Security of the Lin-Lai smart card based user authentication scheme

The remote user authentication scheme of Lin and Lai, that uses a smart card and a fingerprint measurement, is reviewed and shown to possess significant security issues

Optimization of Three-dimensional Face Recognition Algorithms in Financial Identity Authentication

Identity authentication is one of the most basic components in the computer network world. It is the key technology of information security. It plays an important role in the protection of system and data security. Biometric recognition technology provides a reliable and convenient way for identity authentication. Compared with other biometric recognition technologies, face recognition has become a hot research topic because of its convenience, friendliness and easy acceptance. With the maturity and progress of face recognition technology, its commercial application has become more and more widespread. Internet finance, e-commerce and other asset-related areas have begun to try to use face recognition technology as a means of authentication, so people’s security needs for face recognition systems are also increasing. However, as a biometric recognition system, face recognition system still has inherent security vulnerabilities and faces security threats such as template attack and counterfeit attack. In view of this, this paper studies the application of threedimensional face recognition algorithm in the field of financial identity authentication. On the basis of feature extraction of face information using neural network algorithm, K-L transform is applied to image high-dimensional vector mapping to make face recognition clearer. Thus, the image loss can be reduced

Analysis of Biometric Authentication Protocols in the Blackbox Model

In this paper we analyze different biometric authentication protocols considering an internal adversary. Our contribution takes place at two levels. On the one hand, we introduce a new comprehensive framework that encompasses the various schemes we want to look at. On the other hand, we exhibit actual attacks on recent schemes such as those introduced at ACISP 2007, ACISP 2008, and SPIE 2010, and some others. We follow a blackbox approach in which we consider components that perform operations on the biometric data they contain and where only the input/output behavior of these components is analyzed.Comment: 10 pages, 1 figures, submitted to IEEE Transactions on Information Forensics and Securit

Watermarking techniques for genuine fingerprint authentication.

Fingerprints have been used to authenticate people remotely and allow them access to a system. However, the fingerprint-capture sensor is cracked easily using false fingerprint features constructed from a glass surface. Fake fingerprints, which can be easily obtained by attackers, could cheat the system and this issue remains a challenge in fingerprint-based authentication systems. Thus, a mechanism that can validate the originality of fingerprint samples is desired. Watermarking techniques have been used to enhance the fingerprint-based authentication process, however, none of them have been found to satisfy genuine person verification requirements. This thesis focuses on improving the verification of the genuine fingerprint owner using watermarking techniques. Four research issues are being addressed to achieve the main aim of this thesis. The first research task was to embed watermark into fingerprint images collected from different angles. In verification systems, an acquired fingerprint image is compared with another image, which was stored in the database at the time of enrolment. The displacements and rotations of fingerprint images collected from different angles lead to different sets of minutiae. In this case, the fingerprint-based authentication system operates on the ‘close enough’ matching principle between samples and template. A rejection of genuine samples can occur erroneously in such cases. The process of embedding watermarks into fingerprint samples could make this worse by adding spurious minutiae or corrupting correct minutiae. Therefore, a watermarking method for fingerprint images collected from different angles is proposed. Second, embedding high payload of watermark into fingerprint image and preserving the features of the fingerprint from being affected by the embedded watermark is challenging. In this scenario, embedding multiple watermarks that can be used with fingerprint to authenticate the person is proposed. In the developed multi-watermarks schema, two watermark images of high payloads are embedded into fingerprints without significantly affecting minutiae. Third, the robustness of the watermarking approach against image processing operations is important. The implemented fingerprint watermarking algorithms have been proposed to verify the origin of the fingerprint image; however, they are vulnerable to several modes of image operations that can affect the security level of the authentication system. The embedded watermarks, and the fingerprint features that are used subsequently for authentication purposes, can be damaged. Therefore, the current study has evaluated in detail the robustness of the proposed watermarking methods to the most common image operations. Fourth, mobile biometrics are expected to link the genuine user to a claimed identity in ubiquitous applications, which is a great challenge. Touch-based sensors for capturing fingerprints have been incorporated into mobile phones for user identity authentication. However, an individual fake fingerprint cracking the sensor on the iPhone 5S is a warning that biometrics are only a representation of a person, and are not secure. To make thing worse, the ubiquity of mobile devices leaves much room for adversaries to clone, impersonate or fabricate fake biometric identities and/or mobile devices to defraud systems. Therefore, the integration of multiple identifiers for both the capturing device and its owner into one unique entity is proposed

Bioelectrical User Authentication

There has been tremendous growth of mobile devices, which includes mobile phones, tablets etc. in recent years. The use of mobile phone is more prevalent due to their increasing functionality and capacity. Most of the mobile phones available now are smart phones and better processing capability hence their deployment for processing large volume of information. The information contained in these smart phones need to be protected against unauthorised persons from getting hold of personal data. To verify a legitimate user before accessing the phone information, the user authentication mechanism should be robust enough to meet present security challenge. The present approach for user authentication is cumbersome and fails to consider the human factor. The point of entry mechanism is intrusive which forces users to authenticate always irrespectively of the time interval. The use of biometric is identified as a more reliable method for implementing a transparent and non-intrusive user authentication. Transparent authentication using biometrics provides the opportunity for more convenient and secure authentication over secret-knowledge or token-based approaches. The ability to apply biometrics in a transparent manner improves the authentication security by providing a reliable way for smart phone user authentication. As such, research is required to investigate new modalities that would easily operate within the constraints of a continuous and transparent authentication system. This thesis explores the use of bioelectrical signals and contextual information for non-intrusive approach for authenticating a user of a mobile device. From fusion of bioelectrical signals and context awareness information, three algorithms where created to discriminate subjects with overall Equal Error Rate (EER of 3.4%, 2.04% and 0.27% respectively. Based vii | P a g e on the analysis from the multi-algorithm implementation, a novel architecture is proposed using a multi-algorithm biometric authentication system for authentication a user of a smart phone. The framework is designed to be continuous, transparent with the application of advanced intelligence to further improve the authentication result. With the proposed framework, it removes the inconvenience of password/passphrase etc. memorability, carrying of token or capturing a biometric sample in an intrusive manner. The framework is evaluated through simulation with the application of a voting scheme. The simulation of the voting scheme using majority voting improved to the performance of the combine algorithm (security level 2) to FRR of 22% and FAR of 0%, the Active algorithm (security level 2) to FRR of 14.33% and FAR of 0% while the Non-active algorithm (security level 3) to FRR of 10.33% and FAR of 0%

On the Rila-Mitchell security protocols for biometrics-based cardholder authentication in smartcards

We consider the security of the Rila-Mitchell security protocols recently proposed for biometrics-based smartcard systems. We first present a man-in-the-middle (MITM) attack on one of these protocols and hence show that it fails to achieve mutual authentication between the smartcard and smartcard reader. In particular, a hostile smartcard can trick the reader into believing that it is a legitimate card and vice versa. We also discuss security cautions that if not handled carefully would lead to attacks. We further suggest countermeasures to strengthen the protocols against our attacks, as well as to guard against the cautions highlighted. Our emphasis here is that seemingly secure protocols when implemented with poor choices of parameters would lead to attacks