Biometric System Security

Security is “freedom from risk or danger”, while computer and data security is “the ability of a system to protect information and system resources with respect to confidentiality and integrity”. Defining biometrics system security is difficult, because of the ways biometric systems differ from traditional computer and cryptographic security [40]. Implicit in all definitions is the concept of an attacker; however, biometrics should always be assumed to operate in an (at least somewhat) hostile environment – after all, why should one test identity if all can be trusted? The ability of a biometric system to stand up to “zero-effort” attackers is measured by the false accept rate (FAR). Attackers may then change makeup, facial hair and glasses, or abrade and cut fingerprints in order to avoid being recognized; attackers prepared to try harder may use spoofing . This chapter deals with attacks which are not spoofing, but those that target processing within the biometric system. We define biometric system security by its absence. Since biometrics is “automated recognition of individuals based on their behavioral and biological characteristics”, a vulnerability in biometric security results in incorrect recognition or failure to correctly recognize individuals. This definition includes methods to falsely accept an individual (template regeneration), impact overall system performance (denial of service), or to attack another system via leaked data (identity theft). Vulnerabilities are measured against explicit or implicit design claims.