Tytuł prezentacji 

Call for coopera+on: 

network of biometric tes+ng 

laboratories 

Adam Czajka 

Marcin Chochowski

Biometric Laboratories, NASK 

Warsaw University of Technology  

Warsaw, Poland, www.BiometricLabs.pl 

IBPC 2010, March 3, 2010 

NIST Gaithersburg, MD 
The idea of testing labs network - how it evolved 

• Biometrics projects  

• Evident need for cooperaCon 

• Databases 

• CollecCon problemaCc and costly 

• ScaEered and heterogeneous data (e.g. different race) 

•  Enlarging number of teams and tes+ng ac+vi+es  

• Hard to follow the knowledge 

• Different tesCng protocols 

• Security concerns 

• Large scale of new deployments 

• Inadequate harmonizaCon 

• Need to increase society awareness – who is currently the 

best authority to do it? 
Common interest 

• Who will suffer the consequences of frauds in biometrics? 

• Failure of biometrics X influences enCre biometric business (even 

vendors of biometrics Y) 

• Knowledge exchange in the underground world is much faster than in 

academia or industry 

• It seems there is no place where the informa+on about biometric frauds, 

aUacks and vulnerabili+es is systema+cally collected and published 

• Purpose: idenCficaCon of trends, threats, staCsCcs etc. 

• There is no contradic+on between coopera+on and compe++veness 

among the players 

• Economical aspects 

• Reducing the costs of biometric systems deployment due to 

recommendaCons of trusted tesCng laboratories 

• Weaknesses disclosure first of all to vendors (and to the public – 

rather as the last step) 

Adam Czajka, adam.czajka@nask.pl 

Marcin Chochowski, marcin.chochowski@nask.pl 
Adam Czajka, adam.czajka@nask.pl 

Marcin Chochowski, marcin.chochowski@nask.pl 

Network security analogy (CERT) 

• The wake‐up call: late 1980s, first global worm (Morris)  

• Sudden awareness of a strong need for global cooperaCon 

• Over the years IT security specialists worked out the 

coopera+on models of CERT teams 

• ReacCve services (alerts and warnings, vulnerabiliCes analysis 

and handling ...) 

• ProacCve services (technology watch, security audits security 

tools ...) 

• Security quality management (risk analysis, security 

consulCng, product evaluaCon and cerCficaCon ...) 

For further details on CERTs cooperaCon see: „CERT CooperaCon and its further 

facilitaCon by relevant stakeholders”, ENISA Deliverable WP2006/5.1 (CERT‐D3), 

available at: hEp://www.enisa.europa.eu/act/cert/background/coop
Models of coopera+on and trust 

• Centralized authority is not a good idea 

• This idea failed e.g. in CERT model 

• Bilateral team‐team coopera+on 

• Associa+on of teams 

• Coopera+on between associa+ons 

• Sector coopera+on 

• Government, industry, academic, region, ... 

• Legal aspects  

• NDA, MOU, contract, ToR ... 

• Trust models  

• Bilateral and mulClateral agreements, sponsorship 

• AccreditaCon (yet has some limitaCons) 

• procedures take Cme 

• requirement of independency 

• legal aspects (different in each country) 

Adam Czajka, adam.czajka@nask.pl 

Marcin Chochowski, marcin.chochowski@nask.pl 
Adam Czajka, adam.czajka@nask.pl 

Marcin Chochowski, marcin.chochowski@nask.pl 

Things to think over 

• Need for confidence 

• Financial aspects 

• Assurance of quality (the base of trust) 

• Differences in legal systems 

• Organisa+onal and poli+cal support 
Example: Polish Pla`orm for Secure Implementa+on of Biometrics 

• Areas of coopera+on 

• Development of tesCng methodologies (including 

legal aspects) at three tesCng levels (lab, real and 

operaConal scenarios) 

• InformaCon, knowledge and experCse exchange 

• Tools, best pracCces 

• Resources exchange 

• Common mulCmodal database collecCon, including 

data for template ageing assessment

• Consor+um 

• Warsaw University of Technology (coordinator) 

• Research and Academic Computer Network NASK 

• Polish Security PrinCng Works PWPW S.A.  

• Department of  CriminalisCcs, Warsaw University 

• Project co‐sponsored by the Polish Ministry of 

Science and Higher Educa+on within Country’s 

Defense Programme 

Adam Czajka, adam.czajka@nask.pl 

Marcin Chochowski, marcin.chochowski@nask.pl 
Adam Czajka, adam.czajka@nask.pl 

Marcin Chochowski, marcin.chochowski@nask.pl 

What is your opinion ? 

 Adam Czajka 

Marcin Chochowski

Biometric Laboratories, NASK 

Warsaw University of Technology  

Warsaw, Poland, www.BiometricLabs.pl