Protected transmission of biometric user authentication data for oncard-matching

Abstract

Since fingerprint data are no secrets but of public nature, the verification data transmitted to a smartcard for oncardmatching need protection by appropriate means in order to assure data origin in the biometric sensor and to prevent bypassing the sensor. For this purpose, the verification data to be transferred to the user smartcard is protected with a cryptographic checksum that is calculated within a separate security module controlled by a tamper resistant card terminal with integrated biometric sensor.

Analysis of a Biometric Authentication Protocol for Signature Creation Application

“…This protocol is presented by Waldmann, Scheuerman and Eckert [1]. The protocol prevents the user's biometric data from escaping from a biometric reader and protects the data packet using a cryptographic mechanism.…”

“…First, the SMC performs mutual authentication with the user card. It is not stated how this is done in [1]; we have used the Needham Schroeder Lowe protocol. If successful, it will calculate session keys (SK.CG and SK.CC) and SSC from the authentication nonces.…”

MOC via TOC Using a Mobile Agent Framework

“…A mutual authentication by establishing a SSL connection between the client and the server is a good solution, but like the PIN, there is always the recurrent problem of where to store the certificate/private key of the client (we don't want to use another smartcard [11] and we want to avoid asking the user for another PIN to unblock this private key).…”

A Novel Hybrid Crypto-Biometric Authentication Scheme for ATM Based Banking Applications

“…Smartcard based fingerprint authentication has been actively studied [4][5][6]. A fingerprint based remote user authentication scheme by storing public elements on a smartcard was proposed, each user can access to his own smartcard by verifying himself using his fingerprint [4].…”

“…A fingerprint based remote user authentication scheme by storing public elements on a smartcard was proposed, each user can access to his own smartcard by verifying himself using his fingerprint [4]. In [5] and [6], the on-card-matching using fingerprint information was proposed. However, these schemes require high resource on the smartcard and the smartcard runs a risk of physical attack.…”