The 29th IPP Symposium
A System-Level Analysis of Biometric User Authentication
Stephen Kent, BBN
Biometric authentication technology, the use of personal physical characteristics or behavior to verify a user's identity claim, has been used successfully in high-security contexts as part of physical access control systems for many years. Its use in the information-security context, with sensors attached to or part of individual workstations and laptops, is a more recent phenomenon, made possible in large part by declining prices for biometric authentication hardware. Biometrics may even be used in a very local context, e.g., to activate crypto tokens such as smart cards.
Many vendors of biometric technology for information systems promote their products based on improved security. However, in order to evaluate this claim, one has to evaluate the perceived threat environment, something that rarely seems to be part of vendor or technical literature. One also should consider the security of these technologies in a broad system context, e.g., what are the larger implications for a user if there is a security compromise of a biometric authentication server? For example, biometrics may be employed in different ways to provide user authentication in the Internet or an intranet, with dramatically different security and privacy implications.
This presentation discusses system-level characteristics of biometric authentication technologies in several contexts, examining their security properties relative to various threat models. This analysis suggests that perhaps the best rationale for using biometrics is ease of use and cost effectiveness, but that attempts to make biometrics more secure often negate this latter feature. The presentation concludes with a discussion of ways to make use of biometrics that avoid these problems.
