I527-290 ESRIF Final Report (WEB).indd - European Commission

190
8.4.1.2 Improve trust in biometric devices
We need to have robust technologies that make systems or solutions much harder to spoof or fool by building in
enhanced security measures such as liveness detection and anti-spoofing measures such as heartbeat detection. Ideally
we would need to be able to create biometric models specific for a given need and to ensure proper policy management
so that issued “identities” can be updated, revoked and reissued. The research should aim at enhancing the accuracy and
robustness of biometric devices.
To reach this goal, many potential solutions should be explored:
Development of secure biometric acquisition systems
Evaluation of non zero eff ort attacks (internal and external) on biometrics systems
Development of new and innovative biometric sensors able to operate under critical conditions that are typically found at
a disaster scene
Acquisition devices and system certifi cation
User behaviour and postural recognition, promoting “person identifi cation” beyond biometric traits and avoiding
identity theft
Create biometric model-specifi c to a use
Investigate multi-biometric traits application benefi ts and increased performance
8.4.2 Systemic needs
8.4.2.1 Combating identity theft
No coherent approach to address this threat is currently in place. It requires a concerted eff ort involving signifi cant advances
in processes and technology. The current lack of solutions costs companies, countries and citizens billions of Euros in fraud
and theft and undermines global and fi nancial security. The problems come from a lack of joint approach, a lack of trusted
authentication and enrolment processes, and an ongoing and increasing lack of trust.
In order to effi ciently fi ght these frauds, systems and technologies should perform mutual recognition between regional,
national and/or European systems. Standards and retro-compatibility management should also be developed and agreed at
the Union level.
Privacy management of stored data should also be handled appropriately. Systems and architectures should allow the
management of diff erent electronic ID in diff erent contexts (public vs. private, region vs. Europe, etc.). Finally, on the legal
aspects, responsibility and liability matters for fraud should be addressed at national and international levels.
The solution to overcome these challenges would be:
Development of agreed processes and standards
Use of strong authentication processes and technologies
Development of secure enrolment processes and technologies
Solutions to provide for secure on-line transactions (secure payment on the Internet based on eID and banking smart cards)
Education and training for all stakeholders and users on the threats and preventive measures
Harmonise the security level of all identity documents; i.e. have the same requirements in term of technical requirements
and proof (security evaluation criteria and security targets)
Harmonise national legislation between all EU Member States for all applications where eID is mandatory (travel, e-Services,
driving licenses, eHealth, etc.)
8.4.2.2 Mobile identity checks
As mobility of people is becoming a central factor of behaviour and life, the use of new identification technologies
to support and improve law enforcement should contribute to ensuring the security of society. In the same manner,
the growing need for flexibility generates a need for appropriate technologies and processes to achieve the required
security level.
ESRIF FINAL REPORT - PART 2 • Working Group: Identifi cation of People and Assets