and concepts for exchanging information between national and international partners BioAPI consortium develops common Application Programming Interfaces for biometrics technologies 32

33 Activities of NIST (Concluded) NIST is developing standards for the following: Finger image format for data Interchange Face image format for data interchange Iris image format for data interchange Signature image format for data interchange NIST is working with International standards organizations for joint standards ISO (International Standards Organization) 33

34 What is Secure Biometrics? Study the attacks of biometrics systems Modifying fingerprints Modifying facial features Develop a security policy and model for the system Application independent and Application specific policies Enforce Security constraints Entire face is classified but the nose can be displayed Develop a formal model Formalize the policy Design the system and identify security critical components Reference monitor for biometrics systems 34

35 Security Vulnerabilities Type 1 attack: present fake biometric such a synthetic biometric Type 2 attack: Submit a previously intercepted biometric data: replay Type 3 attack: Compromising the feature extractor module to give results desired by attacker Type 4 attack: Replace the genuine feature values produced by the system by fake values desired by attacker Type 5 attack: Produce a high number of matching results Type 6 attack: Attack the template database: add templates, modify templates etc. 35

36 Security and Privacy for Biometrics Privacy of the Individuals have to be protected CNN News Release: August 29, 2005 Distorting Biometrics Enhances Security and Privacy Biometric data converted to numerical strings by mathematical algorithm for later use If the mathematical templates are stolen could be dangerous Researchers have developed method to alter the images in a defined and repeated way Hackers steal the distortion not the original face or fingerprint 36