Abstract
In information systems, authentication involves, traditionally, sharing a secret with the authenticating entity and presenting it whenever a confirmation of the user’s identity is needed. In the digital era, that secret is commonly a user name and password pair and/or, sometimes, a biometric feature. Both present difficulties of different kinds once the traditional user name and password are no longer enough to protect these infrastructures, the privacy of those who use it, and the con- fidentiality of the information, having known vulnerabilities, and the second has many issues related to ethical and social implications of its use (Magalhães & Santos, 2005). Password vulnerabilities come from their misuse that, in turn, results from the fact that they need to be both easy to remember, therefore simple, and secure, therefore complex. Consequently, it is virtually impossible to come up with a good password (Wiedenbeck, Waters, Birget, Brodskiy, & Memon, 2005). On the other hand, once users realize the need for securing their authentication secrets, even fairly good passwords become a threat when the security policies (if at all existing) fail to be implemented. The results of an inquiry made by the authors in 2004 to 60 IT professionals show that, even among those that have technical knowledge, the need for password security is underestimated (Magalhães, Revett, & Santos, 2006). This is probably one of the reasons why the governments increased their investment in biometric technologies after the terrorist attack of 9/11 (International Biometric Group [IBG], 2003). The use of biometric technologies to increase the security of a system has become a widely discussed subject, but while governments and corporations are pressing for a wider integration of these technologies with common security systems (like passports or identity cards), human rights associations are concerned with the ethical and social implications of their use. This situation creates a challenge to find biometric algorithms that are less intrusive, easier to use, and more accurate. The precision of a biometric technology is measured by its false-acceptance rate (FAR), which measures the permeability of the algorithm to attacks; its false-rejection rate (FRR), which measures the resistance of the algorithm to accept a legitimate user; and its crossover error rate (CER), the point of intersection of the FAR curve with the FRR curve that indicates the level of usability of the technology (Figure 1). For a biometric technology to be usable on a stand-alone base, its CER must be under 1%. As an algorithm becomes more demanding, its FAR is lower and its FRR is higher. Usually the administrator of the system can define a threshold and decide what the average FAR and FRR of the applied algorithm will be according to the need for security, which depends on the risk evaluation and the value of what is protected; also, the threshold can be, in theory, defined by an intrusion detection system (software designed to identify situations of attack to the system).
TopIntroduction
In information systems, authentication involves, traditionally, sharing a secret with the authenticating entity and presenting it whenever a confirmation of the user’s identity is needed. In the digital era, that secret is commonly a user name and password pair and/or, sometimes, a biometric feature. Both present difficulties of different kinds once the traditional user name and password are no longer enough to protect these infrastructures, the privacy of those who use it, and the confidentiality of the information, having known vulnerabilities, and the second has many issues related to ethical and social implications of its use (Magalhães & Santos, 2005).
Password vulnerabilities come from their misuse that, in turn, results from the fact that they need to be both easy to remember, therefore simple, and secure, therefore complex. Consequently, it is virtually impossible to come up with a good password (Wiedenbeck, Waters, Birget, Brodskiy, & Memon, 2005). On the other hand, once users realize the need for securing their authentication secrets, even fairly good passwords become a threat when the security policies (if at all existing) fail to be implemented. The results of an inquiry made by the authors in 2004 to 60 IT professionals show that, even among those that have technical knowledge, the need for password security is underestimated (Magalhães, Revett, & Santos, 2006). This is probably one of the reasons why the governments increased their investment in biometric technologies after the terrorist attack of 9/11 (International Biometric Group [IBG], 2003).
The use of biometric technologies to increase the security of a system has become a widely discussed subject, but while governments and corporations are pressing for a wider integration of these technologies with common security systems (like passports or identity cards), human rights associations are concerned with the ethical and social implications of their use. This situation creates a challenge to find biometric algorithms that are less intrusive, easier to use, and more accurate.
The precision of a biometric technology is measured by its false-acceptance rate (FAR), which measures the permeability of the algorithm to attacks; its false-rejection rate (FRR), which measures the resistance of the algorithm to accept a legitimate user; and its crossover error rate (CER), the point of intersection of the FAR curve with the FRR curve that indicates the level of usability of the technology (Figure 1). For a biometric technology to be usable on a stand-alone base, its CER must be under 1%. As an algorithm becomes more demanding, its FAR is lower and its FRR is higher. Usually the administrator of the system can define a threshold and decide what the average FAR and FRR of the applied algorithm will be according to the need for security, which depends on the risk evaluation and the value of what is protected; also, the threshold can be, in theory, defined by an intrusion detection system (software designed to identify situations of attack to the system).
Establishing the error rates of a biometric technology is a complex problem. Studies have been made to normalize their evaluation, but the fact is that the results are strongly dependent on the number of individuals involved in the process and, what is worst, on who is chosen. This means that, even with a large amount of data collected, the results can be very different if we change the evaluated group. The lack of trust in the precision evaluation methodologies and values is one of the reasons why the human rights associations are opposing the generalization of use of biometric technologies and their acceptance as standards for authentication procedures (Privacy International, Statewatch, & European Digital Rights, 2004). Even so, in an inquiry made by Epaynews (http://www.epaynews.com), 36% of users stated that they would prefer to use biometric authentication when using credit cards, a value only comparable to the use of personal identification numbers (PINs) and much higher than the 9% of authentication obtained by signature.
Key Terms in this Chapter
Passgraph: It is the user’s secret code to access a system protected by a graphical authentication system. It is constituted by a sequence of points the user must click in order to obtain a successful log-in.
Threshold: It is the variable that defines the level of tolerance of an algorithm. It can be set to a more demanding value, raising the false-rejection rate and lowering the false-acceptance rate, or it can be set to a less demanding value, lowering the false-rejection rate and raising the false-acceptance rate.
Keystroke Dynamics: It is a biometrical authentication algorithm that tries do define a user’s typing pattern and then verifies in each log-in attempt if the pattern existing in the way the password was typed matches the user’s known pattern. Another application of keystroke dynamics, at least in theory, is the permanent monitoring of the user’s typing pattern in order to permanently verify if the user that is typing is the legitimate owner of the system’s account being used.
False-Rejection Rate (FRR): This rate is a measure of the comfort level of an authentication algorithm. It is calculated by dividing the number of unsuccessful attempts made by legitimate users by the total number of legitimate log-in attempts.
Authentication: It is the process of verifying the identity alleged by a user who tries to gain access to a system.
Crossover Error Rate (CER): Authentication algorithms need to simultaneously minimize permeability to intruders and maximize the comfort level, therefore they have to be both demanding and permissive. This contradiction is the base for the optimisation problem in authentication algorithms, and the measure of success for the overall precision of an algorithm and its usability is the CER, the value obtained at the threshold that provides the same false-acceptance rate and false-rejection rate.
Collaborative Biometric Technology: It is a biometric authentication technology that requires the user’s voluntary and intended participation in the process. It opposes the stealth biometric technologies that can be used without the user’s consent.
Graphical Authentication System: It is a log-in system that verifies the user’s knowledge of specific images or parts of images to grant or deny successful log-in.
False-Acceptance Rate (FAR): This rate is a measure of the permeability of an authentication algorithm. It is calculated by dividing the number of the intruder’s successful log-in attempts by the total number of the intruder’s log-in attempts.
Identification: It is the process of discovering the identity of a user who tries to gain access to a system. It differs from authentication because in the identification process, no identity is proposed to the system, while in authentication, an identity is proposed and the system will only verify if that identity is plausible.
Stealth Biometric Technology: It is a biometric authentication technology that can be used without the user’s consent. It opposes the collaborative biometric technologies that require the user’s voluntary and intended participation in the process.