Biometrics for Authentication: Security and Privacy Implications

This research project explores the security and privacy implications of using biometrics for authentication. It examines the increasing use of biometrics in various sectors, including government and private organizations, and analyzes the potential risks associated with this technology. The study delves into the vulnerabilities of biometric systems, including data breaches and spoofing attacks, and discusses the importance of implementing robust security measures to protect sensitive personal information. The research also explores the ethical considerations surrounding the use of biometrics, particularly in relation to privacy and data protection. The paper concludes by proposing a model for integrating biometrics into ATM systems, highlighting the potential benefits and challenges of this approach.

ITC595 Research Project
Biometrics for authentication: security and privacy
implications
K. Manikanta
ITC595 MIT, School of Computing & Mathematics, Charles Sturt University
[e-mail]
ABSTRACT – Biometrics is the system drawing attention since
the time period of 9/11 incidence. It is not only a system
recommended for the anti-terrorism problems but also for the
powerful method of authentication for verifying the person’s
identity so that the restrictions can be applied on access for the
sensitive areas or the systems. The smart card is a relative
technology as compared to biometrics that is leading to the use of
technology with a slight difference and a higher rate of return on
security. The next part of this study is based on analysing security
and privacy concerns in managing the biometric system. The last
part of the study is based on the analysis of literature review gap
and suggestion for the future level of outcomes.
Keywords— Biometrics, Authentication, smart card technology
INTRODUCTION
Governments have shown their keen interest in biometric
technologies and started to implement at large scales such as
biometric identity cards and passports due to which biometric
has become debatable. The increased interest of governments
has also encouraged private organizations to use it for their
business purposes and it has enhanced commercial interest.
The purpose of biometric technology is to use it for
authorization and identification but issues related to security
and privacy has also become unavoidable[1]. Therefore, any
sort of mishandling of any aspect of biometric can lead to
jeopardizing data biometric which strongly connected with
personal identity.
Biometric is a combination of two Greek words; (1)
“bio” means life, (2) “metro” means quantifying or measuring.
The prime aim of biometric is to identify unique features of
the individual which can be behavioural and psychological.
Behavioural is considered as active which measures features
of individual such as skills or performed functions[2]. While on
the other side, psychological consider as passive in which
firmed and static features of individuals. The major examples
related to physiological are DNA, fingerprints, the image of a
face, iris designs and hand geometry. Behavioural biometrics
includes signatures, dynamics of keystroke and movements of
the mouse.
There are two types of general uses and implications
of biometric; (1) identification, (2) verification. These two uses
require reference data in order to compare individual’s
physiological and behavioural characteristics. So, the process
of identification and verification include a comparison
between sample data of individual and already existed data
which was collected through biometric technologies and
existed in the database[3]. It will help in confirming the
identity of the individual. If the system has correctly confirmed
that identification is true then it will be called as “true
positive” and if system correctly identified that identification is
not matched then it will be “true negative”. While on the
other side, if the system has incorrectly identified or rejected
then it will be “false positive” and “false negative”
respectively.
A. Research Problem
Following are research objectives for this study,
1. To find major privacy concerns for biometrics system
in organizations.
2. To assess and apply the new technologies in
biometrics system followed by the literature gap
analysis for this technologies.
3. To quantify the effects of long-run benefits associated
with these technologies.
B. Research Justifications
The research will be focussing on the stated issues
and their impact on this field of study. The privacy concerns
for the biometric systems and new technologies are required
for the literature gap identification. The biometric system
needs the long run benefit’s identification linked with the
different technologies.
C. Relevant Technologies and their implications
Smart cards are defined the related technologies in the field of
biometrics. Biometrics is the authentication technology
whereas the technology of processing and storage is smart
card[4]. The two technologies are developed as the strength
and conjunction on increasing basis. The biometric data is
mainly stored on the smart card that can be taking place as
the matching with the local PC or the central level of the
server on the basis of the reader. The results for the matching
of biometric can be utilized for unlocking the protected car
areas like the account information or releasing the certificate
or card based PIN to the external level of application. Most of
the smart card based platforms and the key infrastructure
problems are encompassing Multos, Java Card, Mondex, EMV,
OCF, PC/SC as we as the lifecycles and card issuance[5]. One of
the most crucial applications for biometrics is the traveling
documents those is also readable. The technical group
1

advisory can be used for the editions of a new form for all the
parts, objecting to the utilization of traveling document
LITERATURE REVIEW
The literature review can be identified on the basis of latest
researches in this field and their integration with the already
existing and future needs. The biometric system is lasting for a
long time but the certain problems are prevailed in the market
due to the increasing use of biometrics in the business and
other fields.
D. Security in Biometric Implementation
Identification process in the biometric system has high-
security issues as compared to the simple verification process.
Governments are planning to implement biometric
technologies at a larger scale with more strategic value. It has
been noticed that strategic value in biometric technologies is
curtailing governments from implementing long-term plans[6].
The biometric technology has not only proven as the
vulnerable system in the case of organizations who are small
and medium level but also caused issues for the organization
who have developed effective systems of security and working
on the larger scale. The companies can find solutions for their
manual problems but there can be manipulation and lack of
consensus for the information technology related issues and
implications. The governments are also reluctant due to
serious and unique features of biometric technology as well.
The example exists of some governments which have shown
their commitment to a biometric system for long-run plans.
Moreover, they also suggested that key stakeholders of
industries use their databases. For instance, the government
of UK has permitted stakeholders of the industry to verify their
customers’ identity from databases provided by the
government to them. Governments granted this permission
before allowing industries to use their own developed services
[1, 7].
The infrastructure has become complex which is linked to the
biometric system not only at national level but also
international level. Therefore, it has developed a strategic
information system and raises the need and importance of the
use of biometric technologies. It is important to understand
that biometric technology is more complex as compared to
simple technology. As mentioned earlier that biometric
technology has done a great job in resolving issues related to
identification and verification but identification of security
issues from different aspects is a critical domain[8]. Though
the security issue is a technical matter in this paper, we will
treat security issue in perspective of implementation and
different additional aspects. Though, we mentioned security
domain of biometric as a technical issue but need to
understand that security of information system is broad.
Security of information system not only has technical aspects
but also formal and informal aspects [8, 9]. The formal aspects
are related to policies and processes while informal aspects
include cultural norms. Moreover, informal aspects are
elusive. It also required further principle for consideration of
management of information system security concerning
implementations of biometric. Scholars have identified
additional principles such as; ethics, responsibility, trust, and
integrity need to be part of improving the security of
organizations’ databases. The organizations can be
government and private[9].
The following section of the study is related to security
breaches and its analysis in the context of broad
infrastructure. The security breaches are related to the
biometric system. There is one major misconception exist
related to a security breach of biometric is vulnerabilities in
reader device or prototype data generated by this system.
Though, it is very clear that reader device and prototype data
will always get attack but need to understand that security
issue in biometric is more complex and complicated. The
researchers have highlighted eight important points which
have more chances to get an attack. The highlighted points are
shown below in figure and brief explanation also given.
There is an interaction between user and system through the
sensor biometric is considered as a first obvious attacking
point.
E. Security and Privacy
Experts of biometric technology claimed that security has
been improved in a different application. The one aspect of
improved security is the protection of databases with limiting
access to sensitive data (information of individual’s religion,
ethnic, race, and health) through strict rules of monitoring.
Therefore, unauthorized individuals have no access to
databases. Moreover, history of the transaction in the system
can provide information of the user who has tried to access
system. This information is available for temporal basis in the
system. Biometrics technology has aimed to resolve issues
related to conventional methods of identification and
verification due to which biometrics are considered as guards
of privacy [10, 11]. The conventional methods for
identification and verification depend on distinctive identifiers
which include passwords, PINs, and smart cards. But problem
is that these identifiers can be easily replaced or stolen. The
major difference between conventional and biometric is that it
is truly distinctive and no one can replace it. Though, it is also
true that biometric system can be easily jeopardized [11].
Biometric encryption is another technology which has been
invented through the merger of biometric and cryptography.
This technology is using to develop unique electronic signature
and the private key of encryption. There is a mathematical
process exist in encryption which converts data in form of
inarticulate with use of a coding key. Therefore, biometric
encryption technology is used for encrypting and decrypting of
data. Information exchange increases with use of internet and
2

need for protecting sensitive data also increased which are
stored in databases and linked with open networks. Therefore,
encryption biometric is playing a role as a technology of
privacy enhancing[12].
Biometric has become part of many applications which we are
using in our daily life. These applications have improved daily
routine but there is serious threat exist related to security of
these applications. Biometric technology is just like affirmation
which can be true and false at the same time. So, biometric
can work for privacy and against it at the same time. If the
security of biometric data is intact then theft of identity would
be more difficult for hackers. Therefore, it has been proved
with experience that there is no perfect security related to
biometric data. So, there need to have trade-offs between two
range of privacy. One is truly enhancement and other is
differently jeopardized. It requires practical management of
situations in which threat of security is high.
F. Privacy Concerns
It has already been mentioned that the existing level of
biometric systems encompasses the major risks of security
that will lead to the potential issues in privacy in turn. These
risks in privacy are aroused due to the technological
vulnerability of the biometric level. The 100% rate of the
successful correct identification or verification of individuals is
not ensured by biometric systems. The researchers also
explained that it leads to the higher costs for the organizations
who are utilization these processes and the client no
disruption demand[12].
According to Electronic Privacy Information Centre (EPIC),
there are four major aspects of the privacy encompassing
territory privacy, bodily privacy, informational privacy and
information privacy[13]. The first one is referring to the
physical protection of selves against any types of invasive
processes, whereas the territorial privacy is setting the limits
on the domestic as well as other environmental intrusions. The
next one is informational privacy that incorporates the rules
designing the handling and collection of personal data like
government records and credit information. The last one is
information privacy that encompasses the rules for
management of personal data and the communication stages
privacy in the terms of telephone, mail and other modes of
exchange.
It has already been explained that the biometric data is
extremely personal with the greatest level of privacy and
power threat deriving from their relationship with own
identity. It gradually enhances the utilization of biometrics in
different fields and the vision of the applications as the unique
one on large scale or the universal level of applications. This
level can also face the amateur thieves. The perceived level
enhancement in biometric data’s value is offering access to
different applications in various fields for determined career
oriented persons.
The privacy issues arise as per the literature in case of both the
bodily and information types of privacy. The bodily privacy is
at stake due to the PAI through forcing the data entrance by
customers in the biometrics or its removal, mainly performed
by the criminals. The criminals are attempting for an attack on
the biometric system through collecting the direct biometric
information from the owner. PA1 and PA6 are main points of
information privacy through a collection of data[13].
For comparing the effects of these two attack points on the
informational privacy, the attack on the template of the
person’s data is deemed as the serious level of threat as it
permits for the incidence’s series. This issue enhanced with
the increase in biometrics’ status as permanent identifiers.
Biometrics spoofing is mainly the challenge and peril that
biometric systems must confront, particularly when biometrics
are normally exposed to the public. The main rule for
supporting the data protection encompasses lawful
processing, data minimization, disclosure limitation, and data
subject control and purpose specification.
LITERATURE GAPS
The literature gaps can be identified on the basis of latest
researches in this field and their integration with the already
existing and future needs. The biometric system is lasting for a
long time but the certain problems are prevailed in the market
due to the increasing use of biometrics in the business and
other fields. The literature shows that there is various privacy
and crucial security issues pertained to the biometric
implementations showing that there are serious concerns and
the organizations must consider aspects out of the only
technical domain. The organizations must recognize that the
biometrics is the only solution part that is also the part of the
problems. A review on the recent studies on biometric
technology privacy and the risks revealed that there is almost
no research pertained to the factors affecting the decision for
implementation of the biometric access technologies [9, 11].
The research in this regard can support in the explanation of
why the organizations are reluctant for implementation of the
authentically controls of biometric systems. The facts will also
determine the aspects of the biometric security solutions for
the organizations. The security technology organizations can
also support the research through the effective use of the
services and their implications. The security technology
organization can attain benefits from the research through
implications. There are the dearth’s for the scholar research
pertained to the factors affecting the decisions for
recommending biometrics, there is the solid base for the
theories and studies over the general technology adoption.
PROPOSED SOLUTION
The utilization of the authentication in biometrics has
been identified as the solution for such issues. There is a
substantial level of interest in applications of biometric
technology as the source of enhancing the existing
management system identity, but there can also be valid
concerns when the data stored will be protected. The face and
its detection through biometric security solutions will be used.
ATM will be added with smart card solution for higher
security. Following model will be adopted for ATM biometric
information.
3

Figure 2: ATM biometric Adoption Model
FUTURE SCOPE
Future research directions are based upon the biometrics
system consideration in terms of the effectiveness and system
demand for the control management. The system will be
demanded as the possible outcomes those can be generated
through implications of a biometric system in the organization.
The considerations for the biometric systems will also be taken
into consideration for more than one relevant technology
those can be implemented for the effective outcomes.
Another possible research area is considering Biometrics in the
field of ATM in banking services. The automatic and accurate
authentication and identification of users is the basic issue in
the network environments. The personal identification
passwords or numbers and the key devices such as the smart
cards cannot be the enough in the few of the cases. There
must be some naïve implication that one must be the physical
person that one claims to be. The utilization of the
authentication in biometrics has been identified as the
solution for such issues. There is a substantial level of interest
in applications of biometric technology as the source of
enhancing the existing management system identity, but there
can also be valid concerns when the data stored will be
protected. This applied the major adoption of the decision for
the organization due to this form of the authentication
demands strict rules, enough database management, and the
long-run financial implications because of the stored data’s
sensitive nature.
CONCLUSION
Summing it up, the concerns exist in the name of ethics, the
issues to be managed as well as privacy for the information
and data stored. The technical and non-technical implications
of privacy measures are always the key to identifying the naïve
implications. This research is based on current privacy issue’s
identification and their communication for the long run
biometrics. The problems are also assessed in literature gap
analysis those are later on covered up in the future
recommendations. This research will propose the ATM
identification on the basis of biometrics inclusion in ATM. The
smart card is a second major source of information for the
people who will utilize the biometric system in their working.
The system of biometrics can be developed on the basis of
authentication and different new technologies available in this
system.
REFERENCES
[1] A. Lumini and L. Nanni, "Overview of the combination of biometric
matches," Information Fusion, vol. 33, pp. 71-85, 2017/01/01/
2017.
[2] M. V. Ruiz-Blondet, Z. Jin, and S. Laszlo, "Permanence of the
CEREBRAL brain biometric protocol," Pattern Recognition Letters,
vol. 95, pp. 37-43, 2017/08/01/ 2017.
[3] de Carvalho, and A. C. Lorena, "Score normalization applied to
adaptive biometric systems," Computers & Security, vol. 70, pp.
565-580, 2017/09/01/ 2017.
[4] M. Gomez-Barrero, E. Maiorana, J. Galbally, P. Campisi, and J.
Fierrez, "Multi-biometric template protection based on
Homomorphic Encryption," Pattern Recognition, vol. 67, pp. 149-
163, 2017/07/01/ 2017.
[5] S. Barman, S. Chattopadhyay, D. Samanta, and G. Panchal, "A novel
secure key-exchange protocol using biometrics of the sender and
receiver," Computers & Electrical Engineering, vol. 64, pp. 65-82,
2017/11/01/ 2017.
[6] A. Mahfouz, T. M. Mahmoud, and A. S. Eldin, "A survey on
behavioral biometric authentication on smartphones," Journal of
Information Security and Applications, vol. 37, pp. 28-37,
2017/12/01/ 2017.
[7] M. Xin and J. Xiaojun, "Correlation-based identification approach
for multimodal biometric fusion," The Journal of China Universities
of Posts and Telecommunications, vol. 24, no. 4, pp. 34-50,
2017/08/01/ 2017.
[8] E. J. Kindt, "Having yes, using no? About the new legal regime for
biometric data," Computer Law & Security Review, 2017/12/12/
2017.
[9] K. Aloui, A. Nait-Ali, and M. S. Naceur, "Using brain prints as a new
biometric feature for human recognition," Pattern Recognition
Letters, 2017/10/03/ 2017.
[10] G. Slanzi, G. Pizarro, and J. D. Velásquez, "Biometric information
fusion for web user navigation and preferences analysis: An
overview," Information Fusion, vol. 38, pp. 12-21, 2017/11/01/
2017.
[11] P. Punithavathi and G. Subbiah, "Can cancellable biometrics
preserve privacy?," Biometric Technology Today, vol. 2017, no. 7,
pp. 8-11, 2017/07/01/ 2017.
[12] I. Rigas and O. V. Komogortsev, "Current research in eye movement
biometrics: An analysis based on BioEye 2015 competition," Image
and Vision Computing, vol. 58, pp. 129-141, 2017/02/01/ 2017.
[13] A. Rattani and R. Derakhshani, "Ocular biometrics in the visible
spectrum: A survey," Image and Vision Computing, vol. 59, pp. 1-
16, 2017/03/01/ 2017.
4