Telebiometrics, and applications in Japan. Systems Development Lab. Hitachi, Ltd.

Transcription

1

2 Telebiometrics, and applications in Japan Yoshiaki ISOBE Systems Development Lab. Hitachi, Ltd. 2

3 Introduction Biometrics i is one of Authentication ti ti technologies Authentication technologies: Knowledge: Whatyou know Password, PIN, etc. Possession: What you have IDcard card, Smartcard card, One time passwordgenerator etc. Biometric Feature: What you are Fingerprint, Face, Finger vein, etc. These are used to integrate on various application, case by case Credit card(emv): Smart card andpin Immigration: IC Passport and Biometrics (Face, Fingerprint, Iris) 3

4 What is Biometrics? ISO/IEC JTC 1 SC 37 (Biometrics) i dfi defined dthe term of Biometrics : automated recognition of individuals based on their behavioural and biological characteristics Biometrics has advantagesover other authentication methods: Availability (Forgetless) Security (Direct link to the authentication subject) Operation Cost (Operation for Loss/Stolen) 4

5 What is Telebiometrics? TTP (ex: Government) Certificate of Issuing Biometric feature Hanako Hitachi Network Send Is it genuine certificate? Yes. Is she same person? Yes. You are Hanako! Nice meet you! User Capturing of Biometric i feature Verifier However, there are various security threats on ICT environment. ITU T SG 17 Question 9 Telebiometrics is standardizing some network authentication model using biometrics, and security requirements for each models. 5

6 ITU T Recommendations on Telebiometrics 1 For conventional Biometric technologies ISO X.1086 Security Guideline in operating and building system How to use the Biometrics on telecommunication environment X.1083 X.1084 X.1089 Remote Requirements Template format Control for open network for open network and protocol Fingerprinti Ii Iris Face ISO ISO Evaluating Method Sign Other? Vein Voice Standardizing by ISO/IEC SC 37 Conventional Biometric Technology (BSP) 6

7 ITU T Recommendations on Telebiometrics 2 For Biometric template protection technologies Biometric Cryptosystem Cancelable biometrics X.1086 Amd.1 Security Guideline to operate and to develop system How to use the BTP tech. on telecommunication environment X.1088 ISO/IEC PIE And PIR PIV X.ott Applied it to the Framework Applied it to the protection Mechanism Applied it to the Model X.gep Evaluating Method Biometric Cryptosystem Other? Cancelable biometrics Mechanism Biometric Template Protection Technology 7

8 Telebiometrics application in Japan with relationship to ITU T Recommendations 1. ATM on Financial service Japanese Bankers Association released the recommendation (guideline) to avoid fraudulent transactions and to protect customers at Jan Prevention of ATM Frauds / Card Skimming Smart card implementation Biometric authentication for ATM transactions 2. Logical access control on business application Increasing to require secure access to customer privacy informationon on sales department, or integrity of evidence editor, e.g. drug trial, hospital, 3. Cloud service Integration cost is important for cloud application. Cancelable biometric authentication service for cloud application have started in Japan at June

9 1. ATM application on two ITU T X.1086 model ATM with finger vein authentication Capturing vein image from finger The Local model in ITU T T X.1086 The Download model in ITU T T X.1086 Application Vein Device Application Central Server Authentication Server AP Vein DB ATM / Teller Terminal Application Biometric M/W Driver Sensor Controller Smart Card R/W M/W:Middleware, R/W:Reader Writer, AP:Application ATM / Teller Terminal Application Biometric M/W Driver Vein Device Sensor Compare Storage & Compare 9

10 2. Logical access control for Business applications The center model in ITU T X.1086 Client PC 1 Input ID and Bio data 02 指静脈情報を事前に登録 Send ID and Bio data SSL 登録 Authentication Server Enrolled Biometric data 3 Biometric authentication User for each example: 1. Sales staff 2. Drug trial staff 3. Hospital staff 4 Access to Business Application Windows Domain Server Application example: 1. Customer management 2. Drug trial report system 3. Medical report system Business Application 10

11 3. Biometric authentication as Cloud service Outsourcing of Storage & Comparison to The Third Party model in ITU T X.1086 End user Application Service Provider Authentication Service Provider SSL Application Server SSL Biometric i Authentication Server Cloud Center Ease use Low cost and Speedy start for secure authentication Cancelable biometrics Advantage 1: Biometric feature protection Client Sensor Applied the cancelable biometrics for secure operation Biometrics Authentication Server Secret parameter Enc Trans Send Comparison OK/NG Comparable to remain encrypted feature Biometric Authentication Server Advantage 2: Old parameter Client Cancelable Old template New template Update Update Difference Difference value calculation Update New parameter Updatable to remain encrypted feature 11

12 Summary ITU T SG 17 Question 9 is standardizing for secure biometrics authentication on telecommunication There are various telecomm. application using Telebiometrics technologies for convenient and secure authentication This presentation have introduced Telebiometrics Recommendations, and 3 Telebiometrics applications in Japan 12

13 Telebiometrics, and applicationsinjapan in Yoshiaki ISOBE Hitachi, Ltd., Systems Development Laboratory com 13