|
Security of Biometrics
Template
If my template is compromised, does
that mean that I can never use the biometric again?
Not in a well-designed system. If a
criminal steals or guesses your password, it is very easy to have it
changed. There is a fear, however, that if a criminal gets hold of a
biometric template, the damage is irreparable - there is no way to
change that part of your body. Although templates are often
encrypted when in transit and storage in order to protect against
such an occurrence, what happens if a template is compromised?
The answer depends on
how well a biometric system is designed. If a system allows a
template to be inserted into the verification process without
ensuring that this template came from an actual placement, a
compromised template can pose a problem. However, a well-designed
system will ensure that the information it is analyzing is not a
recording but is in fact a new sample.
One way to assure
that a new template is being submitted is to seed the request for a
sample. This involves the biometric system sending an encrypted
random number (known as a seed) to the biometric sensor. This number
can be encrypted such that only the sensor itself can decrypt the
message. When returning the biometric template, the sensor also
sends the seed number back (encrypted). This ensures that the
template being sent was created immediately after the request for
the template (as opposed to an old template that has been recorded
and played back).
The size of a template
varies by technology and vendor. It varies from 9 bytes to as much a
2kb. Fingerprint template is normally about 500Bytes in size.
Templates can be stored in databases or files. |
