Two-Factor Authentication or How to Potentially Counterfeit Experimental Results in Biometric Systems

Abstract

Abstract. Two-factor authentication has been introduced in order to enhance security in authentication systems. Different factors have been introduced, which are combined for means of controlling access. The increasing demand for high security applications has led to a growing interest in biometrics. As a result several two-factor authentication systems are designed to include biometric authentication.In this work the risk of result distortion during performance evaluations of two-factor authentication systems including biometrics is pointed out. Existing approaches to two-factor biometric authentication systems are analyzed. Based on iris biometrics a case study is presented, which demonstrates the trap of untruly increasing recognition rates by introducing a second authentication factor to a biometric authentication system. Consequently, several requirements for performance evaluations of two-factor biometric authentication systems are stated.

A survey on biometric cryptosystems and cancelable biometrics

“…In contrast, if secret tokens are considered compromised accuracy decreases. Performance is untruly gained if this scenario is ignored during experiments causing even more vulnerable systems in case of compromise [139].…”

“…BioHashing [41] (without key-binding) represents the most popular instance of biometric salting which represents a two-factor authentication scheme [139]. Since additional tokens have to be kept secret [137,157] result reporting turns out to be problematic.…”

A multiple server scheme for fingerprint fuzzy vaults

“…In these approaches, the user has to remember the key, which is used for transformations, and the transformations are determined based on the positions of minutia, their local neighborhoods and the key. Note that although some matching results of enhanced fuzzy vaults appear to be better than the original ones, these can be caused by implicit incorporation of the user specific key into the matching decision [23]. As recommended by [23] we measure the matching performance of our system under the assumption of a stolen user key.…”

“…Note that although some matching results of enhanced fuzzy vaults appear to be better than the original ones, these can be caused by implicit incorporation of the user specific key into the matching decision [23]. As recommended by [23] we measure the matching performance of our system under the assumption of a stolen user key. We also present matching numbers for our two-factor system without a compromised key, though these results come from the unlikeliness of two keys (rather than two templates) matching.…”

The State-of-the-Art in Iris Biometric Cryptosystems

“…In experiments a system which exhibits a GAR of 92% and a FAR of 0.03% is hardened, resulting in a GAR of 90.2% and a FAR of 0.0%. However, if passwords are compromised the systems security decreases to that of a standard one, thus the FAR of 0.0% was calculated under unrealistic preconditions (Rathgeb & Uhl, 2010b). A multi-biometric fuzzy vault based on fingerprint and iris was proposed by Nandakumar and Jain ).…”