buletin ştiin ific - Facultatea de Stiinte Economice - Universitatea din ...

Problems of biometric methods in Authentication and Authorization Infrastructures99,99% is returned. This indicates how similar the typing behavior of the current user is to theone stored in the profile. If the match score is greater than a predefined threshold, the user isgiven access to the system.This biometric method has the advantage of not requiring extra sensors except of a standardkeyboard, is less vulnerable to key logging attacks and provides good person recognition.3. Research topicsThe combination of biometrics and AAIs raises several questions, which have to be clearedbefore implementing this combination of technologies:• Architectural particularitiesOne important characteristic of biometrics is the fact that biometric data changes with the time,independent of the type of biometrics used (some biometrics change faster, others age slower). Itis therefore important to examine this role that the aging of biometric data plays within an AAI,whose architecture requires many biometric profiles of the same user stored on many servers, outof which not all of them will be regularly actualized. Due to the fact that this problem occurs forevery type of biometrics in a similar way, standard solutions for this problem must be provided.• Security issuesParticular attention has to be given to the development of algorithms that recognize replayattacks [15]. Every biometric method has its own specific way of treating such attacks anddifferent degree of vulnerability against them. In case of biometric AAIs, the second challengeconsists in the real time replay checking of biometric data which stored on different servers.Another security problem is feature theft. This problem appears when the secret of biometricdata is lost and the biometric identity of a person is available to intruders. This problem is ofmore importance than the theft of a normal password, due to the fact that biometric features (likeface, retina or finger) cannot be replaced. If a biometric factor is corrupted, it cannot be usedagain for authentication, therefore biometric AAIs must also consider this potential threat.• Quality assuranceThe quality that biometrics deliver depends very much of the way in which the user has enrolledand of the type of sensor he authenticates with. The quality problem is one of high importancefor biometric AAIs, as a faulty enrolment or sensor may result in an increased false rejection ofthe entitled user. In case of typing behavior, the user must give additional attention during theenrolment phase. The use of multiple sensors (keyboards) must be provided by means ofdifferent biometric profiles.4. Implications for biometric AAIsThe common current AAIs are not specially designed to be used with biometrics. Therefore,their architectures do not foresee the process of enrolment on different servers, template aging,synchronization of biometric data for the purpose of checking a replay attack or methods ofdelivering information about the quality of biometric data upon the login process. At the sametime, interchanging biometric data between different identity providers can raise significantsecurity questions, which means that a possible solution has to be researched at the level of thearchitecture of the AAI itself. A list of biometric attributes must to be generated and decidedwhich one of them can be passed forward at the request of another server and which ones have tobe kept locally for security reasons.19