Secure Remote Biometric Authentication Ewa Syta 1 Michael J Fischer 1 David Wolinsky 1 Abraham Silberschatz 1 Gina GallegosGarcia 2 and Bryan Ford 1 1 Yale University and ID: 244466
Download Presentation The PPT/PDF document "Private Eyes:" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Slide1
Private Eyes:Secure RemoteBiometric Authentication
Ewa Syta
1
, Michael J. Fischer
1
,
David Wolinsky
1
,
Abraham Silberschatz
1
, Gina Gallegos-Garcia
2
, and Bryan Ford
1
1
Yale University and
2
National Polytechnic Institute of MexicoSlide2
OutlineMotivation
Introducing Private Eyes
Private Eyes Protocol
Implementation / EvaluationConclusion
Yale UniversitySlide3
Peggy
What was my password?
Motivation
Many applications demand verification of identity
Ensure only legitimate access to protected resources
Provide client-specific services
Challenges
Passwords are hard to
remember
Reuse of passwords
Fail when a database is compromised
Yale University
Victor
Mallory
Password Database
PasswordSlide4
MotivationMany applications demand verification of identity
Ensure only legitimate access to protected resources
Provide client-specific services
ChallengesPasswords are hard to
remember
Reuse of passwords
Fail when a database is compromised
Yale University
Peggy
Victor
Mallory
Password Database
PasswordSlide5
Motivation – BiometricsUniquely identify an individual
No need to remember, always with you
Applications for localized verification: IPhones and laptop fingerprint scanners
Challenge: If compromised,
cannot
be replaced
Yale UniversitySlide6
OutlineMotivation
Introducing Private Eyes
Private Eyes Protocol
Implementation / EvaluationConclusion
Yale UniversitySlide7
Private EyesGoal: Eliminate storing sensitive data on server
Insight: Use sensitive data to decrypt an authentication context
Peggy
Victor
Mallory
Token Database
Token
Encrypted
Token
Local
Biometric
Scanner
)
Yale UniversitySlide8
OutlineMotivation
Introducing Private Eyes
Private Eyes Protocol
Implementation / EvaluationConclusion
Yale UniversitySlide9
Security GoalsNo server-side compromise of private inputs
No client-side compromise of private inputs
No cross-site impersonation
Yale University
Peggy
Victor
Mallory
Token Database
Token
Encrypted
Token
Local
Biometric
ScannerSlide10
Protocol PhasesEnrollment
Peggy and Victor establish token
Peggy encrypts token using biometrics
AuthenticationPeggy decrypts token using biometric device
Peggy sends token to Victor for verification
Yale UniversitySlide11
EnrollmentYale University
Peggy
Victor
Token Database
seed =
Diffie
-Hellman Exchange
Rng
:= RANDOM(seed)
Value :=
Rng.Value
()
State :=
Rng.State
()
Template :=
Scanner.Scan
(Peggy)
SecTemplate
:= Value TemplateRng := RANDOM(seed)
Value := Rng.Value()State := Rng.State()
SecTemplate
, State
Peggy, Value, State
Both securely erase all contents not stored to Card and DatabaseSlide12
Authentication
Yale University
Peggy
Victor
Token Database
Peggy,
auth
SecTemplate
:=
Card.SecTample
Template :=
Scanner.Scan
(Peggy)
Auth
:=
SecTemplate
Template
Rng
:= RANDOM(
C
ard.State)Value := Rng.Value()State := Rng.State()Template :=
Scanner.Scan(Peggy)SecTemplate := Value Template
Rng := RANDOM(Peggy.State)Peggy.Value
:=
Rng.Value
()
Peggy.State
:=
Rng.State
()
SecTemplate
, State
Peggy, Value, State
auth
==
Peggy.Value
Both securely erase all contents not stored on Card and DatabaseSlide13
Security AnalysisIf Victor
is compromised
Mallory can impersonate
Peggy only to Victor, no where elseIf
Peggy is compromised
Backtracking resistant RNG prevents Mallory from stealing of Peggy’s template
If both Peggy and Victor are compromisedBreaks security assumptionMallory can learn the current secured template
Yale UniversitySlide14
Suitable Authentication MechanismsPasswords: Password
SecTemplate
== State
Eyes (Iris): Iris Template SecTemplate ~= State
Uses hashing distance to compute similarity
Hashing distance / max distance == .32, false match in roughly 1 in 26 million
Yale UniversitySlide15
SynchronizationPeggy transmits current authentication attempt
If she is ahead, Victor scans ahead (within reason)
If she is behind, Victor tells her to go forward
If she is too far ahead, re-enrollment may be required
Yale University
Peggy
Victor
Peggy,
auth
, attempt #
False, expected attempt #Slide16
OutlineMotivation
Introducing Private Eyes
Private Eyes Protocol
Implementation / EvaluationConclusion
Yale UniversitySlide17
ImplementationC++ client / server modules
Template extractors:
Project Iris written in C++/
QtMasek’s
Iris Recognition ported to Octave
Crypto Library Crypto++
RNG – Blum Blum
ShubSQLite database for server backend
Yale University
CLIENT
PE CLIENT MODULE
SERVER
PE SERVER MODULE
USER DB
TOKEN
PRIVATE INPUTSlide18
CASIA DatabasesVersion 1
Preprocessed images
108 subjects, total of 758 images
Version 2
60 subjects, total of 2400 images
Yale UniversitySlide19
Time for Enrollment
Yale University
Template size:
C++: ~9KB
Octave: ~40KBSlide20
Time for Authentication
Yale University
Min. Difference Score 0.32
False match 1 in 26 million
Slide21
OutlineMotivation
Introducing Private Eyes
Private Eyes Protocol
Implementation / EvaluationConclusion
Yale UniversitySlide22
Conclusion
Private Eyes offers:
Two factor authentication that offers privacy preservation on sensitive information
Offers reasonable performance for authentication timeA step toward making online biometric authentication possible
Yale UniversitySlide23
Feature Extraction Reliability
Yale UniversitySlide24
Time for Feature Extraction
Yale University