Biometrics and Security in Smartphones Steven
Total Page：16
File Type：pdf, Size：1020Kb
Biometrics and Security in Smartphones Steven Bullard Efrain Gonzalez Carter Jamison Saint Leo University Saint Leo, FL, USA about security authentication, back-ups, passwords, etc. But we do not live in that Steven: perfect world. Things we physically own or Abstract: ideas we write down, including intellectual property, need protecting. In all honesty, the point of the fingerprint In this paper we look at the reader is to save time, and to force people to significance of biometrics, specifically implement some form of security on their fingerprint readers which have been devices, which often store very sensitive implemented into smartphones, primarily data. It is a cooler looking alternative to the iPhone 5S. The security of the inputting long strings of complex passwords technology is presented and analyzed while every time you want to unlock your device the security breaches and hacks are or authorize a transaction in the App Store. demonstrated in detail. We look at secure Humans are lazy and we want speed over options in Android vs. iOS. And we also most everything. Touch ID allows just that look at the future of biometrics and soon to while also supporting just as much, if not be wearable technology. We then propose more security than a passcode. the idea of two factor authentication and a fingerprint database. 2 Apple History Keywords: iPhone, Security, Touch ID, iOS, Android Officially founded in 1976 [1], 1 Intro garage-started Apple Computer went from being the laughingstock of the neighborhood in Palo Alto, California to a multinational Technology is ever changing. In a corporation with an incredible reputation for world like ours we are constantly seeking constantly revolutionizing different the next big discovery, invention, what have industries. While it was not taken seriously you. One of the biggest influences of our its first few years, Apple has been ahead of daily lives right now is the internet. With the game while laying cornerstones along that comes the idea of carrying the internet the way of technological advancement in our pocket, more specifically, the use of a within our world. Apple’s public offering of smartphone. Advances in smartphones $22 per share in 1980 jumped 32% in the requires equal advances in security. In a first day, instantly making 40 employees perfect world, we would not need to worry millionaires [2]. history of a dual device release. The iPhone 3 iPhone Evolution 5S with its notable fingerprint reader, and the 5C which adds a splash of plastic color, undoubtedly geared towards a younger In 2007 a revolutionary device was audience. Both these devices sold 9 million unveiled at Macworld conference, the units their first weekend and are now iPhone. Although smartphones had available in 47 countries around the world previously been around, none were quite [3]. like the iPhone. Combining three products into one: Internet browser, iPod (already a revolutionary device on its own), and 4 5S vs. 5C Cellular Communication. In June of 2007, the device was released to the public, selling 700,000 units on the first weekend. Although many people could not afford the device with a contract due to its outrageous price, so a year later the second generation iPhone (3G) was released at half the price, selling over 1 million units the first weekend. This also launched the App Store, a 3rd party feature that allowed anyone to develop an application using XCode and Fig 1 – iPhone 5S Touch ID Sensor upload to the store either for free or for a http://icdn2.digitaltrends.com/image/iphone-5s- designated price. fingerprint-sensor-details-625x417.jpg Again a year later, as we start to see a pattern, the 3G is given an internal So why did Apple choose to release overhaul, selling another 1 million units two devices at the same time? They opening weekend. In 2010, Apple decided probably wanted to create a more affordable to change things up a bit by reinventing the device for those who previously had not exterior of the phone, which had been been able to purchase Apple products due to roughly the same size and shape for three their notorious overpricing. The biggest years. The iPhone 4, along with its new noticeable difference between the two operating system which contained hundreds models (5S and 5C) is their exterior. The of fixes and updates also introduced a soon- 5C is made from a hard-coated to-be trademark feature that many Apple polycarbonate [4], which is just a fancy way fans were waiting for, the Retina display. of saying cheap China plastic, and the 5S is In 2011, Siri, the artificially made from aluminum like the previous intelligent companion was introduced along model. Internally, they are vastly different. with the iPhone 4S, selling a whopping 4 The 5S is sporting the new A7 processor, million units first weekend. In 2012 the which is a 64-bit kernel architecture, the first introduction of iPhone 5 changed the ever smartphone to do this; while the 5C is physical dimensions of the glass screen that still using the A6 processor. The 5S also has had been used for five years, making the a new motion co-processor, which works the resolution natively 16:9, which meant no accelerometer and gyroscope to further more black bars when watching movies; a pinpoint details of its user’s current courteous renovation. Which leads us to condition (if they are standing or sitting). today, 2013, and the first time in iPhone The 5S has a slow-motion video than they should in regards to their Touch ability which enables the user to record up to ID. A Wall Street Journal business editor 120 frames per second in 720p. Of course tweeted regarding his own device that the the most intriguing of these differences is Touch ID was buggy and worked, “a very the 5S fingerprint reader (dubbed Touch ID) frustrating 70% of the time.” [7] This 70% is that is built right into the Home button. The generous compared to what some users are iPhone lets you add up to five unique claiming however. fingerprints which can be selected to unlock The way the Touch ID actually the phone and even authorize purchases works is like this: you set up your from the App Store. This feature is a hot fingerprint (1 of 5) by repeatedly lifting and debate right now in regards to the actual holding your desired print on and off the security it claims. home button. This act does not actually store an image of your fingerprint (like those 5 iPad Air – No Touch ID? in the database of the cool crime scene TV shows) but instead translates your input as a mathematical representation, to which Apple The iPad Air and iPad Mini with claims cannot be reverse engineered [6]. Retina, both released after the 5S, do not This mathematical representation can have the Touch ID feature. There are a few be thought of exactly like a hash function. speculations as to why, but primarily The iPhone then stores this encrypted Apple’s way of doing things is keeping new information in a secret compartment within technology product-exclusive for as long as the A7 chip, known as the Secure Enclave, possible before branching out and which was specifically developed to protect implementing it to other devices. The most Touch ID and passcode data. The encrypted plausible guess is that it was simply a data is protected with a key that only the productivity error. There were known Secure Enclave has access to. This data is problems with 5S production [5] with the only ever used and seen by the Secure Touch ID feature, and seeing as these Enclave, meaning no other 3rd party app or devices were announced right around the even the Operating System has access to same time, it could just be that there simply your print (or rather, hash), which also was not enough resolve to meet deadlines – means it is not stored anywhere on Apple so perhaps Touch ID will be implemented Servers, backed up to iCloud or anywhere on the next generation tablets, most likely to else you can imagine – it is totally locked release Quarter 4 of 2014. Or perhaps this down to that unique device. Apple took this feature is already on its way out from the even a step further by pairing each and every problems users have been running across Touch ID Sensor to only the device or CPU with the 5S? that it is associated with. This theory was tested and proved by 6 Touch ID Issues and employees at iMore blog and forum. They took two brand new devices, ensured the Complaints Touch IDs worked, swapped the Touch IDs within devices, and tested the feature, finding that it did in fact not work. When The fingerprint reader, like all new setting up a new print the screen fails technology, came with bugs. Many of the immediately. They swapped the sensors consumers who purchased the latest flagship again to find the Touch IDs working again smartphone have been having more trouble with their original respectively paired screens) on a 16GB 5S model, which retails devices. for $649 [9], however the majority of those This adds an extra layer of protection who purchase iPhones wait long enough to unique to each device. An attacker would be eligible for a discount (with the renewal have to modify the sensor cable itself in of a 2-year contract from a service provider order to tamper with the Touch ID feature like AT&T) which then costs the customer under the hood, so to speak.