Cryptographic keys from noisy data : theory and applications

Abstract

Biometric security systems that verify a person's identity by scanning fingers, hands, eye or face are becoming more and more common. As a result biometrics is one of the fastest growing industries. Applications for biometrics range from homeland security (for example the European biometric passport), physical access to various facilities (banks, amusement parks, office buildings, computer terminals, etc) and health and social services.Utilizing biometrics for personal authentication is more convenient and than current methods such as passwords or PINs (nothing to carry or remember). Another important advantage of biometric authentication is that it links events to a user (passwords or token can be lost or stolen) and is becoming socially acceptable and inexpensive. Biometric authentication requires comparing a registered or enrolled biometric sample (biometric template or identifier) against a newly captured biometric sample (for example, a fingerprint captured during a login).However, biometric authentication is not perfect and the output of a biometric authentication system can be subject to errors due to imperfections of the classification algorithm, poor quality of biometric samples, or an intruder who has tampered with the biometric authentication systems. Although biometric authentication is intended primarily to enhance security, storing biometric information in a database introduces new security and privacy risks, which increase if the database is connected to a network. This is the case in most practical situations.The most severe threats are: impersonation, where an attacker steals templates from a database and constructs a synthetic biometric sample that passes authentication; irrevocability, where once compromised, biometrics cannot be updated or reissued; privacy, which is the exposure of sensitive personal information without the consent of the owner. A solution to these threats is to apply templateprotection techniques, which make it hard for an attacker to recover the biometric data from the templates.This thesis looks at security aspects of biometric authentication and proposes solutions to mitigate the risk of an attacker who tries to misuse biometric information or who bypasses modules of biometric systems to achieve his malicious goals. vii Our contribution is threefold. Firstly we propose 3W-tree, an analysis tool used to identify critical attack scenarios for a biometric system. We apply the 3W-tree design tool to the SmartGun biometric recognition system with the purpose of identifying critical security issues. Secondly, we explore the challenges of secure template protection, which are both theoretical and practical and we put forward solutions to part of the issues. Thirdly, we present a practical solution to the secure template transfer, which should allow transfer of the biometric traits between two biometrically enabled devices when no security infrastructure is available and the users are no security experts. viii AcknowledgementsThe last four years were an unforgettable exp...

Biometrics-based Generation of Diffie-hellman Key Exchange Parameters

“…The drawback of these authentication protocols is that they can only authenticate the subject, but they cannot produce the cryptographic keys required for secure communication. The "Secure Ad-hoc Pairing with Biometrics: SAfE" protocol proposed by Buhan et al [10] uses the fuzzy extractor scheme and can be used to establish a secure link between two parties. Unlike many biometrics-based protocols, this protocol does not involve a biometric template database or server.…”

Enhancing Information Security and Privacy by Combining Biometrics with Cryptography

“…The "Secure Ad-hoc Pairing with Biometrics: SAfE" protocol proposed by Buhan et al [30,29] (2007) is a protocol which can be used to establish a secure link between two parties. Keys are obtained from biometrics with the help of the fuzzy extractor scheme.…”

Enhancing Information Security and Privacy by Combining Biometrics with Cryptography

“…Buhan et al [30,29] (2007) is a protocol which can be used to establish a secure link between two parties. Keys are obtained from biometrics with the help of the fuzzy extractor scheme.…”