Abstract
Authentication procedures are conducted in order to control and stop illegitimate access of such valuable data. This chapter discusses the biometric authentication inside the cloud. The authors describe how biometric information of a user can be securely transmitted and then stored inside the user database maintained in the trusted cloud. Femtocell, a recent development in mobile network using which secures biometric data transmission from the mobile device to the cloud, is discussed in this chapter.
TopIntroduction
Frauds and fraudulent activities are social crimes that are increasing vigorously every day. They are million dollar businesses escalating every year. The PwC global economic crime survey of 2009 suggests that close to 30% of companies worldwide have reported being victims of fraud in the past year (PricewaterhouseCoopers LLP, 2009). The Oxford Dictionary defines fraud as the use of false representations to gain an unjust advantage. It involves people who purposely act in a secret manner to deprive someone from something of value which actually belongs to the victim.
Statistics says that in recent years, the development of new technologies has provided new avenues to criminals in which fraud can be committed (Bolton, 2002). With the maximum items of our daily lives gone electronic, the scope of performing such crimes has found a strong platform. Credit / debit card fraud, electronic fraud, identity theft etc. are few of the types of fraud that are encountered regularly. To combat such deceptive activities, it is very important to implement authentication techniques. It is the act of confirming the truth of an attribute of a datum or entity which might involve confirming the identity of a person or some software program. The process of authentication often involves verifying the validity of at least one form of identification which is unique in nature. Biometric authentication is an important authentication method which refers to the identification of humans by their characteristics or traits. In Computer Science, it is used for identification and secured access control. Different aspects of human physiology, chemistry or behavior are used for biometric authentication. Biometrics refers to the use of unique physiological characteristics to identify an individual. It uses human traits like finger prints, tongue impressions, iris and face recognitions (Pugazhenthi, 2013). These are unique to each individual and thus differentiate users. A human physiological or behavioral biometric should possess the following desirable properties (Jain, 1999):
- 1.
Universality: Every person should possess the characteristic;
- 2.
Uniqueness: No two persons should be the same in terms of the characteristic;
- 3.
Permanence: The characteristic should not vary with time;
- 4.
Collectability: The characteristic should be measurable quantitatively.
Biometric techniques and cloud computing are combined for the purpose of a secure cloud computation. As cloud is nothing but a remote server, hence, the operations carried out are beyond trusted boundaries and is much more vulnerable to hacking and security breaches (Pugazhenthi, 2013).
As we all know, worldwide adoption of mobile products and cloud computing services is not only continuing, but is accelerating. Biometric security technology seems promising inaddressing the issue of authenticating genuine user that is a fundamental flaw inconventional cryptography. Conventional biometric applications, specifically verification and identification, have been extensively investigated over the past decades,leading to a significant improvement.
Key Terms in this Chapter
Femtocell: The femtocell is a low power and low cost base station which can be deployed inside an indoor building in a plug-and-play manner by the user him or herself. The femtocell is a wireless access point that connects standard mobile devices to a mobile operator’s network using residential DSL or cable broadband connection. The functionalities of a femto base station are almost the same as that of a typical macro base station. But the price of femto BS can be significantly lower because: i) a femto BS is expected to serve a small number of users and ii) a relatively low transmission power is enough to cover the service area. Deploying femtocell networks embedded in the macrocell coverage greatly benefits communication quality in variety of manners. Though femtocells are usually deployed in indoor environment to provide in-building coverage enhancements, service can be provided to outdoor users also in vicinity by deploying portable femtocells. A femtocell contains the components: i) Microprocessor, ii) Random access memory, iii) Field Programmable Gate Array (FPGA), iv) RF (Radio Frequency) transmitter, v) RF receiver, and vi) Power amplifier. The microprocessor is used for managing the radio protocol stack and associated baseband processing. The Random access memory is used for handling various data i.e. the collected information related to network traffic, interference condition and user mobility. The FPGA and other circuitry are used for managing the data encryption, hardware authentication and network time protocol. The RF transmitter, RF receiver, power amplifier (PA) and miscellaneous hardware components are used for non-essential functions. The femtocell in idle mode switches off the RF transmitter, RF receiver, miscellaneous hardware and the PA, thus resulting in power saving.
Mobile Cloud Computing: Mobile cloud computing is the combination of mobile computing and cloud computing. It incorporates the cloud computing into the mobile environment. MCC provides a simple and easy infrastructure for mobile applications and services, where both the data storage and the data processing are performed outside the mobile devices and inside the cloud. MCC provides all the cloud services such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) which are required for mobile user. MCC provides many applications and services like Mobile commerce, Mobile learning, Mobile healthcare, Mobile gaming etc. Mobile devices can access all the services of the cloud through the internet using MCC. MCC has several advantages for mobile devices like: improving capacity of data storage and processing power, extending battery life, reducing the power consumption of the device, reducing energy consumption of the cloud, improving reliability, scalability, simplicity of integration, on demand service, disaster management etc. Smart phone and tablets are the most useful platform of mobile cloud computing. Smart phones are made by Blakberry, Nokia, Samsung, Google and they use different operating systems like Research in Motion (RIM) BlackBerry operating system, the Windows™ Mobile® operating system, Nokia's Symbian platform, and UNIX variations such as Google Android and Apple iOS to support MCC. Apple iPad and Android tablets made by Samsung, Motorola, and Acer. IBM predicts that by 2015, there will be 1 trillion cloud-ready devices. The 4G technology is the most useful enable technology to improving bandwidth and network latency of Mobile Cloud Computing. HTML5and CSS3 can improve the mobile web applications and allows specification of offline support, which makes local storage possible, helping with connectivity interruptions. Web-4.0 is also used for internet application .Another enabler for cross-platform applications is an embedded hypervisor, which allows a web application to run on any smart phone without concern of the essential architecture. Cloudlet is a device, can be used in MCC for improving the network latency.
Cloud: Cloud refers to an elastic execution environment of resources involving multiple stakeholders and providing a metered service at multiple granularities for a specified level of QoS. Without major technical obstacles cloud platforms allow scalability and global presence. It is also an on demand process when it needs, use it with the help of internet and also pay only for that means as per the nature of uses or services hires. Cloud computing provides basic three services like Infrastructure as a Services (IaaS), Platform as a Services (PaaS) and Software as a Services (SaaS). In IaaS, cloud providers are provided basic storage and compute capabilities as a standardized service over the network as an on demand fashion. IaaS providers supply different resources like virtual machine, servers, storage, firewalls, network etc to perform high performance computing application. In PaaS, cloud providers are encapsulated a layer of software and provided it as a service to build a higher level service. It includes operating system, programming language execution environment, database, and web server etc to provide a clod platform for deploying various applications. In SaaS, cloud providers provide different application software and the software runs on the cloud and cloud users are accessed as a service from the cloud client. Example: salesforce.com, Google application which offers different business application like email, word processing and also different games, communication etc.
Trust: Trust refers to reliability on some person or some system. In computer science, any system is said to be trusted when it behaves the way the user expects it to do. It can be defined as the success rate of any computing system. Mathematically, trust is a probabilistic value which lies between 0 and 1. Trust is a complex concept which has no universally accepted scholarly definition. Evidence from a contemporary, cross-disciplinary collection of scholarly writing suggests that a widely held definition of trust is as follows: “Trust is a psychological state comprising the intention to accept vulnerability based upon positive expectations of the intentions or behaviour of another.” Trust is a broader notion than security as it includes subjective criteria and experience. Correspondingly, there exist both hard (security-oriented) and soft trust (i. e. non-security oriented trust) solutions. “Hard” trust involves aspects like authenticity, encryption, and security in transactions. The “soft” trust involves human psychology, brand loyalty, and userfriendliness. Some soft issues are involved in security, nevertheless. When trust is related to cloud computing, it is classified as persistent and dynamic trust to distinguish between social and technological means. Persistent trust referes to trust involving long-term underlying properties or infrastructure and this arises through relatively static social and technological mechanisms. Dynamic trust refers to trust specific to certain states, contexts, or short-term or variable information; this can arise through context-based social and technological mechanisms. Persistent social-based trust in a hardware or software component or system is an expression of confidence in technological-based trust, because it is assurance about implementation and operation of that component or system. In particular, there are links between social-based trust and technological-based trust through the vouching mechanism, because it is important to know who is vouching for something as well as what they are vouching; hence social-based trust should always be considered.
Biometric Authentication: Biometric authentication is defined as a method which is used in computer science to uniquely identify a human being by his or her physiological characteristics and behavior. Physiological characteristics are related to the shape of the body e.g. fingerprint, face recognition, DNA, Palm print, hand geometry, iris recognition, retina etc. Behavioral characteristics are related to the pattern of behavior of a person e.g. typing rhythm, gait, and voice. Each human being has a unique physiological or behavioral characteristic using which he or she can be recognized e.g. voice, face, retina etc. Biometric provides automated methods for identification using unique and measurable physiological or behavioral characteristics such as fingerprint or voice sample etc. These characteristics should not be duplicable, but unfortunately it is possible to create a copy which is acceptable to the biometric system as a true sample. This is where the level of security to be provided. Biometric systems are categorized into two different modes based on their use: (i) Identity verification: It occurs when the user claims to be already enrolled in the system by giving an ID card or login name. In this case the biometric data obtained from the user is compared to the user’s data already stored in the database. If the comparison result is true the user gets accessed, (ii) Identification: It occurs when the identity of the user is a priori unknown. In this case the user’s biometric data is matched against all the records in the database as the user can be anywhere in the database or he/she actually does not have to be there at all.