Biometrics & Security: Combining Fingerprints, Smart Cards and Cryptography

Transcription

1 Biometrics & Security: Combining Fingerprints, Smart Cards and Cryptography THÈSE N O 4748 (2010) PRÉSENTÉE LE 25 AOÛT 2010 À LA FACULTÉ INFORMATIQUE ET COMMUNICATIONS LABORATOIRE DE SÉCURITÉ ET DE CRYPTOGRAPHIE PROGRAMME DOCTORAL EN INFORMATIQUE, COMMUNICATIONS ET INFORMATION ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE POUR L'OBTENTION DU GRADE DE DOCTEUR ÈS SCIENCES PAR Claude BARRAL acceptée sur proposition du jury: Prof. A. Lenstra, président du jury Prof. S. Vaudenay, Dr A. Tria, directeurs de thèse Prof. B. Dorizzi, rapporteur Dr A. Drygajlo, rapporteur Prof. A. Ross, rapporteur Suisse 2010

2 Résumé Depuis le début de ce siècle et plus particulièrement depuis les évenements du 11 Septembre 2001 aux Etats-Unis, plusieurs technologies biométriques sont considérées comme assez matures pour être un nouvel outil de sécurité. Généralement associées à un support personnel afin de respecter la vie privée, les données biométriques de référence sont enregistrées dans des équipements électroniques securisés, tel les cartes à puce et les systèmes utilisent des outils de cryptographie pour entrer en communication avec la carte à puce et échanger les données biométriques de manière sécurisée. Après une introduction générale sur la biométrie, les cartes à puce et la cryptographie, une second partie adressera nos travaux sur les fausses empreintes et les failles des systèmes de capture d empreintes digitales. La troisième partie présentera notre approche d un algorithme léger de reconnaissance d empreinte digitale dédié aux cartes à puce. La quatrième partie détaillera les protocoles de sécurité dans les applications telles que la carte PIV, et présentera notre implémentation dans la carte à puce du protocole proposé par le NIST. Finalement, une cinquième partie adressera l interaction entre Cryptographie et Biométrie, leur antagonisme, leur complémentarité, et présentera notre application d un protocole de challenge-response aux donnèes biométriques afin de faciliter la reconnaissance d empreintes digitales. Mots-clés: Biométrie, Cartes à Puce, Cryptographie, Reconnaissance d Empreinte Digitale, Match-On- Card, Algorithmes Légers, Electronique Embarquée, Protocole Sécurisé de Vérification d Identité par Biométrie, Cryptographie-Biométrie Interaction. Abstract Since the beginning of this brand new century, and especially since the 2001 Sept 11 events in the U.S, several biometric technologies are considered mature enough to be a new tool for security. Generally associated to a personal device for privacy protection, biometric references are stored in secured electronic devices such as smart cards, and systems are using cryptographic tools to communicate with the smart card and securely exchange biometric data. After a general introduction about biometrics, smart cards and cryptography, a second part will introduce our work with fake finger attacks on fingerprint sensors and tests done with different materials. The third part will present our approach for a lightweight fingerprint recognition algorithm for smart cards. The fourth part will detail security protocols used in different applications such as Personal Identity Verification cards. We will discuss our implementation such as the one we developed for the NIST to be used in PIV smart cards. Finally, a fifth part will address Cryptography-Biometrics interaction. We will highlight the antagonism between Cryptography - determinism, stable data - and Biometrics - statistical, error-prone -. Then we will present our application of challenge-response protocol to biometric data for easing the fingerprint recognition process. Keywords: Biometrics, Smart Cards, Cryptography, Fingerprint Recognition, Match-On-Card, Light Weight Algorithms, Embedded Electronics, Cryptography-Biometrics Interaction, Secure Biometric Identity Verification Protocol.

3 Glossary Notations Abbreviations xxv xxix xxxi Thesis Outline & Results Overview Part I. General Introduction Chapter 1. Introduction to Biometrics 1.1 A few words about Biometrics A little bit of History A little bit of Science Fiction Biometric Modalities Introduction Fingerprint Recognition Face Recognition Hand Geometry Iris/Retina Recognition Vein Pattern Recognition Other Techniques Multimodal Biometric Systems Biometric Systems Architecture General Architecture Extraction Algorithm Matching Algorithm Enrollment xi

4 1.3.5 Authentication/Verification Identification Authentication vs Identification Biometric Systems Errors Biometric Systems Evaluation Biometric Systems Management Privacy Issues Applications Chapter 2. Introduction to Smart Cards 2.1 A few words about Smart Cards A little bit of History A little bit of Science Fiction Authentication Token Smart Card Architecture Physical Characteristics Electrical Characteristics Memory Cards Microprocessor Cards Contactless Cards Other complex architectures Smart Cards vs RFID Operating Systems Native Open Platforms for Smart Cards Applications Telephony Banking Identity & Access Management Identity & Travel Documents Multicomponents Smart Cards Screen cards Extended memory cards Fingerprint cards Interaction with Biometrics The Personal Token PhD thesis, 2010 xii claude.barral@epfl.ch

5 Chapter 3. Introduction to Cryptography 3.1 A few words about Cryptography A little bit of History A little bit of Science Fiction Science of Secret Cryptology: Cryptography & Cryptanalysis Symmetric and Asymmetric Cryptography Applications Cryptography Goals Confidentiality Integrity Authentication Identification Others Basic Primitives of Cryptography Encryption/Decryption Functions Hash Functions Message Authentication Codes (MAC) Digital Signatures Basic Protocols of Cryptography Challenge-Response & Mutual Authentication Key Generation & Key Agreement One-Time Passwords (OTP) Interaction with Smart Cards Interaction with Biometrics Part II. Security Issues with Biometrics Chapter 4. Introduction 4.1 General Issues Biometrics with Smart Cards Biometrics vs Passwords Chapter 5. Fingerprints in Details 5.1 Introduction PhD thesis, 2010 xiii claude.barral@epfl.ch

6 5.2 Galton s Classification Galton s Details Pores Existing Standards Finger image data Finger minutiae data Finger pattern data Chapter 6. Sensors Technologies 6.1 Introduction Optical technologies Silicon-based technologies Capacitive Sensors Field Effect Sensors Thermal Sensors Other Technologies Form-factors Thin Flexible Sensors Chapter 7. Dummy Fingers 7.1 Introduction Negatives by Molding Negatives by Latent Print and Etching/Grinding Positives by Pouring Positives by Printing Positives by Etching/Grinding Samples Characterization / Certification Issues Samples Test on Sensors Our Contribution Conclusion Chapter 8. Electronic Fake Fingers 8.1 Introduction Brute Force Attack on Fingerprint Templates Dictionary-like Attack on Fingerprint Templates Hill-Climbing Synthetic Fingerprint Template Generation PhD thesis, 2010 xiv claude.barral@epfl.ch

7 8.6 Synthetic Fingerprint Image Generation SFinGe Optel ASFIP Reconstructing Fingerprint Image from Minutiae Template Our Contribution Conclusion Chapter 9. Aliveness Detection Systems 9.1 Introduction Nature of the Measurable Characteristic Living Properties Non-Living Properties Living voluntary stimulus response Living involuntary stimulus response Measurable physical characteristics Sensor-natural Aliveness Detection Optical Capacitive Field Effect Thermal Pressure Ultrasonic Aliveness Detection by Additional Hardware During Acquisition Pre or Post Acquisition Aliveness Detection by Software Static Dynamic Our Contribution Conclusion Chapter 10. Biometric Systems Certification Issues 10.1 Introduction Existing Initiatives & Standards Our Approach & Contribution Rating Criteriae PhD thesis, 2010 xv

8 Time elapsed Expertize needed Knowledge of the target of evaluation(toe) Window of opportunity Equipment needed Final security levels Conclusion Part III. Biometric Algorithms for Smart Cards Chapter 11. Match-on-Card by Fuzzy Delaunay Triangulation 11.1 Introduction Problem Formulation Our Approach Previous Related Works Isometries Delaunay Triangulation in Fingerprint Recognition Our Triangulation Introduction FDT : Fuzzy Delaunay Triangulation Inputs of Triangulation Triangulation Barycentric Coordinates Outputs of Triangulation Algorithm Matching approach Introduction Inputs Fine-Tuning Parameters Outputs & Decision Algorithm Prototyping with GCC, Octave and GnuPlot On-Card Prototyping Results & Conclusion PhD thesis, 2010 xvi claude.barral@epfl.ch

9 Chapter 12. Evaluation of Match-on-Card Performances 12.1 Introduction to Minex & MinexII by NIST MinexI MinexII MinexI vs MinexII Results with our MoC Algorithm Conclusion Part IV. Security Protocols for Smart Cards with Biometrics Chapter 13. A Simple Approach 13.1 Introduction Authentication Factors Smart Card Password Biometrics Three-Factor Authentication The Yescard / NoCard Issue The Oracle Issue Conclusion Chapter 14. SBMOC - Secure Biometric Match-on-Card 14.1 Introduction to PIV - Personal Identity Verification - card Framework Biometrics Implementation Cryptography Implementation Evaluating the next generation PIV card Security Framework Our Protocol Our Implementation on Smart Card Results Conclusion Part V. Biometrics & Cryptography Interaction PhD thesis, 2010 xvii claude.barral@epfl.ch

10 Chapter 15. General Introduction & State-of-the-Art 15.1 Introduction Hamming Distance Fuzzy Extractors Cancelable Biometrics Biometrics Hashing Biotopes & Biotokens Intricated Biometrics Homomorphic Encryption for Biometric Data Biometric Data Obfuscation Use Cases Pseudo-Identities Efficient Duplication Checking Other Use Cases Chapter 16. Biometrics-Based Challenge-Response: BioEasy 16.1 Introduction Issues with Classical Match-on-Card Externalizing the Fingerprint Matching Our Implementation Our Demonstrator Conclusion General Conclusion & Future Research Bibliography 191 Appendix A. Appendix B. List of Publications Curriculum Vitae PhD thesis, 2010 xviii