Biometrics and Id

Assu

Dr. Colin S

CSC Identit
Identity 

• Identity is no longer solely based on physical credentials • Identity is becoming an entity that is independent from entitlem• Access to identity-enabled applications is becoming more ubi

(internet, cell-phones etc.) 

Consumer 

Banking 

Social Networking 

On line shopping

Marketing Data 

Identity 

Citizen 

Taxes Employee 

Passport HR 

Immigration Payroll 

Health Care Physical Access 

Voting IT Access 

Driver’s License 

CSC Iden
Identity and Biometrics 

• Identity of an Individual is established as a composite of 

components of Personally Identifiable Information (PII): 

– Biographical information – name, DOB, address, etc. – Physiological information – i.e. biometrics 

– Documents – passports, birth certificate – Events and knowledge – i.e. high school, memorable place, mother’s maiden n

• Identity Proofing 

– Determination of the uniqueness of an Individual’s claimed Identity 

• Identity Management System 

– Governs the permissions, privileges, benefits and rights (Entitlements) of an in

an Enterprise

– The requirements for establishing an “Enterprise Identity” are usually a subse– A Credential that links the Enterprise Entitlement to the Individual is usually is

physical or logical token) 

– Identity Authentication is used to verify that the individual is the valid “holder” 

credential 

– Authorization is an Enterprise-level function that verifies that the individual is 

eligible for the entitlement 

CSC Iden
Privacy 

• Jurisdictionally-defined rights and obligations • Individual Control of Personal and Identity Information • Biometric data is Personally Identifiable Information (PII) AND 

Data 

• Consent, Limited Use, Safeguards, Data Protection 

CSC Iden
Identity/Identifiers/Authorization 

Employee 

Identifiers... 

Id ientty 

Biometrics 

etc. 

Identifiers... 

Identifiers... Consumer 

Citizen 

CSC Iden
Identity and Privacy Assurance 

Individual 

Safeguarding 

of 

CSC Iden

Identity Data 

Privacy Assurance Identity A

Levels of 

Identity 

Assurance 
Identity Assurance -> Enterprise 

Identity Identity Iden

Assurance = Authentication + Proo

(transaction) (transaction) (enrollm

Ability to Strength of Uniqu

Support Level Performance of Id

of Assurance 

(LOA) Assurance of Interop

Conformance 

CSC Iden
Biometric Identification and Verification 

• Biometric Identification used as part of Identity Proofing • Biometrics for Identity Proofing needs to be able to distinguis

in a large population 

• Biometric Verification used on a daily basis as part of an auth

mechanism 

• Biometric Verification V ifi i modality or algorithms l i h (and thus l 

h templa

not be the same. 

• Verification needs to authenticate a user to a certain assuran

CSC Iden
Privacy Assurance -> Individual 

Identity 

Assurance 

( itransaction) 

Enables 

transaction 

and protects 

Account 

Identity 

Authentication 

( itransaction) 

Maintains 

ongoing 

Integrity of 

Identity Data 

Iden

+ Proof

( llenrom

Estab

Uniquen

Entitleme

CSC Iden
Kantara Identity Assurance Framework 

• Establish the trustworthiness of Services in Identity system • c.f. the delegation of trust via PKI or other architecture • Common Operating Criteria (CO) 

• Credential Management (CM) g 

• ID Proofing (ID) • Privacy Profile • Some privacy environments require separation of CM and ID 

CSC Identi
Identity Assurance 

Levels of 

Identity 

Assurance 

Risk 

•To: 

•Enterprise 

•Entitlem•Security 

•Individual 

•Privacy •Loss of 

CSC Identi
Risk – Biometric Technologies 

• False Results, Security Breach, Spoofing • Relatively Mature and Controllable in Identity Proofing Scena

– Large scale system evaluation – Supervised 

• Mitigates spoofing 

– Secure Storage 

• Not so well defined in Identity Authentication Scenarios 

– Remote authentication – Non-supervised – Varying Systems (and Performance) 

• Sensors • Algorithms 

– Conformance required, not necessarily interoperability 

CSC Identi
INCITS M1 Ad Hoc on E-authentication (2005) 

• There is a role for biometric authentication at each of the four 

levels defined in OMB M-04-04 

– Map Levels of Performance to resulting level of Identity Assurance 

• Biometric authentication can provide significant benefits in ce

situations, not least of which is the tight binding of the authentevent to the physical presence of a human claimant 

– Evaluate Biometric Performance on Varied Platforms 

• Some additional challenges and threats accompany the use o

authentication, but countermeasures exist to address them 

– Vulnerability Testing 

• Biometrics present a different paradigm than traditional authe

methods where authentication data is always secret. 

– Evaluate Template Protection Techniques – Align quantified performance with other authentication factors 

CSC Identi
Conclusions 

• Mobile devices are being used to access more applications 

– Need to bind device to individual – Many mobile devices available with biometric technologies – Lack of clarity on Identity and Privacy Assurance capabilities 

• Biometrics can be used to strongly bind an individual to ident

– Mitigate Identity Theft and protect personal data – Provide a strong degree of Identity Assurance 

– Trusted Identities as the basis for Identity Federation 

• Identity and Privacy Assurance relies on two distinct process

– Identity Proofing and Identity Authentication – Potentially different Privacy, Interoperability and Performance Req

• Biometrics need to demonstrate system conformance and qu

performance. 

– ISO SC27 WG5, ISO SC37 WG 6, ITU-T SG17, and others on IDM – Common Criteria – NVLAP 150-25 

CSC Identi
Que

csoutar@c

416 64

CSC Identity