Security issues of Internet-based biometric authentication systems: risks of Man-in-the-Middle and BioPhishing on the example of BioWebAuth

Christian Zeitz; Tobias Scheidat; Jana Dittmann; Claus Vielhauer; Elisardo González Agulla; Enrique Otero Muras; Carmen García Mateo; José L. Alba Castro

doi:10.1117/12.767632

18 March 2008 Security issues of Internet-based biometric authentication systems: risks of Man-in-the-Middle and BioPhishing on the example of BioWebAuth

Christian Zeitz, Tobias Scheidat, Jana Dittmann, Claus Vielhauer, Elisardo González Agulla, Enrique Otero Muras, Carmen García Mateo, José L. Alba Castro

Author Affiliations +

Proceedings Volume 6819, Security, Forensics, Steganography, and Watermarking of Multimedia Contents X; 68190R (2008) https://doi.org/10.1117/12.767632
Event: Electronic Imaging, 2008, San Jose, California, United States

Abstract

Beside the optimization of biometric error rates the overall security system performance in respect to intentional security attacks plays an important role for biometric enabled authentication schemes. As traditionally most user authentication schemes are knowledge and/or possession based, firstly in this paper we present a methodology for a security analysis of Internet-based biometric authentication systems by enhancing known methodologies such as the CERT attack-taxonomy with a more detailed view on the OSI-Model. Secondly as proof of concept, the guidelines extracted from this methodology are strictly applied to an open source Internet-based biometric authentication system (BioWebAuth). As case studies, two exemplary attacks, based on the found security leaks, are investigated and the attack performance is presented to show that during the biometric authentication schemes beside biometric error performance tuning also security issues need to be addressed. Finally, some design recommendations are given in order to ensure a minimum security level.

Citation Download Citation

Christian Zeitz, Tobias Scheidat, Jana Dittmann, Claus Vielhauer, Elisardo González Agulla, Enrique Otero Muras, Carmen García Mateo, and José L. Alba Castro "Security issues of Internet-based biometric authentication systems: risks of Man-in-the-Middle and BioPhishing on the example of BioWebAuth", Proc. SPIE 6819, Security, Forensics, Steganography, and Watermarking of Multimedia Contents X, 68190R (18 March 2008); https://doi.org/10.1117/12.767632

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available