Sunday 9 June 2013

EXPLORING BIOMETRICS

Quite a popular word when it comes to advance security technologies, lets drill it deeper.

Definition :
                  Biometrics is a technology, a science used in analyzing biological data or biological information.     In terms of Information Technology, Biometrics is the technology used to measure, analyze, verify various human traits such as the foll (including, but not limited to)-
1) Iris,
2) Retina,
3) Fingerprints,
4) Blood pressure,
5) Heart beat rate,
6) DNA,
7) Facial pattern,
8) Hand pattern, etc.

                    By authenticating with the help of Biometric systems, we confirm the identity of the users undergoing the authentication process. An example would be the common occurence of the fingerprint scanning techniques used in corporate offices for confirming the identity of their employees, by institutions for confirming the identity of their students, professors, by Government offices for confirming the access to authorized staff members, etc.

Characteristics :
                          Biometrics systems possess the following seven important characteristics, as follows:-
1) Universality
2) Uniqueness
3) Permanence
4) Acceptability
5) Collectability
6) Performance
7) Circumvention

                          The above seven, in detail, as follows,

1) Universality :- It implies that the human characteristic being measured should be available in majority of the  users of the system. For example, almost every living human has fingers and thus can be used for authenticating the users. On the other hand if we use "burns on hands" as a measure of authentication, not every user would possess a burn on his/her hand and thus can be ruled out.

2) Uniqueness :- This implies that the human characteristic chosen for authentication should be unique otherwise this biometric system would not have a true meaning. Imagine 20 people having same characteristic and the system is subjected to authenticate them on that particular characteristic. This system would indicate a positive confirmation also to those who are not authorized and hence would amount to a critical security breach.

3) Permanence :- This means that the characteristic chosen for authentication should resist itself from change for a long period of time. In simpler words, that characterstic should retain itself for a longer period of time. Imagine that if we choose height as an authentication factor, it will most probably increase after some years. At that moment, the original height wont be useful anymore and thus would require a complete recheck of the user for proper authentication.

4) Acceptability :- Imagine a system which requires you to touch a device that has been repeatedly used by others, which requires you to do some acrobatics, some kind of unusual dance, which requires you to remove your clothes, all this for authenticating you. Assuming a strong negative nod, we would definitely reject such systems. Acceptability is thus a measure of how useful the system is to the user. A system which requires you to only place your eye at the scanning area is most likely to be accepted by all the users of the system.

5) Collectability :- This simply means how easy it is to collect the authenticating characteristic from the user . For example, if it requires that the user should walk for 10 minutes before the authentication is completed, this is a very time consuming process considering this system authenticating 100 users. On the contrary, a fingerprint is easy to collect and hence would make the authentication process swifter.

6) Performance :-  This talks about the performance of the authenticating system in terms of its speed, accuracy, error rate and other performance parameters.

7) Circumvention :- This describes how easily the authenticating system can be bypassed or tricked. This must be a topic of interest for the security guys, definitely !

To be continued..


Monday 3 June 2013

AUTHENTICATION

Before delving into the actual domain of authentication, let's take a moment to understand the difference between identification and authentication. When you show your ID card to the college security guards you identify yourself to them as being a legitimate student of that college. When you enter your ATM card into the ATM machine card slot, you identify yourself to your bank as its legal customer. But anyone can claim to be this bank's customer by stealing some one's ATM card. Now in such a situation how does the bank confirm its legal user? It is confirmed with the help of the PIN number. If the PIN number you enter is correct then you are positively confirmed. In other words you are authenticated. Now how do we implement this authentication? It can be done, based on the following 5 ways. 
1) Something you know
2) Something you have
3) Something you are
4) Something you do
5) Where you are

Let's explore them in detail.

1) Something you know
     This is based on the fact that you know the important credentials for logging into the system such as passwords, PIN number, unlock patterns etc. When you enter these correctly, you are given access to the system otherwise some kind of error is displayed.

2) Something you have
     This is based on the fact that you possess some kind of physical entity which helps you in your authentication process. For example, ATM card, ID cards used in company's to enter the rooms, etc.

3) Something you are
     This type of authentication is based on your physical traits. Your eyes, your palm, your fingerprints etc are used for authenticating yourself. Retina scans, facial recognition, fingerprint scan, etc are some commonly used authenticating techniques.

4) Something you do
     In simple words, in this pattern if you wave your left hand up and down 3 times, you will get authenticated. If you revolve your head clockwise twice you will get authenticated. In short, what actions you perform becomes your password. This can also include style of handwriting, the speed with which keystrokes are done, etc.

5) Where you are
     This involves using your geographical location as the password. This can be useful in case of ATM card transactions done physically at banks where this type of authentication can be used as an additional step for authentication thus making the system more secure.

Multifactor Authentication
Simply put, more than one type of authentication methods seen above are used for authenticating the user.

Mutual Authentication
In majority of cases we have seen one entity authenticating the other. This is unidirectional authentication. But in mutual authentication, both the entities authenticate each other. This mutual authentication can be seen in client server communication system. When we are trying to log in to an account on a website, the browser(client) authenticates the server by checking its certificate, whereas the server authenticates the client by checking its certificate and authenticates the user by verifying its credentials.