Fahad Al Mannai IT 104 C01 7/8/2016. Biometrics Authentication: An Emerging IT Standard

Transcription

1 1 Fahad Al Mannai IT 104 C01 7/8/2016 Biometrics Authentication: An Emerging IT Standard "By placing this statement on my webpage, I certify that I have read and understand the GMU Honor Code onhttp://oai.gmu.edu/the-mason-honor-code-2/ and as stated, I as student member of the George Mason University community pledge not to cheat, plagiarize, steal, or lie in matters related to academic work. In addition, I have received permission from the copyright holder for any copyrighted material that is displayed on my site. This includes quoting extensive amounts of text, any material copied directly from a web page and graphics/pictures that are copyrighted. This project or subject material has not been used in another class by me or any other student. Finally, I certify that this site is not for commercial purposes, which is a violation of the George Mason Responsible Use of Computing (RUC) Policy posted on web site."

2 2 Biometrics Authentication: An Emerging IT Standard Introduction In your favorite science fiction movie from a long time ago, there is very likely a character who approaches some sort of interface and gains access with something like a retinal scan or putting his finger onto a fingerprint reader. Such technologies used to be the domain of science fiction, but advances in technology mean that this type of access control is the reality of today. In this paper we will speak about the future of biometrics authentication and how it has evolved in recent years. It is interesting when you think of it that if this word was thrown around in the past it would mean any form of authentication, like a passport or a driver s license. And now all these new IT terms would not make sense to many people because the world as become simpler yet confusing. This scenario is an example of biometrics authentication. Biometrics authentication is an application of biometrics. Biometrics are metrics that come from physiological aspects of humans, such as the aforementioned retina or fingerprint example, but also inclusive of things like how someone walks or talks, even (Reid, 2003). Biometrics extend beyond these examples to include any physiological aspect of humans that is shared that can be used as a way of identifying, assessing, and measuring persons (2003). Biometrics are increasingly used as a means of authentication in the information technology world in the place of earlier concepts like passwords because of their significantly greater ability to demonstrate security (Boulgouris et al, 2010). Therefore, biometrics authentication is using biometrics as a means of authenticating users. In the previously mentioned example, the biometrics are the fingerprint and retina, and the biometrics authentication is the use of technology to authenticate the user using any one or combination of biometrics.

3 3 Biometrics authentication represents a new stage in information technology security, but it is not without its own collection of benefits and detriments. Its history is mostly one that takes place from the late 20 th century till now, once digital technologies became capable of using biometrics as a means of authentication (Reid, 2003). Biometrics authentication has primarily security benefits due to the unique nature of biometrics, which makes it a boon for information technology, where security is and always has been a major issue. Additional benefits include less user responsibility overall. Yet the highly personal nature of biometrics authentication, coupled with the fact that users defer a lot of authority to information technology systems, mean that biometrics authentication is controversial for privacy and access reasons. Despite this combination of benefits and detriments, biometrics authentication is fast becoming the norm in information technology worldwide. It is therefore important that persons in the field of information technology approach this subject with an attitude of acceptance and enhancement to make sure that this emerging standard lives up to its potential as an improvement over older systems and processes. Development and Significance of Biometrics Authentication Earlier forms of authentication in the world of IT were either knowledge or material (Clark, 2015). For example, a driver s license is a material form of authentication in that the person holding it needs to physically have it to demonstrate that they are who they say they are. Likewise, a password is a knowledge form of authentication in that the person needs to know the password in order to gain access to whatever system in question. These systems were developed per the technologies available at the time and were further developed accordingly. An example of this is how U.S. passports now include microchips as a means of making them more secure (2015). The development of biometrics authentication occurred in tandem with the availability of technologies that could allow it to go from a science fiction concept to reality. Therefore, there are still many material and knowledge based forms of

4 4 authentication that are prevalent in the world of information technology, but they are becoming less and less common as biometrics authentication takes precedence as the premier way of securing what matters to a given group as best as possible. Likewise, biometrics authentication is definitely a phenomenon that is becoming more common in a piecemeal and phased way. For example, many U.S. companies use a combination of biometrics and traditional authentication, such as the use of biometrics authentication for logging in and out of a workplace and knowledge based authentication for computer systems (Heller, 2015). Explanation of Biometrics Authentication: Technologies and Real-World Applications The biometrics authentication in existence today uses physiological and behavioral traits and associated assessment and tracking technologies as a means of reading them in order to approve or deny access to a given situation (Ratha et al, 2001). Therefore, biometrics authentication has a wide range of applications in about every information technology scenario. Overall, however, its primary function is to provide a layer of individualized security. The two main ways that biometrics authentication is used are therefore useragreed ways and surveillance ways. In ways that the user agrees to, an example is a workplace situation that requires a biometrics authentication in order to access a system. An example of this is an employee at a company who has his retina scanned and stored in a database. Then, when he wants to access a vault, for example, he stands before the retina scanner. The retina scanner scans his retina and matches the information received through the scan with the information on the database. If they match, and to whatever degree matching is defined by the system, the user is granted access to the system (Harinda and Ntagwirumugara, 2015). An example of surveillance application of biometrics authentication might be something like quickness of movement. This is a highly behavioral example that relates to how

5 5 someone behaves, as opposed to a physiological fact such as the nature of one s retina. Yet security systems can use things like movement analysis as a biometric for identifying potential security risks in public spaces due to the fact that such individuals often behave in such a way (2015). The reliability of biometrics authentication is tied closely to the reliability of a metric itself. These two examples demonstrate the difference. A retina, like a fingerprint, is something that remains standard over time in an individual. Behavioral aspects are more ambiguous and less reliable because they are not hard facts. Therefore, one overriding goal in biometrics authentication is the use of metrics that do not change over time or space (Reid, 2004). This is why biometrics like fingerprints, which are different for everyone, represent much more reliable means of authentication than ones like the blood pressure characteristics that are used in things like lie detector tests, due to the fact that fingerprints do not change and are indicative of a particular individual, whereas things like blood pressure characteristics are not one way for liars and another way for truth tellers, and different factors can produce many false positives and negatives. Therefore, biometrics authentication hinges significantly on the consistency of a biometric in multiple ways. Biometrics authentication is already an established application within information technology, but it continues to grow and change in terms of usefulness and popularity. For example, Heller (2015) predicts that biometrics authentication will become prevalent and omnipresent worldwide within the next five years in terms of their purported security benefits, amid global security concerns, and the astonishing pace at which biometrics applications and hardware for information technology have become standardized, reliable, and economical (2015). Likewise, the public is becoming more accepting than not of the use of biometrics authentication systems (Lee, 2015). Benefit, Legal, Ethical, and Security Issues Related to Biometrics Authentication

6 6 As the aforementioned facts on the rise in prevalence of biometrics authentication, biometrics authentication demonstrates a boon of benefits for all parties. An overriding element is power. Biometrics authentication necessitate that those in control of the systems have a strong hold on power over access by nature of the exact science of biometrics authentication. For example, someone might be able to enter another person s bank account using the person s account information and personal information as a means of knowledgebased access. Yet someone whose retina must be scanned to access bank data would certainly be protected to a nearly perfect degree, considering the fact that retinas are like fingerprints in their uniqueness. This scenario demonstrates a strong degree of power of the holder of the biometrics authentication means and standards since the system is so secure. In less theoretical and more immediate terms, there are significant benefits of biometrics authentication. Raju (2014) enumerates the benefits of biometrics authentication as providing accurate information and accountability due to the specificity of biometrics themselves, easy marketing and use due to the lower technology costs and standardization of systems, ease and safety of use such as how much time it saves to just walk by a camera as opposed to stopping to physically enter credentials, and versatility in terms of how factors can be manipulated by owners to a large degree. In short, biometrics authentication represents the next generation of authentication and surveillance in terms of the confluence of recently blossoming technologies. In these terms, it represents a preferred choice over traditional means such as knowledge or material means of authentication. However, ethically and legally speaking, material and knowledge based means of authentication may persist. Ethically speaking, although there is an overriding goal in biometric authentication to move to more certain biometrics and applied measures, this also presents a situation that many perceive as unethical. This is particularly true for surveillance (Chinchilla, 2010). For example, if there were a biometric that reliably and accurately always

7 7 positively identified persons who were not telling the truth, there are major ethical implications at stake, particularly in terms of privacy, but also in terms of safety (2010). Biometrics authentication therefore is strongly associated with the ethics of personal freedoms and security due to the highly personal and exact nature in which they engage with individuals and their lives. But these ethical concerns do not seem to be represented legally in the business world. For example, the use of biometrics authentication by private organizations such as businesses themselves have not been widely challenged around the world, yet this is not true for governments, particularly those in the West that are rooted in traditions of personal freedom (Boulgouris et al., 2010, pp ). For example, a major factor in the lack of use of biometrics in the U.S. is due to the legality of such use by government per U.S. laws (2010). Yet at the same time, biometrics authentication demonstrates, overall, and in reflection to the aforementioned discussion of power, a strong positive in terms of security. These previously discussed benefits, particularly power, and reliability, mean that biometrics authentication are more secure in the work that they do. One vulnerability is hacking, but such a vulnerability may be the only means to override a system (Chinchilla, 2010). Therefore, the security issues of biometric authentication are fewer than traditional means but at the same time more serious. Conclusion Biometrics authentication is the next technological and social stage of authentication. In terms of social and technological change, it seems to be here to stay due to the growing consensus that it is a wise next step and the growing benefits of associated technologies. However, as with all new and useful technologies, it is important for society to regulate them in a way that is in according with social principles about things like security, privacy, and power. Not doing so could be dangerous due to the fact that biometrics authentication

8 8 represents an unforeseen degree of power for the user. Furthermore, biometrics authentication must be controlled in itself in order to develop a preference for more reliable means of authentication as opposed to generalized ones due the fact that success rates drop significantly in accordance to increased uncertainty. Biometrics authentication therefore has a strong role to play today and in the future. However, it must be addressed with regulatory balance in order to facilitate its benefits and reduce its risks. Annotated Bibliography Boulgouris, N. V., Plataniotis, K. N., & Micheli-Tzanakou, E. (Eds.). (2010). Biometrics: Theory, Methods, and Applications. Hoboken, NJ: Wiley. This source is reliable because it is a collection of peer-reviewed papers that were edited by reputable writers in the field. It provides a wide range of information on the subject. It is therefore more of an anthology on biometrics. It was useful as an overview of the subject and its applications. It was specifically useful for its discussion on ethical issues. Chinchilla, R. (2010). Ethical Issues in the Use of Biometric Technology. Retrieved from Eastern Illinois University website: bcs.org/upload/pdf/ashaikh.pdf This is a reputable source because it was published by a reputable institution. Furthermore, the author s credentials demonstrate that he has many published, peerreviewed articles on this subject. This source was useful as an overview of the topic. Specifically, I used it to understand and explain the overriding ethical issues of biometrics and their solutions. Clark, B. (2015, March 4). The history of biometric security, and how it's being used today. Make Us Of. Retrieved on 7/1/2016 from

9 9 Biometric Update. Retrieved on 7/10/2016 from This resource was not as reliable as others due to the fact that it is an online magazine article. However, the author is published in the field. His article is also more explanatory and not contentious, so there is not as much concern for the information. Overall, it is useful as an overview of the subject. It was useful in demonstrating the history of biometrics authentication. Harinda, E., & Ntagwirumugara, E. (2015). Security & Privacy Implications in the Placement of Biometric-Based ID Card for Rwanda Universities. Journal of Information Security,06(02), doi: /jis This source is reliable because it is published in a peer reviewed journal. It was useful in exploring a particular application of biometrics authentication. Furthermore, it provided a review of the benefits and detriments of that application. I used it as a way of understanding ways around potential concerns in the application of biometrics authentication. Heller, M. (2015, January 22). Report: Popularity of biometric authentication set to spike. SearchSecurity. Retrieved on 7/10/2016 from This article was not as reliable as some other sources because it was published in a popular online magazine. However, the author is well published in the area of science writing. Furthermore, it is reporting the facts of a report rather than making a contentious claim. This article was useful in understanding the trends of biometric authentication. I used it to demonstrate the growing importance of the topic. Lee, J. (2015, July 15). Report shows growing public acceptance of biometric authentication.

10 10 of-biometric-authentication Likewise, this article was not as reliable as some other sources because it was published in a popular online magazine. However, the author is well published in the area of science writing. Again, it is reporting the facts of research. This resource was useful in understanding the current trends of biometric authentication. I used it to demonstrate the growing acceptance of biometrics authentication. Raju, R. (2014, April 7). The advantages of a biometric identification management system [Web log post]. Retrieved from on July Ratha, N. K., Connell, J. H., & Bolle, R. M. (2001). Enhancing security and privacy in biometrics-based authentication systems. IBM Systems Journal, 40(3), doi: /sj This source was not as reliable as others because it was a web log post. However, the author is published in the topic. Also, the claims were logically and factually sound, with evidence provided in the writing. This resource was useful in identifying the advantages of biometric identification. I used it to enumerate them in the essay. Ratha, N. K., Connell, J. H., & Bolle, R. M. (2001). Enhancing security and privacy in biometrics-based authentication systems. IBM Systems Journal, 40(3), doi: /sj This resource was reliable because it was published in a peer-reviewed paper. It provided a strong critique of the application of biometrics technologies such as authentication. It gave insights into future questions and concerns that need to be addressed in order to make biometrics authentication more user friendly and acceptable. I used it to demonstrate that constructive changes can be made.

11 11 Reid, P. (2004). Biometrics for network security. Upper Saddle River, NJ: Prentice Hall PTR. This book was reliable because it was published by a reputable publisher and written by a published author in the field of biometrics. It is older, but I used it to understand the basic ideologies and background of biometrics for network security, which have not really changed. It was useful in my research for understanding the history and underlying principles and goals of biometrics technologies.