![](bg5.png)
silicon or gelatin, can deceive a fingerprint biometric sensor [9][10]. The proce-
dure for materializing this attack is consisted of three steps. The first step is captur-
ing a fingerprint (e.g. from a glass, a door handle or with the user’s consent). The
second step is creating the artefact, which is a procedure that lasts from a few
hours, to a few days maximum. The final step is using the artefact to access the
system. The use of pictures, masks, voice recordings or speech synthesis tools is
possible to deceive iris, face, and voice recognition systems. As a countermeasure,
it must ensured that vitality detection features, which conduct an extra measure-
ment of one or more attributes, such as the relative dielectric constant, the conduc-
tivity, the heartbeat, the temperature, the blood pressure, the detection of vitality
under the epidermis, or the spontaneous dilation and constriction of the pupil or
eye movement, are integrated in the biometric device.
If these features are not pre-
sent, compensating controls must be applied, such as the deployment of multimo-
dal biometrics (e.g. combination of face and lips movement recognition), or the
implementation of interactive techniques (e.g. the request for the user to say a spe-
cific phrase, or place 3 fingers in a certain order on the sensor).
• Server side - Fake templates: Server based architectures, where the biometric tem-
plates are stored centrally, inherit the vulnerabilities of such systems [14]. A possi-
ble attack can be realized when the impostor inserts his template in the system un-
der someone else’s name. Distributed architectures (e.g. template storage in a
smart card) should be preferred. In that case, the template is stored in a tamper re-
sistant memory module that is write-once and erased or destroyed if its content is
altered, resisting to this type of attack. When this scenario is not an option, strong
security controls must protect the server, including encryption of the templates,
system and network security controls (firewalls, intrusion detection and prevention
mechanisms) and a strong security policy followed by detailed procedures based
on international standards.
• Communication links: Data could be captured from the communication channel,
between the various components of a biometric system [14], such as: the sensor
and the feature extractor, the feature extractor and the matching algorithm or the
matching algorithm and the application, in order to be replayed at another time for
gaining access. This is also called electronic impersonation. An effective counter-
measure is the integration of the various parts of the system into a hardware secu-
rity module, or generally the elimination of the transmission of the biometric tem-
plate. An example of such a module is the biometric smart card, that has a finger-
print sensor and the matching mechanism embedded in it, confining the template to
a secure environment. Similar security levels are addressed in integrated terminal
devices, such as PDAs or mobile phones. If this is not an option, challenge and re-
sponse is another approach for addressing this vulnerability. An additional control
is the introduction of a rule to discard a signal when it is identical to the stored
template or to the last measurement that was conducted.
• Cross system: The utilization of the template in two or more applications with
different security levels (i.e. convenience applications and security applications)
tends to equalize these security levels, by decreasing the higher security level to
the lower one - if a template is compromised in one application, it can be used for
gaining access to the other. A countermeasure, depending on the criticality of the
application, is the deployment of custom encoding algorithms in order to ensure
27