 |
|
BioVault locks up biometrics
July 31, 2009Using biometrics for encryption, digital signatures
A system that allows biometric data to be used to create a secret key for data encryption has been developed by researchers in South Africa. They describe details of the new technology in the International Journal of Electronic Security and Digital Forensics this month.
If a user, a web customer say, wishes to send a message or other data to another user, an online shop, over an unsecured network, the message must be encrypted to avoid interception of sensitive information such as passwords and credit card information.
Encryption relies on authentication being symmetric to work. In other words, the user's password or PIN must match the password or PIN stored by the online shop to lock and unlock the data. This is because encryption systems use the password or PIN to produce, or seed, a random number that is used as the cipher for encrypting the data. If the passwords do not match exactly then the seed will be incorrect, the random number different and the decryption will fail.
One way to avoid users having to remember endless, complicated passwords is to use biometrics, including fingerprints, iris pattern, face recognition. However, biometrics is not a symmetric process. The initial recording of biometric data samples only a limited amount of the information, the pigment patter in one's iris, for instance. The unlocking process then compares the iris pattern, or other biometric "token", being presented for access with the sample stored in the database. If the match is close enough, the user can gain entry.
The reason for this asymmetry is that any biometric system takes only a digital sample of data from the fingerprint or iris, for instance. Moreover, even the legitimate user will not be able to present exactly the same biometric data repeatedly. The close enough aspect of biometrics does not make biometrics insecure, provided that the closeness is very precise, but it does mean that biometric tokens cannot be used to create a secret key for an encryption algorithm.
Bobby Tait and Basie von Solms of the University of Johannesburg, Gauteng, South Africa, explain how biometrics can nevertheless be used to make a consistent secret key for encryption.
In conventional encryption, if Alice wishes to send a secret message to Bill, then she must encrypt the message, whether it is an email or credit card details transmitted from her computer to the online shop. In order for the encryption algorithm to provide cipher text that is random, a secret key must be provided. Alice and Bill must share exact copies of their secret key for this to work.
Aside from the asymmetry in biometrics, this approach will not work because Alice and Bill cannot provide the same biometric token to encrypt and decrypt the message. Now, Tait and von Solms have used the so-called BioVault infrastructure to provide a safe and secure way for Alice and Bill to share biometric tokens and so use their fingerprints, iris pattern, or other biometric to encrypt and decrypt their data without their biometrics being intercepted.
The BioVault encryption system works as follows:
In phase 1, Alice identifies herself to the authentication server, and indicates that she wants to send an encrypted message to Bill and requests Bill's biometric key from the server.
In phase 2, the server retrieves a random biometric key from Bill's stored biometric keys.
In phase 3, Alice uses the biometric key to encrypt her message and sends it to Bill.
In phase 4, Bill receives the message sent by Alice, and decrypts the message by testing the biometric keys in his database against the received cipher text.
The fact that each biometric key (data) is unique means that the BioVault system can irrevocably identify and authenticate users through their biometric keys (data) and detect fraudulent use of biometric keys.
Tait adds that the same approach could also be used to digitally sign electronic documents, files, or software executables using biometrics. He will be presenting the team's results on this aspect of their work in the UK at the beginning of September. "If passwords or tokens are used for authentication, only the password or token is proven as authentic - not the user that supplied the token or password," he explains, "Biometrics authenticates the user directly - this was one of the drivers behind the BioVault development."
Inderscience Publishers
Encryption relies on authentication being symmetric to work. In other words, the user's password or PIN must match the password or PIN stored by the online shop to lock and unlock the data. This is because encryption systems use the password or PIN to produce, or seed, a random number that is used as the cipher for encrypting the data. If the passwords do not match exactly then the seed will be incorrect, the random number different and the decryption will fail.
One way to avoid users having to remember endless, complicated passwords is to use biometrics, including fingerprints, iris pattern, face recognition. However, biometrics is not a symmetric process. The initial recording of biometric data samples only a limited amount of the information, the pigment patter in one's iris, for instance. The unlocking process then compares the iris pattern, or other biometric "token", being presented for access with the sample stored in the database. If the match is close enough, the user can gain entry.
The reason for this asymmetry is that any biometric system takes only a digital sample of data from the fingerprint or iris, for instance. Moreover, even the legitimate user will not be able to present exactly the same biometric data repeatedly. The close enough aspect of biometrics does not make biometrics insecure, provided that the closeness is very precise, but it does mean that biometric tokens cannot be used to create a secret key for an encryption algorithm.
Bobby Tait and Basie von Solms of the University of Johannesburg, Gauteng, South Africa, explain how biometrics can nevertheless be used to make a consistent secret key for encryption.
In conventional encryption, if Alice wishes to send a secret message to Bill, then she must encrypt the message, whether it is an email or credit card details transmitted from her computer to the online shop. In order for the encryption algorithm to provide cipher text that is random, a secret key must be provided. Alice and Bill must share exact copies of their secret key for this to work.
Aside from the asymmetry in biometrics, this approach will not work because Alice and Bill cannot provide the same biometric token to encrypt and decrypt the message. Now, Tait and von Solms have used the so-called BioVault infrastructure to provide a safe and secure way for Alice and Bill to share biometric tokens and so use their fingerprints, iris pattern, or other biometric to encrypt and decrypt their data without their biometrics being intercepted.
The BioVault encryption system works as follows:
In phase 1, Alice identifies herself to the authentication server, and indicates that she wants to send an encrypted message to Bill and requests Bill's biometric key from the server.
In phase 2, the server retrieves a random biometric key from Bill's stored biometric keys.
In phase 3, Alice uses the biometric key to encrypt her message and sends it to Bill.
In phase 4, Bill receives the message sent by Alice, and decrypts the message by testing the biometric keys in his database against the received cipher text.
The fact that each biometric key (data) is unique means that the BioVault system can irrevocably identify and authenticate users through their biometric keys (data) and detect fraudulent use of biometric keys.
Tait adds that the same approach could also be used to digitally sign electronic documents, files, or software executables using biometrics. He will be presenting the team's results on this aspect of their work in the UK at the beginning of September. "If passwords or tokens are used for authentication, only the password or token is proven as authentic - not the user that supplied the token or password," he explains, "Biometrics authenticates the user directly - this was one of the drivers behind the BioVault development."
Inderscience Publishers
Biometrics Current Events and Biometrics News RSSImproving security with face recognition technology
A number of U.S. states now use facial recognition technology when issuing drivers licenses. Similar methods are also used to grant access to buildings and to verify the identities of international travelers. Historically, obtaining accurate results with this type of technology has been a time intensive activity.
Research Continues on Secure, Mobile, Quantum Communications
Researcher Dr. David H. Hughes of the Air Force Research Laboratory in Rome, N.Y. is leading a team investigating long-distance, mobile optical links imperative for secure quantum communications capabilities in theater.
Fingerprint Technology Beats World's Toughest Tests-Including 100s of Builders' Thumbs
Technology developed by the University of Warwick that can identify partial, distorted, scratched, smudged, or otherwise warped fingerprints in just a few seconds has just scored top marks in the world's two toughest technical fingerprint tests.
Identifying the metabolism of a healthy embryo could improve infertility treatment
Embryos that are most likely to result in a pregnancy are crucial to the success of in vitro fertilization (IVF) but are difficult to identify. Researchers at Yale School of Medicine, led by Emre Seli, M.D., are developing a fast, non-invasive test to help assess embryo viability for IVF.
Who are you? Mobile ID devices find out using NIST guidelines
A new publication that recommends best practices for the next generation of portable biometric acquisition devices-Mobile ID-has been published by the National Institute of Standards and Technology (NIST).
New data demonstrate potential for early detection of Alzheimer's disease
Data published in the June issue of the Journal of Alzheimer's Disease demonstrated that minimally-invasive biospectroscopy was able to identify changes in oxidative stress (OS) levels in blood plasma, which may prove to be a useful biomarker in the early detection of Alzheimer's disease.
Knobbly kneed ID
Forget LED thumb-pad identification devices, complex retinal laser scanning, or even computerized iris recognition, the way forward for biometric validation is a quick X-ray snapshot of a person's knees, according to a report published in the International Journal of Biometrics.
Wake-up call: Draft security pub looks at cell phones, PDAs
In recent years cell phones and PDAs-"Personal Digital Assistants"-have exploded in power, performance and features. They now often boast expanded memory, cameras, Global Positioning System receivers and the ability to record and store multimedia files and transfer them over wireless networks-in addition to the cell phone system-using WiFi, infrared and Bluetooth communications. Oh, yes, and make phone calls.
Passports for penguins
Ground-breaking technology that will enable biologists to identify and monitor large numbers of endangered animals, from butterflies to whales, without being captured, will be shown to the public for the first time at this year's Royal Society Summer Science exhibition [30 June to 3 July].
Technology Would Help Detect Terrorists Before They Strike
Are you a terrorist? Airport screeners, customs agents, police officers and members of the military who silently pose that question to people every day, may soon have much more than intuition to depend on to determine the answer.
More Biometrics Current Events and Biometrics News Articles
 |
Eikon Digital Privacy Manager (USB fingerprint reader) - works with Firefox, Windows Vista, and now Mac by UPEK People are forced to use passwords to access their online personal accounts (banks, credit cards, email, etc.) and work-related applications (VPN, CRM, etc.). They even have passwords for logging into Windows and allowing tasks prompted by Vista's User Account Control (UAC). Requirements based on password length and use of capitalization, numbers and symbols result in countless different passwords that are hard to manage. How often do you rely on the "Forget password?" link to have your password emailed to you?Accessing your personal accounts is now as simple as swiping your finger. Now that you don't have to remember or enter passwords, you can create "strong" passwords (long and complex) that are replayed when you swipe your finger, making your personal accounts more secure.In order to... |
 |
Biometric Technologies and Verification Systems by John R. Vacca (Author) Biometric Technologies and Verification Systems is organized into nine parts composed of 30 chapters, including an extensive glossary of biometric terms and acronyms. It discusses the current state-of-the-art in biometric verification/authentication, identification and system design principles. It also provides a step-by-step discussion of how biometrics works; how biometric data in human beings can be collected and analyzed in a number of ways; how biometrics are currently being used as a method of personal identification in which people are recognized by their own unique corporal or behavioral characteristics; and how to create detailed menus for designing a biometric verification system. Only biometrics verification/authentication is based on the identification of an intrinsic... |
 |
Transcend JetFlash 220 - 8 GB Biometric USB 2.0 Flash Drive TS8GJF220 (Ruby Red) by TRANSCEND The fingerprint USB flash drive - JetFlash 220 combines elegance and functionality with an attractive rotating cover that will never get lost. Transcend's JetFlash 220 features a unique sensor strip which allows users to access protected data by simply scanning their fingerprint. The JetFlash 220's fingerprint scanning technology not only makes it easy to safely store personal files and sensitive office documents, but also allows users to automatically log on to any website for which they have a registered account. Transcend constantly strives to combine high tech performance with exceptional quality and an elegant design in all of its products, and the JetFlash 220 is no exception. |
 |
Handbook of Biometrics by Anil K. Jain (Editor), Patrick Flynn (Editor), Arun A. Ross (Editor) Biometric recognition, or simply Biometrics, is a rapidly evolving field with applications ranging from accessing one's computer to gaining entry into a country. Biometric systems rely on the use of physical or behavioral traits, such as fingerprints, face, voice and hand geometry, to establish the identity of an individual. The deployment of large-scale biometric systems in both commercial (e.g., grocery stores, amusement parks, airports) and government (e.g., US-VISIT) applications has served to increase the public's awareness of this technology. This rapid growth has also highlighted the challenges associated with designing and deploying biometric systems. Indeed, the problem of biometric recognition is a "Grand Challenge" in its own right. The past five years has seen a significant... |
 |
Gunvault Microvault Biometric Pistol Gun Safe by Gunvault The outside of the Microvault is constructed of heavy-gauge steel with soft foam on the inside to protect the pistol. High-strength lock mechanism performs reliably time after time. Precise fittings are virtually impossible to pry open with hand tools. Built-in computer blocks access after repeated invalid keypad entries. Conveniently located keypad is easy to use. Mounts almost anywhere. Four pre-drilled holes on bottom of vault. |
 |
BARSKA Biometric Safe by Barska Biometric Valuables/ Gun Safe with Fingerprint Lock |
 |
Acroprint Time Q-Plus Biometric Attendance System by Acroprint Time Recorder Company timeQplus Proximity Biometric and Attendance System, AutomatedAn advanced biometric that prevents buddy punching. Ideal for small businesses with up to 125 employees. Employees clock in/out using fingerprint or PIN number. Holds up to 50,000 transactions with a fingerprint capacity of 1,500 templates. Tracks department transfers and employee hours worked in different departments. Generates numerous reports and exports directly to popular payroll formats including QuickBooks. Global Product Type: Time Clocks; Time Clock Type: Automated; Number of Employees: 125; Imprint Style: N/A.ACP 010250000, ACP-010250000, ACP,010250000 |
 |
Biometrics For Dummies (For Dummies (Computer/Tech)) by Peter Gregory (Author), Michael A. Simon (Author) What is biometrics? Whether you’re just curious about how biometrics can benefit society or you need to learn how to integrate biometrics with an existing security system in your organization, Biometrics For Dummies can help. Here’s a friendly introduction to biometrics — the science of identifying humans based on unique physical characteristics. With the government’s use of biometrics — for example, biometric passport readers — and application of the technology for law enforcement, biometrics is growing more popular among security experts. Biometrics For Dummies explains biometric technology, explores biometrics policy and privacy issues with biometrics, and takes a look at where the science is heading. You’ll discover: How pattern recognition and... |
 |
Transcend JetFlash 220 - 16 GB Biometric USB 2.0 Flash Drive TS16GJF220 (Lime Green) by TRANSCEND In order to satisfy the ever growing demand for secure storage in today's digital world, the JetFlash 220 combines elegance and functionality with an attractive rotating cover that will never get lost.In recent years, the use of high capacity compact storage devices has become commonplace, making data more portable than ever. As a result, the number of stolen identities, trade secrets and other high tech crimes has also steadily risen. Biometrics has quickly become the best way to fight back against data theft, and fingerprint recognition is the current weapon of choice. Transcend's JetFlash 220 features a unique sensor strip which allows users to access protected data by simply scanning their fingerprint.The JetFlash 220's fingerprint scanning technology not only makes it easy to safely... |
 |
Biovault Biometric Safe with Fingerprint Reader by CHISUPPLY.COM BioVault Biometric Safe with Fingerprint Reader provides safe storage and easily controlled access for jewelry, handguns, weapons, ammunition, and other valuable items including: GUNS, pharmaceuticals, coins, stamps, stocks, bonds, critical data and personal documents. BioVault Biometric Safe with fingerprint reader uses proprietary fingerprint technology to verify identification and permit access. BioVault Biometric Safe with fingerprint reader is easily programmable and can store up to 50 authorized fingerprints in its flash memory. Only you decide who gains access to BioVault Biometric Safe. BioVault Biometric Safe with patent-pending technology is the culmination of over 20 years of biometric development. BioVault Biometric Safe with fingerprint reader requires no external... |
| © 2009 BrightSurf.com |