Biometrics and its applications in Singapore - Biometrics Institute

Biometrics and its applications inSingaporeMinistry of Home AffairsSingapore*All images are copyrights of their respective owners

Public Sector: BIKES ProjectOverview:- Biometrics Identification of Motor-BikersSystems Facilitates self- immigration clearance atdesignated lanes for motorcyclists (i.e. 1person per motorcycle)Highlights:- Requires the user to pre-register hisFingerprint at enrolment stations About 40,000 enrolees Scheme is made available to Singapore Citizens All Singapore Permanent ResidentsBenefits:- Clearance now takes under 16 secondsper motorcyclistNext steps:- To allow for clearance of pillion riders aswell Doing this for cars will be the Holy Grail*All images are copyrights of their respective owners

Public Sector: eIACS ProjectOverview:- enhanced Immigration Automated ClearanceSystem Automated immigration clearance using:- Machine- Readable Singapore Passport User’s FingerprintHighlights:- First commissioned in Mar 2006 Annual figures place 1.8 million Singaporeansclearing via eIACS lanes Won “Most Innovative Use of InfoCommTechnology (Public Sector) at the 2006 NationalInfoComm Awards Won the Gold Award at the inaugural TEC PublicService Innovation Awards ceremonyBenefits:- Enables the 3 million Singapore Passport holdersto clear Immigration under 12 seconds No user pre-registration requiredNext Steps:- Implementing this for Singapore PermanentResidents (SPR) In future, how to include all foreign visitors toSingapore will be the Holy Grail*All images are copyrights of their respective owners

Singapore Standard ID The Singapore Standard ID (SSID) or SS 529SSID is a common standard applicable tovarious identification cards and their readingdevices used by government agencies andprivate organisations in Singapore Based on ICAO’s electronic passports (e-passport)specifications With extensions for data and security that isnot required or stored in an e-passport Specifies Data structure, security and access conditionsfor a smartcard that contains personalidentification data Supports Contact or contactless readingBiometrics Adoption of SS 529 SSID Civil Aviation Authority of Singapore PSA Singapore TerminalsChangi International Airport*All images are copyrights of their respective owners

Private Sector InitiativesBiometrics Projects in Singapore

Private Sector:Foreign Worker Dormitories Overview Singapore- based Face Recognition vendor Dormitory Management Company (MultiHub) Deployed 2D Facial Recognition screening atentrance Prevent illegal immigrants from seeking shelter Prevent sharing of access cards among workers Highlights:- 4,500 enrolees 10 lanes of secure access in an outdoorenvironment Resistant to lighting conditions 32 cameras to track & monitor workers’movements*All images are copyrights of their respective owners

Private Sector:Pay-by-TouchBackground Privately held US company which enabled consumersto pay for goods and services with a swipe of theirfinger on a biometric sensorNov 2006: Partnered with Citibank (Singapore) forpayment processing with “the touch of a finger” “Card-less” credit card transactions at retailoutlets Abrupt closure on 19 th March 2008Singaporean sentiments on the affair Innovative payment scheme was widely accepted andadopted Many wrote letters to newspaper forums to suggestanother company to revive the biometric paymentscheme*All images are copyrights of their respective owners

Other matters:Failed Attack on Singapore ePassportRFID Enabled 'Biometric' passports contain:- Fingerprint Facial Image Birth Certificate Home Address Phone NumbersDuring SyScan 2008, Adam Laurie shared onthe test results of an attempt to read and thenmodify the contents of RFID chip Succeeded on several countries’ ePassport Implemented only Basic Access Control(BAC) Low entropy & susceptible to brute forceattack But unable to read the DG3 (fingerprint data)on Singapore ePassport Protected by Extended Access Control (EAC)*All images are copyrights of their respective owners

*All images are copyrights of their respective owners

Knowledge Sharing What is the Next Generation DocumentSecurity concept? Perform real-time checks against thedocument’s Access Control List (ACL) beforeunlocking the documents for viewing Automatically lock the document upondetecting the user’s absence Able to block all unauthorized user access Video Demos POC demo: Encrypted document repositorywith Biometrics*All images are copyrights of their respective owners

Video Demo:Secure SharePoint withFingerprint Biometrics

Interesting Challenges*All images are copyrights of their respective owners

Challenge:Mobile Biometrics What Singapore envisions:- No need for proprietary drivers to be installed(i.e. Driver-less) Just plug in any USB biometric reader and beable to convert any user mode (e.g. lockeddown kiosk) into a biometrics- capableworkstationNot just do a simple “embedded match toaccess USB storage” To implement cloud- capable, portable anddistributed security using USB devicesaugmented with Biometrics Biometrics is crucial for “proof of presence” Combined scheme with digital signatures Obstacles faced:- No biometric reader available which canoperate without drivers*All images are copyrights of their respective owners

*All images are copyrights of their respective owners

Biometrics transition to mainstream Although many of us think of Biometrics as something“mainstream” or acceptable, there are reservations overthe security of such devices by everyday users Example – Biometric flash devices As seen from user comments Users still find biometric flash devices difficult to operate (swipesensor technology), reliability of sensors in doubt There are doubts about security (password access is alwaysbackup for biometrics, defeats purpose of paying more forBiometrics, attempt to connect biometric drives withoutauthentication)*All images are copyrights of their respective owners

Black hat attacks– Notebook Face Recognition Biometric attacks feature yet again in Black Hat 2009 Vietnamese researchers show attacks on notebookFR logins MHA tested photo attacks on webcam with FR back in 06 Simple photo attack or video attacks suffice Best practice: 2-factor authentication*All images are copyrights of their respective owners

Whats Next?We see new technology and applications helping to sustaininterest in Biometrics Saliva Biometrics – Pushing the envelope?From New Scientist – “A new worldwide survey of thehuman saliva microbiome – the bugs in our spit – findsthat a man from La Paz, Bolivia, shares no moremicrobes in common with his neighbours than with awoman from Shanghai.”http://www.newscientist.com/article/dn16678-spit-bacteria-could-be-as-distinct-asfingerprints.html?DCMP=OTC-rss&nsref=online-news Fingerprint logins will probably not be obsolesced bySaliva scanning USB pads anytime soonCredit Card BiometricsAccording to CreditCards.com trends point for Biometrics tobe widely accepted in credit card payments A smartphone built by Fujitsu for NTT DoCoMo serves as amobile wallet and has a fingerprint sensor to lock the phonefrom unauthorized accessIncreasingly, consumers are ready to accept biometrics as ameans to convenience themselves*All images are copyrights of their respective owners

*All images are copyrights of their respective owners

Held on 7 th - 9 th Oct 2008 in Suntec InternationalConvention & Exhibition CentreMulti-Track conference & exhibition:- Law Enforcement Track (Closed DoorGovernment only) Biometrics Track (1 day) Enterprise Security Track eID and Personal Security Track Infrastructure Protection Track Mobile Security Track CxO Track (by invitation only) CISO Track (by invitation only)*For more details, please visit www.govware.sg*All images are copyrights of their respective owners

Conclusion Biometrics has transitioned from esoteric sci-fitech to everyday system Challenge has moved on From global security, to enterprise and endusersecurity Next phase for large scale applications E.g. Banking, personal security systems Nex Gen Document Security Where are the deployments? Technology refresh due for projectscommissioned 4-5 years ago New infrastructure (i.e. SOE in Singapore) Invitation to Government Ware 2009 Website: www.govware.sg Usually in Sept or Oct of the year See you there!*All images are copyrights of their respective owners

End of presentationThank You*All images are copyrights of their respective owners