Biometrics & Security
Total Page:16
File Type:pdf, Size:1020Kb
Biometrics & Security: Combining Fingerprints, Smart Cards and Cryptography THÈSE NO 4748 (2010) PRÉSENTÉE LE 25 AOÛT 2010 À LA FACULTÉ INFORMATIQUE ET COMMUNICATIONS LABORATOIRE DE SÉCURITÉ ET DE CRYPTOGRAPHIE PROGRAMME DOCTORAL EN INFORMATIQUE, COMMUNICATIONS ET INFORMATION ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE POUR L'OBTENTION DU GRADE DE DOCTEUR ÈS SCIENCES PAR Claude BARRAL acceptée sur proposition du jury: Prof. A. Lenstra, président du jury Prof. S. Vaudenay, Dr A. Tria, directeurs de thèse Prof. B. Dorizzi, rapporteur Dr A. Drygajlo, rapporteur Prof. A. Ross, rapporteur Suisse 2010 Acknowledgments First of all, I would like to thank David Naccache for his crazy idea to give me the opportunity to start a PhD thesis, on the late, and Serge Vaudenay for his welcoming in LASEC, for teaching me cryptography, and his incredible patience with my slow advancement in this PhD work. Many thanks to Jean-Pierre Gloton, David Naccache and Pierre Paradinas for sup- porting my Doctoral School application. I must thank all my colleagues in Gemplus, then Gemalto, for all their support. Especially Pierre Paradinas for hiring me, more than ten years ago, in his GRL team - the Gemplus Research Lab - Denis Praca, my very first mentor at Gemplus and Michel Agoyan for his precious sup- port whatever was the subject (e.g. Hardware, Software, Chip Design, Trainees management). Then Eric Brier and Cédric Cardonnel, first persons to work with me on Biometrics. Pascal Paillier and Louis Goubin for their support in cryptography. Jean-Louis Lanet for giving me the opportunity to give my very first courses at universities. Precisely, I would like to thank every person having trusted me for my teaching skills on Biomet- rics, Smart Cards and Cryptography: Traïan Muntean at Ecole Supérieure d’Ingénieurs de Lu- miny, Marseille, France. Caroline Fossati at Ecole Centrale Marseille, France. Marie-Laure Potet at ENSIMAG, Grenoble, France. Assia Tria and Laurent Freund at Ecole des Mines de St Etienne - Centre Microelectronique de Provence George Charpak, Gardanne, France. Thierry Fournel at Institut Supérieur d’Optique, St Etienne, France. Thanks a lot to all my past and present colleagues at LASEC for helping me with practical work during cryptography learning: Pascal Junod, Gildas Avoine, Jean Monnerat, Thomas Baignières, Sylvain Pasini, Martin Vuagnoux, Julien Brouchier. And Philippe Oechslin for teaching me IT security at EPFL. My professional relations were very helpful: especially Bernadette Dorizzi from INT Evry, Nicolas Delvaux and Loïc Bournon from Sagem, Jean-François Mainguet from At- mel. The rock band which I’m proud to be the bass guitar player and helped me, for more than five years now, to counter-measure with professional and thesis stress. Thanks a lot to past and present mem- bers: Eric Brier, Julien Brouchier,Cédric Cardonnel,David Hallé, Laurent Lagosanto and Daniela Laurans. And thanks God for my very first marathon (during this dis- sertation’s redaction), and finally a second one while I was in late with the redaction... Ecole des Mines de St Etienne and CEA-Leti welcomed me in their lab and gave me the opportunity to pursue my research. Thanks a lot to Assia Tria and Alain Merle. My colleagues were very helpful with Linux, LATEX, and other stuffs: Michel Agoyan, Sylvain Bouquet, Pascal Manet, Jean-Baptiste Rigaud, Bruno Robisson. For their collaboration on biometrics, many thanks to Stéphanie Anceau, Philippe De Choudens, Abdel Yakoub. David Naccache and Assia Tria finally convinced me not to give up in particular hard times, thanks! Many thanks to one external reader and spellchecker: Bart Bombay, and to the jury: the President, the Director, the co-Director and the three Examiners. And last but not least, MANY THANKS to my family. Especially my wife, Agathe, and children Julien, Antoine, Axel, for supporting me. And my mother, mother-in-law, sisters, nieces and everyone having helped me to save time for my studies and helped my wife while I was in Lausanne few days a week for several months. — À ceux que j’aime. “Tout le monde savait que c’était impossible. Il est venu un imbécile qui ne le savait pas et qui l’a fait.” — Marcel Pagnol. Résumé Depuis le début de ce siècle et plus particulièrement depuis les évenements du 11 Septembre 2001 aux Etats-Unis, plusieurs technologies biométriques sont considérées comme assez matures pour être un nouvel outil de sécurité. Généralement associées à un support personnel afin de respecter la vie privée, les données biométriques de référence sont enregistrées dans des équipements électroniques securisés, tel les cartes à puce et les systèmes utilisent des outils de cryptographie pour entrer en communication avec la carte à puce et échanger les données biométriques de manière sécurisée. Après une introduction générale sur la biométrie, les cartes à puce et la cryptographie, une second partie adressera nos travaux sur les fausses empreintes et les failles des systèmes de capture d’empreintes digitales. La troisième partie présentera notre approche d’un algorithme léger de reconnaissance d’empreinte digitale dédié aux cartes à puce. La quatrième partie détaillera les protocoles de sécurité dans les applications telles que la carte PIV, et présentera notre implémentation dans la carte à puce du protocole proposé par le NIST. Finalement, une cinquième partie adressera l’interaction entre Cryptographie et Biométrie, leur antagonisme, leur complémentarité, et présentera notre application d’un protocole de challenge-response aux donnèes biométriques afin de faciliter la reconnaissance d’empreintes digitales. Mots-clés: Biométrie, Cartes à Puce, Cryptographie, Reconnaissance d’Empreinte Digitale, Match-On- Card, Algorithmes Légers, Electronique Embarquée, Protocole Sécurisé de Vérification d’Identité par Biométrie, Cryptographie-Biométrie Interaction. Abstract Since the beginning of this brand new century, and especially since the 2001 Sept 11 events in the U.S, several biometric technologies are considered mature enough to be a new tool for security. Generally associated to a personal device for privacy protection, biometric references are stored in secured elec- tronic devices such as smart cards, and systems are using cryptographic tools to communicate with the smart card and securely exchange biometric data. After a general introduction about biometrics, smart cards and cryptography, a second part will introduce our work with fake finger attacks on fingerprint sensors and tests done with different materials. The third part will present our approach for a lightweight fingerprint recognition algorithm for smart cards. The fourth part will detail security protocols used in different applications such as Personal Identity Verification cards. We will discuss our implementation such as the one we developed for the NIST to be used in PIV smart cards. Finally, a fifth part will address Cryptography-Biometrics interaction. We will highlight the antagonism between Cryptography - deter- minism, stable data - and Biometrics - statistical, error-prone -. Then we will present our application of challenge-response protocol to biometric data for easing the fingerprint recognition process. Keywords: Biometrics, Smart Cards, Cryptography, Fingerprint Recognition, Match-On-Card, Light Weight Algorithms, Embedded Electronics, Cryptography-Biometrics Interaction, Secure Biometric Iden- tity Verification Protocol. Contents Glossary xxv Notations xxix Abbreviations xxxi Thesis Outline & Results Overview Part I. General Introduction Chapter 1. Introduction to Biometrics 1.1 A few words about Biometrics ............................. 9 1.1.1 A little bit of History ............................. 10 1.1.2 A little bit of Science Fiction ......................... 10 1.2 Biometric Modalities .................................. 11 1.2.1 Introduction .................................. 11 1.2.2 Fingerprint Recognition ............................ 11 1.2.3 Face Recognition ............................... 12 1.2.4 Hand Geometry ................................ 13 1.2.5 Iris/Retina Recognition ............................ 13 1.2.6 Vein Pattern Recognition ........................... 13 1.2.7 Other Techniques ............................... 14 1.2.8 Multimodal Biometric Systems ........................ 15 1.3 Biometric Systems Architecture ............................ 16 1.3.1 General Architecture .............................. 16 1.3.2 Extraction Algorithm ............................. 16 1.3.3 Matching Algorithm .............................. 17 1.3.4 Enrollment ................................... 17 xi Contents 1.3.5 Authentication/Verification .......................... 18 1.3.6 Identification .................................. 18 1.3.7 Authentication vs Identification ........................ 19 1.4 Biometric Systems Errors ............................... 19 1.5 Biometric Systems Evaluation ............................. 21 1.6 Biometric Systems Management ............................ 22 1.7 Privacy Issues ..................................... 22 1.8 Applications ...................................... 23 Chapter 2. Introduction to Smart Cards 2.1 A few words about Smart Cards ............................ 25 2.1.1 A little bit of History ............................. 26 2.1.2 A little bit of Science Fiction ......................... 26 2.1.3 Authentication Token ............................. 26 2.2 Smart Card Architecture ................................ 27 2.2.1 Physical Characteristics ............................ 27 2.2.2 Electrical Characteristics