I527-290 ESRIF Final Report (WEB).indd - European Commission

182
Behaviour analysis
One possible way to prevent identity theft or misuse of biometric traits is to be able to measure the user behaviour to
derive the coherence with previous uses of the services, and thus the potential presentation of a biometric credential
by an intruder. User behaviour may also be used to detect a user acting under unexpected conditions that may be
forced by a kind of kidnapping act: the stress, the face contraction, etc. could be used. Abnormal behaviour needs
to be extended to vehicles and assets in general where the person is always involved in the process as a driver or a
controller.
But some diffi culties exist and require further work:
First, these practices may be against the Personal Data Protection Directive, and study of legal implications and limits should
also be an issue of research
Second, there is no standard methodology to evaluate the security of a behaviour detection system
Standardisation Status
Standards are critical to the proper and robust development of the biometrics and identity management market place and
technologies. Contrary to common perception there are many standards already in existence for many technologies. However
some key cross technology areas remain to be properly addressed as for example security, interoperability and performance.
This standards harmonization will be key to the success of future biometric systems’ operations.
The need for enhanced security technologies drove and accelerated the development of identity related standards. With
regards to biometrics, in addition to the ICAO standards, relevant biometric, ID/smartcard, and security standards have been
developed in ISO (i.e., JTC1 SC37, SC17, and SC27). Although there is still a long way to go towards achieving interoperability
in terms of technical specifi cations, it is important to note that these standards exist and they should be promoted and
developed.
Extended Access Control (EAC) requirements
With the EAC process, the time needed for reading the chip in the e-passport is estimated to be 6 to 9 seconds for 40 Kb data
read. It would be interesting to break down this time:
1. Is the maximum communication speed reached by the reader?
2. Are there waiting times (calculation of the keys, data encryption)? Is it possible to count and measure these? How long do
they take? Is it possible to reduce these? If so, how?
3. BAC reading seems to be very smart. Has the diff erence of reading time with the EAC control been identifi ed: availability of
certifi cates? Latency time between two readings? Calculation time for the keys? Exchange data’s encryption time? Are these
times attributable to the reader, to the chip, or to both of them?
At border control, time is money and the EAC process execution time is a critical factor. It would be interesting to answer these
questions, especially for airport administrators. In addition, it is important to assess if the considered technical solutions (RSA
key, elliptic curve) will be able to reduce the time of border control on complex airport platforms such as Heathrow, CDG,
Frankfurt, Schiphol and so on.
Of course, the main reason for introducing biometrics is to increase security and the sense of security. Although increased
effi ciency in law enforcement does not directly improve security, it can be argued that the use of biometrics acts as a deterrent
to criminal, illegal or anti-social activities. In this respect, overblown claims about the performance of biometrics may actually
prove helpful.
Fingerprints consist of particularly sensitive personal data. Their access, for any check or verifi cation operation needs to be
strongly secure. Therefore, even though we want to reduce the reading time, it is critical to maintain a high level of data
protection. This is achieved by having for each Member State an infrastructure of keys management and cryptographic
mechanisms.
ESRIF FINAL REPORT - PART 2 • Working Group: Identifi cation of People and Assets