Biometrics and (IT) Security 

Axel Munde 

German Federal Office for Information Security 
Motivation 

Actual situation of biometrics in governm

environment 

• Issuing of biometric enabled Passports and ID Ca

only (38%) and Finger (62%)) in 94 states worldw

• About 360 millions of ePassports / (ID Cards) are • Increasing use of biometrics in border control (16 

using ABC) 

• 30 ICAO participating states • Mandatory taking fingerprints for applying for a Sc

Visa / European Union 

Numbers published by US State Department in Sept. 2011 

Axel Munde March 2012 
Motivation 

• Increasing numbers of passengers • Assured transfer time of passenger – Economic 

for airport operating companies 

• Mandatory biometric usage for Schengen Visa 

Question? 

Why not use biometrics for ePassport (verificatioVisa (identification) in a self service environment border control and visa request? (Increasing natsecurity and speeding up processes) 

Axel Munde March 2012 
Content 

• Biometrics and (IT) Security / Faking Biometrics (Fing• Common Criteria 

– Structure – Security functional and Assurance classes – Evaluation Assurance Level (EAL ) – Biometric Protection Profiles – Attack potential and Examples (Fake detection) 

• Methodologies for evaluation of fake detection (Finge• Summary 

Axel Munde March 2012 
Biometrics and (IT) Security 

Biometric characteristic (refined from SC37HBV) Biological or behavioural characteristic of an individcan be detected and from which distinguishing, re

biometric features can be extracted for the purpose automated recognition of individuals (e.g. fingerpr Biometrics is a (IT) means to ensure the „identity Has to fulfill the „traditional“ IT (security) requirem

Axel Munde March 2012 
Biometrics and (IT) Security 

Challenges of Biometrics 

1. FAR / FRR – Statistical properties (BEM <=> SC

Standards) 

2. Strong and weak biometrics and the “Zoo” (User 

depending) – Quality related? 1. and 2. – No (technical) tools used for attackin

3. Attacks on biometric systems using fakes  In the following only direct attacks, using faked b

(limited to fingerprints). 

 Are Common Criteria (CC) adequate to addres

security challenges? 

Axel Munde March 2012 
Producing Fakes 

Raw finger image 

Digitizing, enhancing 

and modifying 

Printing 

wood glue 

„Wie können Fingerabdrücke nachgebildet werden? 09. Oktober 2004 (starbug)“ 

http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?language=de http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?language=en 

Axel Munde March 2012 
Faking biometrics - Fingerprints 

“ The trust in biometric systems depends on their reliAND their level of security!” 

There are many types of publicly known fakes 

... and a wide range of variations 

With little experience fakes are: 

made of cheap & easy obtainable materials relatively easy to produce able to deliver high quality fingerprints adaptable by additives like: magnetic powder, col

The challenge for spoof detection is to distinguish betweexisting human fingers and all possible spoofing material 

Axel Munde March 2012 
Common Criteria in a Nutshell 

2009: Common Criteria 

Version 3.1 Release 3 ISO/IEC 15408:2009 

Homepage: www.commoncriteriaportal.org 

Axel Munde March 2012 
Common Criteria (V 3.1) - Structu

• Consists of 3 or 4 parts: 

 Part 1: Introduction and general model 

 Part 2: Security functional components 

 Part 3: Security assurance components 

• Instructions for the evaluation are given by the Comm

Evaluation Methodology (CEM) (Part 4) 

• Protection Profile (PP) – Implementation independent 

of a TOE type 

• Security Target (ST) – Implementation dependent des

specific TOE – Could base on evaluated PP 

Axel Munde March 2012 
Common Criteria (V 3.1) - Evaluat

• Evaluated will be Security Target, configuration ma

delivery procedures, design documentation, guida

documentation as well as development and produc

• Product testing and vulnerability analysis • Evaluation is structured in 7 level, so-called Evaluatio

Level, short EAL-Level (Assurance Packages) 

• Raised depth of evaluation (trust) from EAL 1 – 7 • Raised requirements for documentation, development 

production sites, intensity of the evaluation and resistaattackers 

Axel Munde March 2012 
Common Criteria (V 3.1) – EAL Le

EAL1- functional tested EAL2 - structural tested EAL3 - methodical tested and checked EAL4 - methodical designed, tested, and reviewed Up to EAL4 international mutual recognition of evaluation (CCEAL5 - semiformal designed and tested Mutual rec

EAL6 - semiformal verified design and tested EAL7 - formal verified design and tested 

Axel Munde March 2012 
Common Criteria (V 3.1) – Part 2

Security Classes 

• CLASS FAU: SECURITY AUDIT • CLASS FCO: COMMUNICATION • CLASS FCS: CRYPTOGRAPHIC SUPPORT • CLASS FDP: USER DATA PROTECTION • CLASS FIA: IDENTIFICATION AND AUTHENTICATION • CLASS FMT: SECURITY MANAGEMENT • CLASS FPR: PRIVACY • CLASS FPT: PROTECTION OF THE T(OE) S(ecurity) F(un• CLASS FRU: RESOURCE UTILISATION • CLASS FTA: TOE ACCESS • CLASS FTP: TRUSTED PATH/CHANNELS

Axel Munde March 2012 
Common Criteria (V 3.1) - Part 3 

Assurance Classes 

• CLASS APE: PROTECTION PROFILE EVALUATION • CLASS ASE: SECURITY TARGET EVALUATION • CLASS ADV: DEVELOPMENT • CLASS AGD: GUIDANCE DOCUMENTS • CLASS ALC: LIFE-CYCLE SUPPORT • CLASS ATE: TESTS • CLASS AVA: VULNERABILITY ASSESSMENT • CLASS ACO: COMPOSITION 

Axel Munde March 2012 
Axel Munde March 2012 
Biometric Protection Profiles – A

Overview 

1. Archived U.S. Government Approved Protection Profil

Government Biometric Verification Mode Protection PBasic Robustness Environments, Version 1.0 http://www.niap-ccevs.org/pp/PP_BVM_BR_V1.0/ Date: 12 January 2006 – Common Criteria Version: 2.3 

Not assigned to any Validated Products 

2. Archived U.S. Government Approved Protection Profil

Government Biometric Verification Mode Protection PMedium Robustness Environments, Version 1.1 http://www.niap-ccevs.org/pp/PP_BVM_MR_V1.1/ Date: 25 July 2007 – Common Criteria Version: 2.3 

Not assigned to any Validated Products 

Axel Munde March 2012 
Biometric Protection Profiles – A

Overview 

3. Biometric Device Protection Profile (BDPP) 

http://www.cesg.gov.uk/policy_technologies/biometrics/media/bdDate: 5. September 2001 – Common Criteria Version: 2.3 

Ever used? 

5. Protection Profile - Biometric Verification Mechanisms Versio

(BSI-PP-0016-2005) – Evaluated PP 

https://www.bsi.bund.de/ContentBSI/Themen/ZertifizierungundArtifierungnachCCundITSEC/SchutzprofileProtectionProfile/schutz

P0016 

Date: 17. August 2005 – Common Criteria Version: 2.3 Based on PP 1. - 3. – Used for 2 Products – 1 under re-evaluation 

4. Biometric Verification Mechanisms Protection Profile Version 

(BSI-CC-PP-0043-2008) – Evaluated PP https://www.bsi.bund.de/ContentBSI/Themen/ZertifizierungundArtifierungnachCCundITSEC/SchutzprofileProtectionProfile/schutz

P0016 Date: 07. August 2008 – Common Criteria Version: 3.1 Rev 2 

Axel Munde March 2012 
Biometric Protection Profiles – A

Overview 

6. Fingerprint Spoof Detection Protection Profile (FSDPP), Ver

(BSI-CC-PP-0063-2010) https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Zertif

ePP/pp0063b_pdf.pdf?__blob=publicationFile Date: 23th November, 2009 – Common Criteria Version: 3.1 Rev 

2 Products under evaluation 

7. Fingerprint Spoof Detection Protection Profile based on Org

Security Policies (FSDPP_OSP), Version 1.7 (BSI-CC-PP-0062-2010) https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Zertif

ePP/pp0062b_pdf.pdf?__blob=publicationFile Date: 27th November 2009 – Common Criteria Version: 3.1 Rev 

Axel Munde March 2012 
How to calculate Attack Potentia

- Elapsed Time 

-

Elapsed Time Factor Value 

<= one day <= one week <= two weeks <= one month <= two months <= three months 1<= four months 1<= five months 1<= six months 1> six months 1

Axel Munde March 2012 
How to calculate Attack Potentia

- Expertise and Knowledge of TO

Expertise Factor Value 

Layman Proficient 

3

Expert Multiple experts 

Knowledge of TOE 

Public Restricted Sensitive Critical 

(1) When several proficient persons are required to complete th

path, the resulting level of expertise still remains “proficient” (wto a 3 rating). 

Axel Munde March 2012 
How to calculate Attack Potent

- Window of Opportunity and Equip

Window of Opportunity Factor Value 

Unnecessary / unlimited access Easy Moderate Difficult None 

Equipment Factor Value 

Standard Specialised Bespoke Multiple bespoke 

(2) Indicates that the attack path is not exploitable due to other measuintended operational environment of the TOE. (3) If clearly different test benches consisting of specialised equipmenrequired for distinct steps of an attack, this should be rated as bespo

Axel Munde March 2012 
How to calculate Attack Potentia

- The Result -

Attack Potential = Elapsed Time + Expertise + Knowle

of TOE + Window of Opportunity + 

Values Attack potential TOE resistant Meets F

required to exploit to attackers assurance cscenario: with attack components 

potential of 

0-9 Basic No rating - A

10-13 Enhanced-Basic Basic AVA_VAN.1 - .2 A14-19 Moderate Enhanced- AVA_VAN.1 - .3 A

Basic 

20-24 High Moderate AVA_VAN.1 - .4 A

=>25 Beyond High High AVA_VAN.1 - .5 

Axel Munde March 2012 
(Fake) Attack Potential 

- Examples -

1. Example – Fingerprint System No fake detection; system commercial available; iin internet, unlimited access 

Elapsed Time 

<= one week 1 

Expertise Layman 0 

Knowledge of TOE 

Public 0 

Window of Opportunity 

Unnecessary / unlimited access 

0 

Equipment Standard 0 

 Attack potential is 1  Fails EAL1 

Axel Munde March 2012 
(Fake) Attack Potential 

- Examples 

-

2. Example – Fingerprint System Fake detection; system commercial available; informinternet, limited access (Supervised) 

Elapsed Time 

<= one week 1 

Expertise Proficient 3 Knowledge of TOE 

Public 0 

Window of Moderate 4 Opportunity Equipment Standard 

0

 Attack potential is 8  Fails EAL1 

Axel Munde March 2012 
(Fake) Attack Potential 

- Examples 

-

3. Example – Fingerprint System Sophisticated fake detection1); system not commerci

information not in internet, limited access (Supervise

Elapsed Time 

<= one month 4 

Expertise Proficient 3 Knowledge of TOE 

Restricted 3 

Window of Moderate 4 Opportunity Equipment Standard 

0

 Attack potential is 14 (Moderate Attack Potential)  System can be evaluated up to EAL4 1) In terms of fake recognition rate 

Axel Munde March 2012 
Summary of Examples 

• In examples no Brute force and Hill-Climbing 

have been taken into account 

• At the moment no fake detection available which 

CC evaluated - Fails even EAL 1 

• Fingerprint sensor can be spoofed with relatively 

fakes 

• Some sensors recognize a subset of the availab• For a sensor usually a “golden” fake could be id

that worked reproducible 

• In order to rate the performance of current and f

spoof detection technologies there is a need for comprehensive evaluation methodology 

 Need to develop of “Fingerprint Spoof Detection 

Methodology” 

Axel Munde March 2012 
Supporting Documents on Evaluat

on Fake Detection (but not limited 

1. Characterizing Attacks to Fingerprint Verificatio

Mechanisms 

Version 2.0 – 2010 CCDB-2008-09-002 Date: 2010 - 12 

2. Fingerprint Spoof Detection Evaluation Guidan

Version: 2.1 Date: 2009 – 12 - 18 

Axel Munde March 2012 
Characterizing Attacks to Fingerpr

Verification Mechanisms (1.) 

Provides guidance about attack methods to be consin the evaluation of TOEs with fingerprint verification mechanisms. Addresses also the standardization of the security rthis type of mechanisms and include examples for tattack rating. (Re-introduction of Exploitation and Identification of a vulnerability) Developed by: Spanish National Cryptologic Centre (CCN) and the Biometric Recognition Group - ATVS of the AutonomUniversity of Madrid (UAM). 

Axel Munde March 2012 
Fingerprint Spoof Detection

Evaluation Guidance (2.) 

• Introduction of “new” extended Vulnerability Compo• Based on component used in EAL2 evaluations (To 

developers testing and vulnerability analysis) 

• Requires resistance against “minimal” attack potent

of “basic” attack potential 

• Evaluations of Spoof Detection System shall alway

Flaw Remediation – To update spoof detection 

Value Resistant against attackers with attack potential of: 

0 – 4 No rating 

5 – 9 Minimal 

10 – 13 Basic 14 – 19 Enhanced-Basic 20 – 24 Moderate 

>= 25 High 

Axel Munde March 2012 
Fingerprint Spoof Detection

Evaluation Guidance 

Testing methodology: 

• Main focus: Examination whether spoof detection functio

to detect spoofed biometric characteristics with a sufficie

• Determination of security relevant error rate: False Spoof 

Rate (FSNDR)

• Determination using a standardized Fake-Toolbox 

Vulnerability assessment: 

• Addresses slight modifications to the “most effective” fake

used in ATE and innovative fakes adopted to the specific They must not lead to changes of error rates. 

• The evaluation guidance provides interpretations of the C

units, gives help in finding the most promising fake and gexamples for relevant attack scenarios together with exam

The TOE has not to miss the maximum error rate for eac“golden” fake as well, that is presented to the system. 

Axel Munde March 2012 
Summary 

1. Biometric systems without fake detection are fa

lowest IT security requirements 

2. Using biometric systems without security prope

the possible attacks by fakes have to be addresorganizational means 

3. First steps are made to formulate a methodolog

„measure“ the risk of fakes. 

4. Some Manufacturers improving the fake recogn

capability of their products – 2 CC evaluation a

5. Foundation of a technical domain within CC co

or ISO for “Security Evaluation of Biometrics” 

6. After having a methodology for fingerprint gene

for other biometrics 

Axel Munde March 2012 
Contact 

Federal Office for Information (BSI) Axel Munde Godesberger Allee 185-189 53175 Bonn Tel: +49 (0)22899-9582-5342 Fax: +49 (0)22899-10-9582-5axel.munde@bsi.bund.de www.bsi.bund.de www.bsi-fuer-buerger.de 

Axel Munde March 2012