Evaluating Attack Resistance Leve

Biometric Systems Tony Mansfield National Physical Laboratory, UK IBPC 7 March 2012 
Outline 

1. Rationale/Scope/Terminology 2. NPL / CPNI evaluation of biometric terminals for auto

access control 

3. Attack levels of the CPNI Grading System, with exam4. General findings on attack resistance of biometric sy

th NPL / CPNI evaluation 

5. Issues in evaluating attack resistance 
Rationale 

Quotes on the web 

 We claim that we can fake every sensor ...  Fingerprints in particular are laughably easy to spoof.... 

But ... 

 Are some systems harder to spoof than others 

 e.g. systems with fake finger detection 

 Are biometrics easier to spoof than other components of y Are these attacks relevant for your use case? 

Measures of attack resistance are needed that .... 

 Distinguish between good and poor attack resistance 

 Broad equivalence of metrics over different biometric te

 Relate attack resistance to the use case & risk assessmen

 Commensurate with security levels of other system com
Terminology 

Attack 

 This talk focuses on attacks at 

the sensor / terminal, including: 

 Artefact  Tamper  Bypass 

Level of an attack 

 Difficulty or level of 

sophistication of the attack 

System resistant to 

 Prob[ Attack Succe

is su

 Prob[ Attack detec

is su

Level of attack resis

 Attack resistance a

implies the system attacks at level n o
CPNI Classification for Security Products 

Guidance, standards & evaluation for ... 

 Automated access control  Intruder detection  Barriers 

... 

 Biometrics used in access control 
CPNI/NPL Evaluation of Biometric Authenticatio

for Automated Access Control Systems (AACS

Use case 

 Access to controlled area within site  Biometrics as 2nd authentication factor 

 combined with prox card  independent of prox card 

 Trusted administration staff 

 Attacker must impersonate a properly 

enrolled identity 

Evaluation 

 Evaluate biometric subsystem only 

 Security of dependent AACS system 

evaluated separately 

 Assure security at the same level as 

the rest of the AACS 

Si

Controlle
CPNI Evaluation Standard for 

Biometric Access Control 1. Security-related functionality 

 Admin & operator access: (i) Authenticated (ii) NOT at  Reference storage: (i) NOT in device at portal (ii) NOT  Communications with AACS: (i) Protected (ii) Alert on 

 Check on installation 

2. Biometric performance requirements 

 FAR < 0.1% & requirements on FRR, FTE, Transaction 

 Scenario test 

3. Attack resistance 

 CPNI Grading depends on level of attack resistance 

 Spoofing  Tamper 

... 

 Practical assessment 
Testing Attack Resistance 

Variety of types of attack 

 Zero-effort impostor – e.g. targeting lookalike  Fake finger, fake iris, ...  Tamper 

 Remove from wall, Connect attacker’s PC to terminal o

 Exploiting poor quality enrolment, ... 

Attack assumptions for the evaluation (based on use cas

 Attacker has obtained possession of a user’s prox card  User is known and accessible to acquire a biometric imag Attacks to be made at same security settings as used in d

verification performance 

Attack resistance 

 System considered resistant to an attack if < 5% of attacks 

succeed 
Attack Levels of CPNI Grading System 

Resource level Low Medium 

Domestic / High Street 

Trade / Specialist 

Skill & knowledge level 

Low None 1 2 

Knowledge of Medium Product / 2 4 Techniques 

High Expert 3 5 
CPNI Grading System 

Attack Protection Level System 

1 

Base 

2 3 

Enhanced 

4 5 

High 6 
Example Attack Levels: Fake Fingerprint 

Home / High St. 

resources 

Trade / specialist 

supplier 

Novice 

No special 

knowledge/skill 

1 2 

Knows product 

& techniques 

2 4 

Expert 3 5 
Knowledge and Resource Requirements to 

Fake Fingerprints 

Step Resource KnowAcquire fingerprint image 

Latent print Low Med 

Fingerprint scanner Med Low Generate from template High 

Make mould 

Direct impression Low-Med Low 

Engrave / etch from image High Med Low Med 

Make fingerprint artefact 

Depends on material Depe

Present artefact at terminal 

Without practice Low With practice & Med-knowledge of device 
Knowledge and Resource Requirements to

Fake Iris 

Step Resource Know

Acquire iris image 

Camera phone / SLR Low Low 

Iris camera Med Low Generate from iriscode High Image enhancement/selection Med 

Reproduce iris image 

Print Low Low Film Low Med Contact Lens / Glass eye High High 

Present fake eye(s) at terminal 

Without practice Low With practice & knowledge of Med device 
Example attack levels: Fake iris 

Home / High St. 

resources 

Trade / specialist 

supplier 

Novice 

No special 

knowledge/skill 

1 2 

Knows product 

& techniques 

2 4 

Expert 3 5 
General Findings: Liveness / Artefact Detection 

Different methods of preventing use of fakes 

 “Liveness/non-artefact” properties required to enable ima Built in sensor measures properties associated with real c Algorithmic processing of captured images 

Choosing the setting for fake detection 

 If enabled: Level of attack resistance generally higher  Stricter settings: Reduced chance of successful attack (b

Can also significantly increase FRR 

Successful attacks at level 3 & 4 (fingerprint) 

 Finding “right” material for device – catastrophe: all attack Tuning of methods – attack success rate increases with e

 Sometimes indirect signal that a fake is detected 

Our use case eliminates some of the easier spoofing att

 E.g. recognition against an enrolled artefact 
General Findings: Security Functionality & Tam

Protection Many biometric terminals provide configuration options 

render the system less secure 

 Door relay on device  Templates stored on device – on removable media  Admin controls on device at portal for enrolment / disable 

Better tamper protection often needed Knowledge of product/techniques: 

 Available on the internet (for the medium level attacker) 

 Tutorials on basic fake fingerprint attacks  Manuals for several biometric systems with details of e.

 tamper switch location  default passwords 

 Software for some systems 
Issues in Evaluating Attack Levels 

Sufficient coverage of types of attack at each level? 

 Determined by expert review (incl. CPNI & Test Organisati Difficulty to thoroughly test new/novel biometric modalities 

Limits to what can be tested through real use: 

 No skin transplants, or severed fingers in our evaluation  Skill level of test personnel quickly increases from novice l

attacks are made 

Attacks get easier over time – need to review levels regu

 New vulnerabilities are found  Expert knowledge becomes available on internet  Black market in helping people spoof systems  Ways to exploit legitimate services e.g. 

 Mingpao Daily journalist successfully spoofed a biometrics dev

Kong-China self-service immigration clearance channel with fiproduced by a HK$110 fingerprint cast kit bought on Taobao
Your Questions & Comments 

Contact details for offline comment & questions  Tony.Mansfield@NPL.CO.UK