buletin ştiin ific - Facultatea de Stiinte Economice - Universitatea din ...

Problems of biometric methods in Authentication and Authorization InfrastructuresA solution of the problems mentioned above can be offered by authentication and authorizationinfrastructures (called AAIs from now on), which are combinations of services and methods thatallow customers of different web services access to protected contents stored on differentservers. In this case, the authentication does not take place on every server, nor in some centralplace, but on the server of one single company, which later submits the authorization to anotherrequested web service.Although the AAI represents the successor to single sign on technology, its principles offunctioning are not yet clearly defined and many questions are still to be answered [7]. So far,there are implementations of different AAIs based on password technology. Nevertheless, thesehave all the disadvantages implied by the knowledge factor of password. In case of AAIs, wherewith one authentication a user is granted access to all of his accounts (thus having one singleidentity), it is mandatory that no user is able to authenticate as someone else. This request makespassword and token based authentications inadequate in the use with future AAIs. The onlyauthentication method which can provide protection against transmission of credentials isbiometric authentication.This paper gives a short overview of potential problems that can occur upon using biometricauthentication technologies within AAIs. While biometric systems provide an authenticationtechnology which is already used in software applications, their implementation within an AAIwill raise a set of special problems, which are of architectural, security and quality nature andaffect every type of biometrics.2. Design researchIn order to design an AAI system based on two-factor authentication that combines passwordand biometrics, two possible main AAI architectures are considered:• Central Single Sign On server (SSO)This architecture implies that only one dedicated server is responsible for the authenticationprocess and for the ticket-generation process. From the flow-logic point of view it is possiblethat the user first logs in at the central server and then chooses which resources he wants to use.It is also possible that the user first requires the access to one resource and, if he does not have aticket yet, he will be redirected to the central server.The advantage of this architecture relies in its low redundancy in the authentication process andticket generation, while its disadvantage is the single point of failure: if the central server isunavailable, no online resource can be accessed.• Circle of Trust (CoT)The CoT-architecture is defined as a union of resources where each one of them is able togenerate online tickets valid for any resource from the circle. While being more difficult toimplement than the Central SSO Server, the circle of trust has the advantage of being failsafewhen one of the resources is unavailable.The AAI presented uses the typing-cadence biometrics based on the Psylock method ofrecognition [1], developed since 1993 at the University of Regensburg. This biometric methoduses as input parameters the keys events that were pressed or released (from a standard computerkeyboard), together with the time when the events occurred (in milliseconds). From this data twotypes of features are extracted: dynamic attributes (like speed or rhythm) and static attributes(like the preference for left and right hand, agility, use of shift keys, ways or making orcorrecting mistakes, etc.). By means of neural networks and support vector machines, theseattributes are compared to those stored in the user profile [3] and a match score between 0% and18