Title:	“D3.2: A study on PKI and biometrics”

Author:	WP3

Editors:	Mark Gasson (University of Reading, UK)
Martin Meints (ICPP, Germany)
Kevin Warwick (University of Reading, UK)

Reviewers:	James Backhouse (London School of Economics, UK)
Paul De Hert (Leiden University, the Netherlands)

Identifier:	D 3.2

Type:	[Deliverable]

Version:	1.0

Date:	Thursday, 31 August 2006

Status:	[Final]

Class:	[Public]

File:	fidis-wp3-del3.2.study_on_PKI_and_biometrics.doc

Summary
Public-Key Infrastructures (PKIs) have been a hot topic for several years now, and many – often very practical – questions are still open. These certainly include corruption of keys or algorithms, usability, awareness of users and security issues. With respect to high-tech IDs, advanced PKI, e.g. supporting convertible credentials, could be developed. Until now, official PKI in member states, working according to the Digital Signature Act and national signature law, rarely work with pseudonymous keys and certificates. To improve the diffusion of electronic signatures into European markets six concrete measures are suggested. Both technologists and lawyers have experience in research on biometrics in the form of technology assessment and conceptualisation. However, for many kinds of biometrics it is still unclear how much security and privacy can be achieved. As the biometric market evolves in response to technology enhancement and political pressure, it is imperative that research on this topic is up to date, especially with respect to avoidance of discrimination and to privacy-compliance. This document forms a comprehensive study on PKIs and biometrics, specifically from the legal and technological point of view, with focus put on the possibility of privacy-enhancing implementations.

Copyright Notice:

This document may not be copied, reproduced, or modified in whole or in part for any purpose without written permission from the FIDIS Consortium. In addition to such written permission to copy, reproduce, or modify this document in whole or part, an acknowledgement of the authors of the document and all applicable portions of the copyright notice must be clearly referenced.

The circulation of this document is restricted to the staff of the FIDIS partner organisations and the European Commission. All information contained in this document is strictly confidential and may not be divulged to third parties without the express permission of the partners.

All rights reserved.

PLEASE NOTE: This document may change without notice – Updated versions of this document can be found at the FIDIS NoE website at www.fidis.net.

Foreword

FIDIS partners from various disciplines have contributed as authors to this document. The following list names the main contributors for the chapters of this document:

Chapter	Contributor(s)
1 (Executive Summary)	Martin Meints, ICPP Mark Gasson, University of Reading,
2 (Introduction)	Lorenz Mueller, AXSionics, Mark Gasson, University of Reading
3 (Public-Key Infrastructures and Digital Signatures)	Jos Dumortier, KULRD (3.1) Henry Krasemann, ICPP, (3.1.1, 3.4), Ammar Alkassar, SIRRIX (3.2), Matthias Bauer, ICPP (3.3), Xavier Huysmans, KULRD (3.4.2) Heiko Rossnagel, University of Frankfurt (3.5, 3.6) Mark Gasson, University of Reading
4 (Biometrics)	Els Kindt, KULRD (4.1, 4.3.2.2, 4.3.3) Vasiliki Andronikou, ICCS (4.2) Martin Meints, ICPP (4.2.1, 4.2.2, 4.6) Vaclav Matyas, MU (4.3.1.1, 4.3.1.2, 4.3.4) Lorenz Mueller, AXSionics (4.3.3.3) Michael Backes, IBM (4.4) Dionysios Demetis, LSE (4.5) Mark Gasson, University of Reading
5 (Enhancing PKIs using Biometrics)	Els Kindt, KULRD (5.1) Martin Meints, ICPP (5.2) Mark Gasson, University of Reading
6 (Conclusion)	Mark Gasson, University of Reading, Martin Meints, ICPP

Table of Contents

1Executive Summary	7

2Introduction	12

2.1The Importance of the Authentication Process	12

2.1.1PKI as a Logical Basis for a Secure Authentication Infrastructure	13

2.1.2The Weak Link in the Authentication & Verification Chain	13

2.2Document Scope and Content	14

3Public-Key Infrastructures and Digital Signatures	15

3.1Introduction	15

3.1.1Basic Definitions of Terms	17

3.2Digital Signature Schemes: Technical Aspects	18

3.2.1Security of Digital Signature Schemes	18

3.2.2Signature Schemes with Additional Properties	19

3.3Security and Privacy Aspects	22

3.3.1Security Aspects	22

3.3.2Privacy Aspects	23

3.4Legal aspects of Electronic Signatures	24

3.4.1Electronic Signatures According to EU Directives	24

3.4.2Legal Provisions on the use of Pseudonyms for Electronic Signatures	30

3.5Economic Aspects: Diffusion of Electronic Signatures	38

3.5.1Economic Theory	38

3.5.2Rate of Adoption of Qualified Electronic Signatures	41

3.5.3Qualified Electronic Signatures in the Innovation-Decision Process	44

3.5.4Analysis of Current Efforts to Diffuse Qualified Electronic Signatures	44

3.6Case Study: Mobile Signatures	46

3.6.1Server Based Electronic Signatures	46

3.6.2Client Based Electronic Signatures	47

3.6.3Certification on Demand	48

3.6.4Special Aspects of Mobile Signatures	50

3.6.5Possible Applications for Mobile Signatures	53

3.7Summary and Conclusions	55

4Biometrics	57

4.1Introduction	57

4.2Biometric Methodologies	59

4.2.1Technological Aspects of Biometric Recognition	59

4.2.2Physiological (or Passive) Methods	62

4.2.3Behavioural (or Active) Methods	78

4.2.4Soft Biometrics	86

4.3Security and Privacy Aspects	87

4.3.1Security Aspects	87

4.3.2Privacy Aspects	93

4.3.3Current Privacy Research Applied to Biometrics	100

4.3.4Biometric Credentials	102

4.4Case Study: Secure Storage Biometric Smart Cards	103

4.5Broader Social, Political and Economic Implications	105

4.5.1Biometrics as a Solution to What?	107

Nietzsche, F. (1979) Philosophy and Truth: Selections from Nietzsche's Notebooks of the Early 1870's, Prometheus Books, USA.	109

4.5.2A Social, Political and Economic Outlook	109

4.6Summary and Conclusions	110

5Enhancing PKIs using Biometrics	114

5.1The BEE Recommendations (IST-20078 BEE) and BioVision	114

5.2Summary	115

6Conclusion	117

7References	120

8Acronyms and Glossary	125

Appendix 1: Analytical Steps for Genetic Fingerprinting	128

Appendix 2: The Eigenface Approach	130

Appendix 3: Details of the Hidden Markov Model	132

Executive Summary

This document forms a comprehensive study on current implementations of digital signatures, public key infrastructure (PKI), biometrics and approaches for combined technical solutions. This is carried out from the legal and technological point of view, with focus put on privacy-enhancing implementations.

This study explains the technical infrastructure and the functional principals of cryptographic algorithms used for electronic signing. Basic standards, definitions and terms including those introduced by the European Directive 1999/93/EC have been described in light of their importance in the on-going development of public-key infrastructures (PKI). Cryptographic signature schemes for various areas of application are described; they are solutions to meet security requirements and can be used to implement additional functionality such as non-deniability (undeniable signature scheme), resistance against forgery (fail-stop signature scheme) or included encryption (signcryption scheme).

Security problems of PKI arise mainly from the use of general purpose machines for signing (secrecy of the private key may be compromised), the concept of trust in hierarchical systems (who trusts whom for what?), interoperability and compatibility aspects (such as certificate revocation, adoption of the X.509v3 standard for the internet and name schemes in cyberspace). In addition, the limited validity of key pairs raises a number of problems with for example the resigning of longer valid contracts or digital archives. The solution to those problems requires some technical effort and raises the costs of the infrastructure required for electronic signatures. From the privacy perspective the linkability of a certificate with the holder making her or him highly traceable when signing documents or transactions is a major problem of current PKI implementations. The concept of pseudonymous certificates is not very well adopted by the EU member states.

This study describes legal requirements, legal effects and the probative values for the four types of electronic signatures defined in the Directive 1999/93/EC. Legal provisions on a European level on the use of pseudonyms for electronic signatures are also discussed. The intent of the European legislator towards pseudonymous electronic signatures is concluded. The European legislator tries to ensure that the member states do not prevent certification service providers from indicating pseudonyms in certificates whilst at the same time leaving the choice to give legal effect to pseudonymous signatures up to them. Certificate providers should be obliged to communicate their conditions to the signatory; they could indicate limitations in a qualified certificate which have to be recognisable to third parties. The requirements of a service provider which offers pseudonymous certificates are concluded; a main topic is that they are liable for the damage resulting from any inaccuracy and incompleteness of the information contained in the certificates.

Using the established economic model of diffusion of technologies into a market, the currently available electronic signatures are compared with five key factors of success defined for technological products and solutions. While a good performance towards compatibility and complexity with today’s PKI is observed, the relative advantage against investigated substituting solutions, triability and observability need substantial improvements, at least in some European member states. This matches with the observed diffusion of electronic signatures in the investigated European markets.

From the economic perspective, the diffusion of PKI in the European market has been notably less successful than expected. This study suggests six concrete measures to improve the diffusion into the market:

To shift costs in order to achieve a fair distribution

Measures to reach the critical mass of users

Increasing awareness and knowledge about this technology

To especially target the user group called ‘early adopters’

To increase triability e.g. by trial versions of electronic signatures

To further reduce complexity of the needed private infrastructure

In a case study on mobile signatures two approaches are investigated: (1) a server based approach that is independent from the client and (2) a client based approach using an improved SIM-card. Technical aspects, basic designs and typical processes needed for mobile signing are presented and discussed. A number of possible applications including multilateral secure financial transactions and integration in a user controlled digital identity management system are discussed.

From the technological perspective, biometrics is a promising enrichment for the factors (or channels) of authentication. In this study terms and established categories of biometric methods are introduced. Five passive (physiological) and two active (behavioural) methods which demonstrate current state-of-the-art techniques are described and investigated with respect to technical strengths and weaknesses as well as privacy aspects. In contrast to the situation two years ago biometrics are now tested with higher enrolment numbers under operative conditions. Notably there is a gap between high quality of biometrics under laboratory conditions and limitations observed under practical implementation.

In addition to active and passive biometrics, soft biometrics are discussed with respect to their current area of application. Currently they are not used for authentication and verification, but have found applications for statistical purposes e.g., the assignment of an individual to a specific group such as an ethnic group (see FIDIS Deliverable 7.2 for further information on group profiling).

From a technological and economic perspective all biometric methods used today for authentication and verification depend on the following factors:

Quality (low False Acceptance Rates (FAR), secure systems with e.g. high tamper resistance and compliance to the privacy criteria of the European Art. 29 Data Protection Working Party (WP 29))

Convenience (easy and quick enrolment, use and maintenance, low False Rejection Rate (FRR))

Costs for the needed infrastructure

In this study technological weaknesses with respect to quality and convenience of the biometric methods were analysed. Many of these methods cannot be used by all people, for example iris recognition (e.g. people with aniridia) or genetic fingerprinting (e.g. monozygotic twins). In addition some methods cannot be used in certain environments. This applies to for example fingerprinting (people doing hard labour may have severely worn papillary structures) or face recognition (light conditions are vital for the quality of this method). For these cases alternative methods are needed when used for authentication or verification. Notably, current active and behavioural biometrics are not as reliable as passive biometrics. Perhaps the most notable aspect of biometrics is the connection between quality (in this case FAR) and convenience (in this case FRR) – it is not possible to optimise both factors at the same time due to the inherent connection between them.

Based on an international discussion on biometrics raised in the late 1990s and the work of the European WP 29, privacy criteria for the use of biometrics have been developed and, at least on the European level, are well agreed. Implementation of these criteria seems to be possible, in principle, with all of the investigated methods. In this study a number of current initiatives, projects and technical available systems looking into implementation of these criteria are described.

Figure 1‑1.1: Magic triangle of biometrics

Many questions with respect to implementation of privacy criteria are still open from the perspective of currently available solutions. In some cases it is not known if privacy-critical information e.g., concerning health, can be extracted from templates. This is notably not thoroughly investigated in areas where numerous different algorithms are used to generate templates, e.g. for face recognition. Further research is necessary in this area, however it is expected that this will not be driven by the economic sector due to the lack of economic interest.

Summing up those factors we can characterise biometrics by a “magic triangle” (Figure 1-1.1) deriving from a model originally established for project management. This magic triangle is defined through (1) quality, (2) convenience and (3) costs. At least currently it is impossible to optimise all of these factors at the same time – implementations of biometrics seem to always be a compromise with focus on one, at best two of these factors while the remaining factor or factors show significant weaknesses. Most notably, even when optimised with respect to quality, today’s available biometric systems are simply unsuitable for access control solutions with high security requirements.

In general we observe a far reaching international standardisation of methods and data formats for biometrics which are used for forensic purposes. This applies especially to fingerprinting and genetic fingerprinting. Other biometric methods suffer from the lack of standardisation; e.g., face recognition and hand geometry. In accordance to the privacy criteria described by the WP 29, biometrics which offer no common templates for the area of application, e.g., international authentication of individuals, should not be used. In addition, some algorithms and resulting template formats are subject to patents or copyright which will have an influence on the standardisation process. A case study on secure storage of biometric data on smart cards shows current research and development with respect to standardisation in the area of authentication technologies using biometrics.

The case study is followed by a broader view on social, economic and political implications of the planned introduction of biometrics, e.g. in ID documents such as passports. The complexity, the total costs of the introduction of biometrics in large scale projects and the draw backs on society seem to be underestimated. More research is therefore required to establish the interaction of such systems pertaining to the implementation of biometric technologies and to consider the potential implications of their deployment to other fabrics of the socio-political sphere which in their own turn will affect the economy. Especially in countries where the implementation of biometrics in ID documents is an opportunity for e-government services or for cooperation between public and private sector, there needs to be more research on how such an implementation will reframe the economic and commercial national and international relations.

Looking into current development of biometrics themselves we expect further improvements in the near future. Technological trends are:

Improvement of sensors e.g. for taking images or aliveness detection

Improvements in algorithms to generate templates

Developments in methods used to discriminate acceptance from rejection

This will result in improved accuracy, and hence security of biometric solutions. In addition further integration of systems e.g., bio-chips for genetic fingerprinting, will lead to improvements of functionality and further areas of application.

However, it seems likely that implementations of biometric systems will remain a compromise between several factors, and limitations of enrolment and application of certain biometrics to specific groups will remain.

It is possible for biometrics to offer significant enhancements to the PKI model. The co-operation of these technologies potentially brings a lot to the area of secure data exchange and general encryption. In the discussion on whether biometrics could enhance PKIs, the distinction has been drawn between (1) the use of biometrics in order to secure the access to the private key by the user, (2) the use of the biometric as an electronic signature and (3) the use of biometric characteristics as a private key in a PKI environment. Currently, most of those approaches are either still at the concept level, or in a pilot phase. Certainly within this structure, it appears that there is great promise for the continued integration of these two technologies.

Within the FIDIS Network of Excellence the results of this document are to be used for further research leading to several future deliverables. One area of research is the application of biometrics and PKI in ID documents such as passports, ID cards or e-health cards.

Certain aspects discussed in this document are also relevant for future work in the area of ID theft / ID fraud and ambient intelligence where authentication plays a central role. Certainly social and legal aspects of today’s technically weak authentications are an on-going matter of discussion there. From an ethical and legal perspective the question of how consent for transfer and processing of personal data defined by the European Directive 95/46/EC can be applied to passive authentication, e.g. using active biometrics, is still open. The solution to this issue is vital for the development of socially acceptable and commercially implementable concepts for ambient intelligent environments and thus also a key area of research within FIDIS.

Introduction

A large building with a vitreous facade and a prestigious lobby with secured entry doors still represents a classic picture of an enterprise or an organisation main seat. However this is an idea of the past. Companies and organisations in the E-society are becoming more and more virtual structures, distributed over many countries and interacting with a rapidly growing community of collaborators, clients and partners. In parallel to this evolution the classical concept of secured zones inside clearly defined borderlines vanishes. Security now includes logical (information systems) as well as physical assets (buildings, labs). This is true for the physical security, but even more for the security of the knowledge and information space of an enterprise or organisation.

The Importance of the Authentication Process

The process of authentication consists of establishing a link between a physical person and a corresponding digital identity. In the physical world, this link is often established through the use of an official document, such as a passport, established by a government entity. With a passport, the link between the physical person and the digital data entered in the passport (for example name, date of birth or nationality) is established with the help of a photograph and occasionally a signature or as is the cases in Portugal, a fingerprint.

Figure 2‑2.1: Authentication is a process used to link a physical person with a chosen identity

With the advent of computer systems and the need for heightened measures to fight criminal activity, new methods for authentication have been required to provide means to authenticate a person remotely (to log in remotely to a computer for example), and make it more difficult to forge an identity. However, the worthiness of the authentication document is directly related to the trust in the body that created the document, and the process used to establish a match with the physical person.

Authentication is today performed using a combination of methods, but has largely remained unchanged despite the availability of technology to strengthen the process. Recent developments, such as the terrorist attacks in September 2001, Internet-based financial scams and identity fraud have shed new light on the weaknesses in the systems currently in place and generated an overall push for increased levels of authentication security.

PKI as a Logical Basis for a Secure Authentication Infrastructure

Authentication has two facets. On one side authentication mechanisms serve to establish secure and authentic communication links between hardware components of a network. On the other side authentication should also guarantee that only authorised persons get access to certain resources.

For the machine authentication tasks, cryptographic secured protocols for all kinds of communication channels and network architectures have been developed. A public key infrastructure (PKI) provides the necessary mechanism and instances of trust for establishing a secure, efficient and auditable management of keys for the establishment of the cryptographic secured communication links. If applied and implemented in a proper way, a PKI and the related mechanisms provide strong protection against intruders.

Figure 2‑2.2: The process of authenticating an individual is typically the weakest part of the system

The Weak Link in the Authentication & Verification Chain

Much less obvious is the secure authentication of persons. Persons will not accept complicated protocols and cannot perform in a cryptographic dialog. Until recently, the problem has been circumvented by asking for the knowledge of a secret password or PIN-code from a person on the request to become an authorised user. However, it is a well-known fact that people neither choose strong passwords nor treat passwords as highly valuable secrets. The average user will always optimise ergonomic convenience regardless of security considerations. The result is an unbalanced security situation with a clear weak spot at the point where a physical person is linked to her digital identity. Social engineering attacks make this weakness obvious, with phishing being the best known but not by far the only such threat. Any form of masquerading or man-in-the-middle attacks may break the fragile chain of trust between a physical person and their identity credentials.

Solutions exist today to provide authentication of persons at much higher security levels. However, the hard problem in all security, and especially in all authentication schemes, is the integration of the human user in the security chain. Organisations need highly secure and user friendly authentication with no compromise on privacy, mobility or cost efficiency. The use of PKI to secure digital identity credentials and strong links of these credentials, based on biometrics and other authentication methods, to the physical person can potentially provide a solution to the problem.

Document Scope and Content

This document has a broad scope, covering particularly the technical and legal aspects of Public Key Infrastructures, and Biometrics, with a focus on the possibility of privacy-enhancing implementations.

Chapter 3 considers PKIs and digital signatures by introducing their application and analysis of the key terminology as described in the EU Directive 1999/93/EC. Following this, the chapter examines the technical aspects of PKIs and their implementation. The inherent security and privacy aspects that are bought about by their specific implementation are then discussed. The EU has initiated some legal directives regarding electronic signatures and pseudonyms for electronic signatures, and these are presented and discussed in section 3.4. This is followed by an analysis of the current acceptance of electronic signatures and in particular analysis on current efforts to diffuse qualified electronic signatures. Finally, this section concludes with the examination of a case study on mobile signatures.

Chapter 4 tackles the rapidly expanding field of Biometrics. It starts by introducing the key facets of the technology, and by discussing the various methodologies that are being currently adopted. Then the technological aspects are presented and more detail is given by showing how such approaches can be divided into two broad groups of active and passive biometrics. A discussion follows of the important issues of privacy and security pertaining to the use and implementation of biometric systems. This is achieved by considering the technical, formal and informal aspects of privacy and security. Next, a case study of Secure Storage Biometric Smart Cards is presented and analysed, followed by consideration of the broader implications of implementing biometric systems, from the social, political and economic perspectives.

Chapter 5 attempts to draw a common thread between PKIs and Biometrics by considering the possibilities of biometric-enhanced PKI systems. It draws a distinction between the three methods by which this may be achieved, and illustrates them using the BEE recommendations (IST-20078 BEE) and BioVision project.

Chapter 6 draws conclusions from this document.

Public-Key Infrastructures and Digital Signatures

Introduction

A Public Key Infrastructure (PKI) is a security architecture which is aimed at providing an increased level of confidence for exchanging information over the increasingly insecure Internet. The term PKI can be very confusing, even to a technologist, because it is used to mean several different things. On the one hand, PKI can be defined as a set of hardware, software, people, policies and procedures needed to create, manage, store, distribute and revoke public-key certificates. On the other hand, it may mean the use of a public and private key pair for authentication and proof of content. A PKI infrastructure is expected to offer its users benefits, such as certainty of the quality of information sent and received electronically, certainty of the source and destination of that information, assurance of the time and timing of that information (providing the source of time is known), certainty of the privacy of that information, assurance that the information may be introduced as evidence in a court or law. These facilities are delivered using a mathematical technique called public key cryptography that uses a pair of related cryptographic keys to verify the identity of the sender (signing) and/or to ensure privacy (encryption). PKI facilities have been developed principally to support secure information exchange over insecure networks - such as the Internet - where such features cannot otherwise be readily provided. Nevertheless, they can also be used just as easily for information exchanged over private networks, including corporate internal networks. What is more, PKI can be used to deliver cryptographic keys between users (including devices such as servers) securely, and to facilitate other cryptographically delivered security services.

Public-key cryptography uses a pair of mathematically-related cryptographic keys. If one key is used to encrypt information, then only the related key can decrypt that information. Should you know one of the keys, you cannot easily calculate the other one. A private key is used to decrypt information that has been encrypted using its corresponding public key. The person using the private key can be certain that the information they are able to decrypt must have been intended for them, but they cannot be certain from whom the information comes.

If the sender wishes to prove to a recipient that they are the source of the information (perhaps they accept legal responsibility for it), they use a private key digitally to sign a message (a digital signature). Unlike the handwritten signature, this digital signature is different each time it is deployed. A unique mathematical value, determined by the content of the message, is calculated using a ‘hashing’ or ‘message authentication’ algorithm, and then this value is encrypted with the private key – creating the digital signature for this specific message. The encrypted value is either attached to the end of the message or is sent as a separate file together with the message. The Public Key corresponding to this private key may also be sent with the message, either on its own or as part of a certificate. A certificate is information referring to a public key that has been digitally signed by a Certification Authority (CA).

The framework for PKI is defined in the ITU-T X.509 Recommendation [X.509]. The most important elements of a PKI are the following ones:

End Entity: a generic term used to denote end-users, devices (e.g., servers, routers), or any other entity that can be identified in the subject field of a public key certificate. End entities typically consume and/or support PKI-related services.

Certification Authority (CA): the issuer of certificates and (usually) CRLs. It may also support a variety of administrative functions, although these are often delegated.

Registration Authority (RA): an optional component that can assume a number of administrative functions from the CA. The RA is often associated with the End Entity registration process, but can assist in a number of other areas as well.

Repository: a generic term used to denote any method for storing certificates and CRLs so that they can be retrieved by End Entities.

End Entities must “enrol” into the PKI before they can take advantage of the PKI-enabled services. Registration is the first step in the End Entity enrolment process. This is usually characterised as the process whereby an End Entity first makes itself known to a CA. Once the identity of the End Entity is verified in accordance with the applicable policies, the End Entity is typically issued one or more shared secret(s) and other identifying information that will then be used for subsequent authentication as the enrolment process continues.

Initial registration is followed by initialisation. This step is usually associated with initialising the End Entity with its associated key pair(s). Key pair generation involves the creation of the public/private key pair associated with an End Entity. Key pair generation can occur in advance of the End Entity enrolment process or it can take place in response to it. Key pairs can be generated by the End Entity client system, RA, CA or some other component such as a hardware security module.

Certification is the conclusion to the End Entity enrolment process. As the word implies, this step involves the issuance of the End Entity public key certificate by the CA. If the key pair is generated externally to the CA, the public key component must be conveyed to the CA in a secure manner. Once generated, the certificate is returned to the End Entity and/or published to a certificate repository. Certificates are issued with fixed lifetimes (referred to as the “validity period” of the certificate). However, the circumstances that existed when the certificate was issued can change before the certificate expiry. Reasons for revocation include private key compromise, change in affiliation and name change (specific reason codes are defined in X.509). Therefore, it is sometimes necessary to revoke a certificate before its expiration date. The Revocation Request allows an End Entity or a Registration Authority (RA) to request revocation of a given certificate. Certificate revocation information must be made available by the CA that issued that certificate or by the CRL Issuer to which the CA delegates this function. X.509 defines a method for publishing this information via Certificate Revocation Lists (CRLs). The End Entities, or trusted third parties operating on their behalf, must check the revocation status of all certificates in a given certification path. This includes revocation information about End Entity certificates as well as intermediate CAs.

Key pairs and public key certificates can be used to support digital signature creation and verification, encryption and decryption, or both. Digital signatures are typically used for securing the authenticity and the integrity of data processed in a system or transmitted over a network. Therefore the technology can also be used to “sign” data in the legal sense (so-called “electronic” signatures). Between 1995 and 1998 legislation was enacted in the US and in Europe presenting the digital signature technology as the privileged technology to generate secure electronic signatures for legal purposes. Later legislation reversed this approach in order to follow a more technology-neutral approach for electronic signatures. Nevertheless, the European Directive 1999/93/EC still refers to electronic signatures based on PKI, mainly in its annexes containing requirements for qualified certificates based on the X509 standard.

PKI is quite a complex and expensive solution and it has been less successful than expected. However it is still considered to be a very secure technology for authentication and electronic signatures. National identity card projects in some European Member States such as Austria, Belgium, Estonia, Finland and others have adopted PKI for these functions.

In principle, normal business regulations are valid concerning the Internet and electronic transactions. Contracts resulting in a binding obligation for all parties can be made by e-mail or by a simple click. To ensure authenticity and to have potential evidence in an anonymous environment in front of court, the use of electronic signatures is reasonable. Additionally authenticity can be gained by using pseudonyms, a possibility the legal systems of some countries provide (e.g., Germany, § 5 paragraph 3 Signaturgesetz, see section 3.4.1.1).

Basic Definitions of Terms

To avoid different regulations within member states, the EU approved Directive 1999/93/EC on the 13.12.1999 on a Community framework for electronic signatures . In this directive the following terms are defined:

Electronic signature

Means data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication

Advanced electronic signature

Means an electronic signature which meets the following requirements:

It is uniquely linked to the signatory

It is capable of identifying the signatory

It is created using means that the signatory can maintain under his sole control

It is linked to the data to which it relates in such a manner that any subsequent change of the data is detectable.

Signatory

Means a person who holds a signature-creation device and acts either on his own behalf or on behalf of the natural or legal person or entity he represents

Signature-creation data

Means unique data, such as codes or private cryptographic keys, which are used by the signatory to create an electronic signature

Signature-creation device

Means configured software or hardware used to implement the signature-creation data

Secure-signature-creation device

Means a signature-creation device which meets the requirements laid down in Annex III of the European Directive about electronic signatures

Signature-verification-data

Means data, such as codes or public cryptographic keys which are used for the purpose of verifying an electronic signature

Signature-verification device

Means configured software or hardware used to implement the signature-verification-data

Certificate

Means an electronic attestation which links signature-verification data to a person and confirms the identity of that person

Qualified certificate

Means a certificate which meets the requirements laid down in Annex I of the European Directive about electronic signatures and is provided by a certification service provider who fulfils the requirements laid down in Annex II

Certification service provider

Means an entity or a legal or natural person who issues certificates or provides other services related to electronic signatures

Electronic-signature product

Means hardware or software or relevant components thereof, which are intended to be used by a certification service provider for the provision of electronic-signature services or are intended to be used for the creation or verification of electronic signatures

Voluntary accreditation

Means any permission, setting out rights and obligations specific to the provision of certification services, to be granted upon request by the certification service provider concerned, by the public or private body charged with the elaboration of, and supervision of compliance with, such rights and obligations, where the certification service provider is not entitled to exercise the rights stemming from the permission until it has received the decision by the body.

Digital Signature Schemes: Technical Aspects

Digital signature schemes are cryptographic processes which provide similar functions for digital messages as handwritten signatures do for messages on paper: They guarantee the authenticity of a message to its recipients (data origin authentication), and the recipient can prove this authenticity to third parties, such as courts, at a later date (non-repudiation). Hence, digital signatures are necessary wherever legal certainty is required in digital message exchange.

An essential requirement for a useful deployment of digital signatures is the availability of a Public Key Infrastructure (PKI). Validating a digital signature requires an authenticated public key from the issuer. Certificates (which roughly speaking are signed public keys) organised within a PKI allow the construction of relationships of trust without authenticating each key manually.

Usually, a digital signature consists of three algorithms: The (probabilistic) key generation algorithm generates a public/secret key pair. The signing algorithm gets the secret key and the message to be signed and outputs the signature. The verification algorithm gets the signature (and sometimes the original message) and outputs whether the verification succeeded or not. Digital signature schemes can be categorised in two general classes: digital signature schemes with appendix require the original message as input to the verification algorithm and digital signature schemes with message recovery do not.

Security of Digital Signature Schemes

Digital signature schemes are usually based on trapdoor one-way functions like RSA or ElGamal. However, the RSA scheme and the ElGamal scheme are not ‘provably secure’ since they are subject to existential forgery, e.g., it is easy to create new valid message-signature pairs. Since the appearance of public key cryptography, a significant line of research has tried to provide provable security for cryptographic protocols and schemes. In the area of computational security, proofs have been given in the asymptotic framework of complexity theory. However, these are not absolute proofs since cryptography ultimately relies on the existence of one-way functions and the P vs. NP question . Instead, there are computational reductions to and from well known (but not proven) problems from number theory such as factoring, the discrete logarithm problem or the root extraction problem.

The first signature scheme proven to be secure against a very general attack, the so-called adaptive chosen-message attack, was been proposed by Goldwasser, Micali and Rivest in [GMR88]. Since then many provable and efficiently employable schemes have been proposed.

Forward-Secure Signature Schemes

The goal of forward security is to protect some aspects of signature security against exposure of the secret signing key, but in a simple way. In particular, it requires no distribution of protected storage devices, nor does it increase key management costs.

However, obviously we cannot expect total security. Once a signing key is exposed, the attacker can forge signatures. The idea of forward security is simply that a distinction can be made between the security of documents pertaining to (meaning dated in) the time prior to key exposure and those pertaining to the period after key exposure.
A forward secure signature scheme is given in [BEL99].

Signature Schemes with Additional Properties

Undeniable Signatures

Undeniable Signatures provide more privacy than ordinary ones since a recipient can show an ordinary received signature to anybody else, even if there is no need to do so. For example, if Alice lent Bob money and in the process received a signed promissory, usually there is only a need to show the signature in the case of a dispute. However, Alice can show the promissory around infringing the privacy of Bob who may want to keep the fact that he borrowed money private.

In contrast, undeniable signatures cannot be shown to third parties without the help of the signer. If, however, the signer is forced to either deny or acknowledge a valid signature, e.g., in court, he cannot deny it. Undeniable (or invisible) signatures were introduced in [ChAn90].

Designated confirmer signatures (or sometimes simply ‘confirmer signatures’) are a variant of undeniable signature schemes that can be verified only with some help of a semi-trusted designated confirmer. They were introduced by Chaum [CHA95] as an improvement of convertible undeniable signatures. The main difference to convertible undeniable signatures is that the capability to confirm a signature does not lie solely with the signer, which has several advantages. Designated confirmer signatures improve the availability and reliability of the confirmation services for verifiers. Verifiers can rely on a designated confirmer instead of having to rely on the signers themselves.

Designated confirmer signatures are a useful tool to construct protocols for contract signing [ASW98]. The trusted third party in contract signing takes the role of a designated confirmer. Each participant produces a designated confirmer signature of his statement and distributes it to all other participants and to the trusted third party. After the trusted third party has collected the statements and corresponding designated confirmer signatures from all participants, they convert them into ordinary digital signatures and circulates them to all participants according to a predefined policy. Designated confirmer signatures are also useful for constructing verifiable signature sharing schemes [FR95].

Blind Signature Schemes

Blind signatures are issued by the signer although the signer does not actually see the content of the message he signs. However, the signer has the guarantee of signing just one message at a time. An important application is untraceable payment schemes in which the bank signs so-called electronic coins using a blind signature scheme and sells them. Later, the owner of a coin can pay with it, and the payee can deposit the coin at the bank again. The bank cannot trace the payment, because it had not actually seen the coin in the first place.

Construction of blind signatures also requires the recipient to transform what the signer really does into the form of a signed message. The efficient construction relies on the multiplicative structure of RSA or similar basic signature schemes; in a sense, they employ selective forgery after a chosen-message attack, but in a positive way.

Group-Oriented Signature Schemes

Sometimes people sign on behalf of a group or an organisation. In this case, it may be useful if the group has a public key. Thus, the recipients do not need to know which individuals belong to the group. If the group members trust each other, they can simply generate one secret key and disseminate it within the group. However the task gets more difficult if one of the following additional requirements have to be met:

A certain quorum of group members is needed to produce a signature. This maybe a simple threshold or a more complicated rule, e.g., two directors, or one director and two vice-directors etc.

Provisions are needed to deanonymise a particular signer later under certain circumstances.

Other issues include: Whether a group centre is needed, to which extent it has to be trusted, and how it has to take part and whether it is explicitly required that the specific signer within the group remains anonymous from the recipient (unless the specific deanonymiser is made within the group) and whether members can dynamically enter or leave the group.

Schemes where a quorum is needed are often called threshold signature schemes. Schemes where anonymity is guaranteed, but deanonymisation is possible under certain circumstances, are typically called group signature schemes.

Identity-Based Signature Schemes

In identity-based signature schemes, the public keys are simply the digital partial identities of their owners. The best known scheme is given in [FIA87]. There, a trusted third party generates all the secret keys, which are used to sign messages with respect to their identities. This is necessary otherwise there would be no difference between the signer and the other participants.

From the applications point of view, identity-based signature schemes are no different from the ordinary digital signature schemes. In addition they include key distribution via certificates by one centre. The only advantage of identity-based schemes is that the length of the authentication information is halved.

One-Time Signature Schemes

One-time digital signatures can be used to sign, at most, one message otherwise signatures can be forged. Thus, a new public key is required for each message that is signed. The public information necessary to verify one-time signatures is often referred to as validation parameters. Most, but not all, one-time digital signatures have the advantage that signature generation and verification are very efficient. One-time signature schemes are useful in applications such as chip cards, where low computational complexity is required.

Fail-Stop Signature Schemes

A fail-stop signature scheme contains all the components of an ordinary digital signature scheme, and, as long as the cryptographic assumption is not broken, it works in the same way. However, if someone succeeds in forging a signature, in spite of the assumption, the supposed signer can prove that it is a forgery. More precisely, if the forged signature is shown to him in order to make him responsible for it, he can prove the underlying assumption has been broken [PFIT96].

Self-Certified Signature Schemes

In these schemes, a signer computes a temporary signing key with his long-term signing key and its certification information together, and generates a signature on a message and certification information using the temporary signing key in a highly combined and unforgeable manner. Then, a verifier verifies both the signer’s signature on the message and related certification information together. Examples are [PET97] and [LEE02].

Signcryption

In contrast to current standard methods used to achieve privacy and authenticity, i.e. signature followed by encryption, signcryption addresses a question on the cost of secure and authenticated message delivery/storage, namely, whether it is possible to transport/store messages of varying length in a secure and authenticated way with an expense less than that required by signature followed by encryption.

Signcryption schemes fulfil simultaneously both the functions of digital signature and public key encryption in a logically single step, and with a cost significantly smaller than that required by signature followed by encryption. Examples are [ZEH97] and [NAL03].

Security and Privacy Aspects

Security Aspects

The concept of a global Public Key Infrastructure (PKI) has several inherent problems. These problems have been known for years and received extensive discussion in the security community, see for example Peter Gutmann’s X.509 Style Guide , Carl Ellison’s testimony before congress , Bruce Schneier’s 10 Risks of PKI [SCH00] or [LAN02]. Given below are just a few of them.

Hidden assumptions

The hidden assumption underlying public key cryptography, and thus PKI systems, is that secret keys always remain secret. In reality that would necessitate specially designed hardware and software for the exclusive purpose of signing. As long as secret keys are kept in general purpose machines with all their security shortcomings , the non-repudiation of digital signatures cannot be guaranteed.

“Trust” in hierarchical systems

Hierarchical PKI systems consist of trees of certificate authorities (CAs) with individual keys as leaves (“Subjects” in X.509 terminology). The CAs certify connections between subject names and public keys. The CAs nearer the root of the tree certify compliance to certain policies (Policy CAs) with their signatures. The policies define the strictness of checks to run on individuals who apply for certificates, among other things. When an application checks a subject’s certificate, this means that it has to check along the chain starting at the root CA (which has ultimate “trust”) up to the CA signing the subject’s key.

The problem with this approach is that all CAs’ policies have to be at least as strict as the root CA’s policy. This monotonously increasing burden of “trustworthiness” does not reflect economic reality, i.e. the root CAs are run in high-security environments and charge highly for their services whereas less central CAs often cannot implement the same precautions. Another problem is the lack of checks on the implementation of policies.

Certificate revocation

If a certificate holder suspects that someone may have copied her secret key (although knowing that might not be possible), she can issue a certificate revocation request to the CA that signed her key. The CA then puts the certificate’s unique number on a public list of revoked certificates, the Certificate Revocation List (CRL). For this reason, every signature check requires an authenticated query to the CA.

This concession to the potential non-secrecy of secret keys breaks the elegant design of PKI. One might be tempted to ask, for example, why anyone needs signed certificates at all if one must inquire after the subjects’ keys at a central authority anyway.

Square pegs in round holes

The established standard for certificates, X.509v3, was designed by committees not involved with the Internet and its inner workings. It is no wonder that the requirements of Internet applications do not map nicely onto the data fields of X.509 certificates. This has led to a multitude of non-interoperable adoptions to the standard, which again has delayed adoption of security protocols such as IPsec.

Names in cyberspace

In the identity context, another problem with global PKI arises. If one were looking, e.g., for old John Smith’s public key, a PKI would most probably not help. Names which are globally unique (“John E. Smith with passport number 0X456DN34757”) cannot be memorised easily by people, whereas the naming schemes useful for people (“the John Smith from Baltimore, who works for Ann Miller”) are not easily formalised to allow automated processing.

Longevity of signatures

If digital signatures were to replace handwritten ones, the non-material nature of digital signatures becomes a problem. If a contract’s duration is 30 years, and at the end of this span one of the partners claims never to have signed the contract, it is far from clear how this would be resolved. The CA which signed the certificates and kept the revocation list might be out of business. The signer’s key and the key that the CA used to sign the CRL might be broken by then by new algorithms or faster hardware, such that anyone could fake the signatures.

Privacy Aspects

Traditional public key certificates contain information about the holder. Each digital certificate can be traced uniquely to the person to whom it has been issued (or to the device in which it has been incorporated) and can be followed around instantaneously and automatically as it moves through the system. In this respect, digital certificates offer no more privacy than social security numbers, credit card numbers, and health registration numbers. Consequently, digital certificates can be misused to deny a certificate holder access to services, and to block his or her communication attempts in real time. For example, certificate blacklists could be built into Internet routers. Also, transaction generated data conducted with target certificates can be filtered out by surveillance tools, and delivered electronically to third parties.

In spite of these threats, the protection of privacy has never been a core issue in the legal and policy discussions about PKI in Europe. Of course every PKI application has to be fully compliant with the provisions of the European Data Protection Directive 1995/46/EC. But the use of identity certificates as such has rarely been put into question since the European regulatory framework for electronic signatures was introduced.

Following the example of the German “Signaturgesetz” (see section 3.4.1.1) of 1997 the European Directive 1999/93/EC provides that personal information used in this context should be directly collected from the person concerned and foresees also the possibility to use certificates based on pseudonyms. In practice however, the electronic identity card initiatives in the Member States which adopted PKI as a solution for authentication and electronic signatures do not make use of this possibility. Some of these initiatives even make extensive use of unique identifiers.

In Australia, the Federal Privacy Commissioner, on the invitation of the government, has issued guidelines for Commonwealth Agencies using PKI to transact with individuals . The guidelines include: the principle of choice for individuals to use or not to use a PKI-based government service, the necessity to conduct a “privacy impact assessment” before the introduction of a PKI-based solution, the prohibition to collect or to log unnecessary personal data, the individual’s choice between one or multiple certificates, an opt-out possibility for public directories, the principle of key generation by the subscriber, etc.

From a technological perspective, research has been conducted to find suitable alternatives for PKI based on identity certificates. One of these alternatives is the use of credentials. Following earlier research findings of David Chaum and others, Stefan Brands has described this alternative in his book “Rethinking Public Key Infrastructures and Digital Certificates” . The certificates he proposes function in much the same way as cash, stamps, cinema tickets or subway tokens: anyone can establish the validity of these certificates and the data they overtly specify, but no more than that. A “demographic” certificate, for instance, can specify its holder’s age, income, marital status, and residence, all digitally tied together in an unforgeable manner. Each certificate holder can decide for himself, depending on the circumstances, which part of the data encoded into a digital certificate to disclose. Also, a certificate can be presented in such a manner that no evidence is left at all of the transaction; this is much like waving a passport when passing customs. Alternatively, it can be presented in such a manner that the only information left is self-authenticating evidence of a message or a part of the disclosed property; this is much like presenting a paper-based certificate with crossed-out data fields so that a photocopy can be made. Furthermore, the self-authenticating evidence can be limited to designated parties.

Legal aspects of Electronic Signatures

Electronic Signatures According to EU Directives

Types of the Electronic Signature in comprehensive European law

Germany was one of the first countries with a law regulating digital signatures. The first “Signaturgesetz” – Law Governing Framework Conditions for Electronic Signatures – Signatures Law (SigG) became effective on 01 November 1997 and was revised by a new law of 16 May 2001 (last amended 4 January 2005). By the signatures law and the ordinance “Signaturverordung” (SigV) the legal framework conditions of the construction of signatures and the certification by trust centres were regulated.

Since then, other countries of the EU have developed their own regulations regarding digital/electronic signatures. To avoid different regulations within the Member States the EU approved Directive 1999/93/EC of 13.12.1999 on a Community framework for electronic signatures . This also contained a graded system of different kinds of signature regulations regarding legal effectiveness and ability of proof. The EU Directive is neutral concerning technology and implementation and changes nothing on party autonomy or contractual freedom. The term “electronic signature” should be more open to all kinds of signature technologies than the technologically defined term “digital signature”. The purpose of the Directive is to facilitate the use of electronic signatures and to contribute to their legal recognition. It establishes a legal framework for electronic signatures and certain certification-services in order to ensure the proper functioning of the internal market (cf. Article 1 of the Directive).

The following exemplarily depicts the implementation of the Directive as it was realised in Germany.

Other Electronic Signatures

In principle according to Article 1 par. 1 of the Directive (cf. Section 1 par. 2 SigG) different signature methods are allowed and possible. The use of signature methods like PGP or complete free systems therefore is permitted. The legal validity remains restricted to areas in which the law does not require particular form.

Advanced Electronic Signatures

Prerequisites for the advanced electronic signature are (cf. Article 2 no. 2 of the Directive):

It is uniquely linked to the signatory

It is capable of identifying the signatory

It is created using means that the signatory can maintain under his sole control

It is linked to the data to which it relates in such a manner that any subsequent change of the data is detectable

Qualified Electronic Signatures

A qualified electronic signature means a certificate which meets the requirements laid down in Annex I of the European Directive regarding electronic signatures. It must contain:

An indication that the certificate is issued as a qualified certificate

The identification of the certification service provider and the State in which it is established

The name of the signatory or a pseudonym which shall be identified as such

Provision for a specific attribute of the signatory to be included if relevant, depending on the purpose for which the certificate is intended

Signature-verification data which correspond to signature-creation data under the control of the signatory

An indication of the beginning and end of the period of validity of the certificate

The identity code of the certificate

The advanced electronic signature of the certification service provider issuing it

Limitations on the scope of use of the certificate, if applicable

Limits on the value of transactions for which the certificate can be used, if applicable

Additionally it must be provided by a certification service provider who fulfils the requirements laid down in Annex II (cf. Article 2 no. 10 of the Directive).

For qualified electronic signatures in Germany according to Section 4 SigG the obligation of Sections 5 till14 SigG must be accomplished. For this it is sufficient that the provider reports commencing of operation to the German “Regulierungsbehörde für Telekommunikation und Post” (RegTP). A voluntary accreditation is not necessary.

The following points additionally join the prerequisites of the advanced signature:

signatures are based on a qualified certificate valid at the time of their creation (Section 2 no. 3a) and

signatures have been produced with a secure signature-creation device (Section 2 no. 3 b) SigG)

Qualified electronic signatures of providers from within the EU must be treated as equivalent to German signatures if they correspond to at least the minimum requirements provided in the Directive. For example, the EU signature guideline does not dictate the regulation of a preservation period as it applies to the German law (cf. Annex II lit. i) of the Directive). The German law regulates a preservation period of five years in Section 4 SigV.

Qualified Electronic Signatures based on voluntary Accreditation (Accredited Electronic Signature)

Voluntary accreditation is according to Article 2 no. 13 of the Directive any permission, setting out rights and obligations specific to the provision of certification services, to be granted upon request by the certification service provider concerned, by the public or private body charged with the elaboration of, and supervision of compliance with, such rights and obligations, where the certification service provider is not entitled to exercise the rights stemming from the permission until it has received the decision by the body.

The accredited electronic signature is regulated in Germany in Section 15 SigG and goes beyond the standard regulations of qualified electronic signatures. The obligations of the Sections 5-14 SigG have to be met. The supplier must in particular prove this by an initial examination / voluntary accreditation. A re-examination is carried out every three years at the latest (cf. Section 11 paragraph 2 SigV).

Legal effects

Not only were the types of signatures regulated in Europe, but the Directive also instructed the Member States to regulate the recognition of electronic signatures in their systems of laws for different legal transactions in civil and administration law. This also means the modification of proof methods to put strong powers into the hand of the users and acceptors of electronic signatures in a dispute in front of court.

This means that the Member States must ensure that advanced electronic signatures satisfy the legal requirements of a signature in relation to data in electronic form in the same manner as a hand-written signature satisfies those requirements in relation to paper-based data (cf. Article 5 of the Directive).

The regulation shall be illustrated using the German law again.

Other Electronic Signatures

For other electronic signatures there are no particular regulations for legal effect. They can be employed everywhere where the law does not require particular form. As in the case of verbal contracts and simple e-mails with corresponding contents, a valid contract takes place according to German law.

Advanced Electronic Signatures

The advanced electronic signature obtains the same rules as the ‘other electronic signatures’. It is also only applicable where the law does not stipulate particular form for correct business behaviour. With the increased prerequisites it can however be easier to prove.

Qualified Electronic Signatures

The application field for the qualified electronic signature was expanded in the German law by Sections 126 pp. BGB (German civil law). In most cases in which writing is demanded according to the law, the “signature” also can be carried out with the qualified electronic signature (cf. Section 126 par. 3 BGB). Only for particularly serious business are the handwritten signature or even stronger forms still required such as at declarations of surety (Section 766 BGB), purchases of property or the making of a will (Section 2247 BGB).

Qualified Electronic Signatures based on voluntary Accreditation

For the accredited electronic signature, there is limited application in the business area today. This kind of signature was also stipulated by the corresponding EU Directive. Only in the area of administration are the Member States allowed to dictate stricter prerequisites than for the qualified electronic signature for certain actions. One example is the accredited electronic signature in Germany. A reason for the limited application today seems to be that accredited signatures have to remain testable for 30 years (a problem of electronic archives). According to German law, the supplier of qualified signatures is obliged to store certificates for five years only after the year the validity has expired.

Probative value

Anyone who wants to sue for his right in front of court with digitally signed documents must prove the substantiating facts. If he does not succeed, his complaint will be rejected. On the other hand, the one who wants to defend himself against a complaint must have counterevidence or show the insufficiency of the evidence of his opponent.

Article 5 of the EU Directive states that Member States shall ensure that advanced electronic signatures are admissible as evidence in legal proceedings (Article 5 no. 1). The Member States shall also ensure that an electronic signature is not denied legal effectiveness and admissibility as evidence in legal proceedings solely on the grounds that it is in electronic form, or not based upon a qualified certificate, or not based upon a qualified certificate issued by an accredited certification service provider, or not created by a secure signature-creation device (Article 5 no. 2).

The possibilities for this are regulated very differently within the systems of laws in Europe. German law is used once more as an example.

In principle, the German law has different regulations for different kinds of evidence. Electronic documents, such as e-mails according to Section 371 par. 1 ZPO (German code of civil procedure), are seen as “objects of appearance” (Augenscheinsobjekte). The judge has the possibility of free evaluation of evidence. With the “Gesetz zur Reform der Zivilprozessordnung” (law for the reform of the code of civil procedure), which became effective on 01 January 2002, there are special consequences in civil action regarding electronic signatures now. These aim particularly at facilitating the tendering of evidence.

Other Electronic Signatures and Advanced Electronic Signatures

For the ‘other electronic signature’, as well as the advanced electronic signature, there is in Germany the basic principle of free evaluation of evidence by the judge with regard to these objects of appearance. There are no special proof regulations with respect to this. The process of proving can in fact be easier when using a digital signature. This confidence can be obtained by long experience with the reliability of such methods or measures of the suppliers.

Qualified Electronic Signatures

For the qualified electronic signature the new Section 292a ZPO was edited in Germany. Therein it is called: “The appearance of genuineness of an explanation available in electronic form (Section 126a of the German civil law) resulting from an examination according to the signature law, can only be unsettled by facts that substantiate serious doubts that the explanation has been given willingly by the key owner.”

This means that when there is a qualified electronic signature that was tested positively, the court in principle assumes that this explanation has been made by the signature key owner. If the opposing party already denies that a qualified electronic signature exists, the party which refers to the validity has to prove the prerequisites. He has to prove the fulfilment of the prerequisites of a qualified signature according to Section 2 no. 2 a) – d) and no. 3 a) and b) SigG. He is not obliged to do so, if the opposing party can not arouse doubt.

Initially, the exclusive assignment of the signature to the signature key owner must be proven according to Section 2 no. 2 a) SigG. Suppliers of qualified signatures have to rely upon their documentation in accordance with § 10 SigG.

The proof of identifiability of the signature key owner like in Section 2 no. 2 b) SigG can fail because of the restricted obligation to store certificates for qualified signatures (Section 4 par. 1 SigV). The supplier is obliged to keep them for only five years after expiry of the validity. There is no trustworthiness of the root authority as such either since qualified certification suppliers confirm their trustworthiness to themselves on their own and mutually.

Furthermore the party giving evidence has to prove that the signature was created with resources that one of the signature key owners can hold under his exclusive control. This can be difficult owing to the short period of storage mentioned above.

The proof of reliability (like Section 2 no. 3 b) SigG) can then be problematic if the employed signature method in the meantime has been proven to be insecure. To prevent this, a regular re-evaluation of the signatures every six years can be recommended.

Evidence to prove the use of a secure signature-creation unit as in Section 2 no. 3b) SigG might arise from the documentation of the supplier. This also applies to the proof that the signature is based on a qualified certificate valid at the time of its production (Section 2 no. 3 a) SigG). The technical and administrative security of the supplier must hereby be explained by the probating party.

If the probating party succeeds in proving these six points, the ‘proof of appearance’ that the explanation was given with the will of the key owner is valid in his favour. This is however only a ‘proof of appearance’. The opposing party can still destroy this appearance by presenting facts which arouse a serious doubt that the signature key owner has given the intended statement.

For example the signatory could refer to the fact, that not he but someone else (e.g., a thief) has performed the signing process unauthorised. The obligations to take precautions have to be noticed by signatories according to Section 6 no. 1 and 2 SigV.

Furthermore he could claim that it is not the actual data he signed being shown to him. He also has to prove this.

Qualified Electronic Signatures based on voluntary Accreditation

Further alleviation of the burden of proof exists in the context of the use of accredited signatures if it is necessary to prove the appearance of the genuineness of a prepared explanation.

It is expected, according to Section 15 par. 1 sentence 4 SigG that suppliers of accredited signatures use only signature keys which cannot be duplicated and the signature key cannot be calculated from the signature or the signature examining key (“security that has been comprehensively tested technically and administratively”).

The identification of the signature key owner is possible for a longer time for users of accredited signatures because they are testable for 30 years after expiry (Section 4 par. 2 SigV). This also applies to the proof that the signature was created with both software and hardware, which the signature key owners can hold under their exclusive control. Furthermore a trustworthy root authority exists in Germany with the RegTP (“Regulierungsbehörde für Telekommunikation und Post”) and the publication of the public key of the supplier in the German “Bundesanzeiger”.

The technical and administrative security of the supplier and the production of valid qualified certificates can end since this had already been proven certainty for the accreditation process.

Legal Provisions on the use of Pseudonyms for Electronic Signatures

I. Legal provisions on (online) Anonymity - Pseudonymity on a European level

Directive 95/46/EC on processing of personal data defines “personal data” as “any information relating to an identified or identifiable natural person (“data subject”)”.

An “identifiable person” is defined as “one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity”.

The Directive is not applicable to anonymised data. Recital 26 of the Directive’s preamble explicitly states that “the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable.” Recital 26 also explains that “to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used by the controller or by any other person to identify the said person”.

At first sight, recital 26 seems to be univocal. On the transposition of the EU Directive into Belgian law, a very radical stand was put forward, taking into account this recital. The radical interpretation of the notion of identifiability in the EU Directive, which was followed in the explanatory memorandum of the Belgian privacy law , has not been adopted in other EU Member States. Most of them took the view that data had no connection with an identifiable person if the controller (= the person responsible for the processing of the personal data) could not retrieve the identity of the person without unreasonable efforts. In such case, those data were not considered as personal data on account of the controller. Consequently, from a legal point of view, the notion of anonymity is generally limited to simply referring to the impossibility of identifying a natural person with reasonable means.

Pseudonymity is a way to be pseudo- or fully anonymous. In the event of pseudo-anonymity, the pseudonym is an identifier that does not reveal one’s identity at first but is indirectly sufficient to associate the transaction or the communication with the particular human being who uses the fictitious name (which makes the Directive on processing of personal data applicable). In case of real or full anonymity, the pseudonym cannot be linked to any form of identity knowledge at all and consequently, this directive is not applicable.

Directive 1999/93/EC recognises the right to use pseudonyms in its article 8 (3): “Without prejudice to the legal effect given to pseudonyms under national law, Member States shall not prevent certification service providers from indicating in the certificate a pseudonym instead of the signatory’s name.” This is confirmed in annex I where it is stated that a qualified certificate must contain, besides other requirements, “the name of the signatory or a pseudonym, which shall be identified as such”.

Directive 2000/31/EC (i.e. the directive on e-commerce) does not intend to prevent the anonymous use of open networks such as the Internet .

Directive 2002/58/EC (i.e. the directive on privacy and electronic communications) acknowledges expressly the right to anonymous communications.

Recital 9 stresses the need for Member States to take particular account of the objectives of minimising the processing of personal data and of using anonymous or pseudonymous data where possible.

Recital 33 states that Member States should encourage the development of electronic communication service options such as alternative payment facilities which allow anonymous or strictly private access to publicly available electronic communications services, for example calling cards and facilities for payment by credit card.

An important provision in this Directive is that the practice of sending electronic mail for purposes of direct marketing disguising or concealing the identity of the sender on whose behalf the communication is made, or without a valid address to which the recipient may send a request that such communication cease, has to be prohibited by the EU Member States” legislation.

The scope of this contribution, within FIDIS deliverable D3.2, is limited to the background of the legal provisions use of pseudonyms for electronic signatures, i.e. the background of the above mentioned article 8 of Directive 1999/93/EC. Consequently, we will not elaborate legal aspects of the general use of “anonymity” and “pseudonymity” in an online context (e.g. contractual and criminal liability of anonymous service providers), nor apply them to specific situations, such as anonymous connections, e-mail, publishing, browsing, payments, voting or auctions.

II. Background of article 8,3° of Directive 1999/93/EC

1. Legitimacy of the use of on-line anonymity / pseudonymity in a European context

In Europe, the use of on-line anonymity has been examined by EU Data Protection Working Party and has led to a recommendation on this issue. The Working Party points out a number of legitimate situations for anonymous online communications (e.g. a victim of a sexual offence seeking help or wanting to share his/her experiences with others, political dissidents subject to a totalitarian regime wishing to express their opposition to the political system, etc.). It concludes that the need for anonymity goes much further than those specific cases and that the very existence of identifiable transactional data creates means through which individual behaviour can be surveyed and monitored to a degree that has never been possible before.

In a working document of 21 November 2000, the Working Party explains that the ability to choose to remain anonymous – and consequently to have anonymous access to the internet – is essential if individuals are to preserve the same protection for their privacy on-line as they currently enjoy off-line. It is striking that, even after the events of 11 September 2001, the EU Data Protection Working Party has reaffirmed the need for using on-line anonymity and pseudonymity in its recent working document on on-line authentication systems. Likewise, the Council of Europe promotes the use of on-line anonymity as a tool for effective protection of the fundamental right to on-line privacy . On 28 May 2003 the Council of Europe adopted a Declaration on Freedom of Communication on the Internet.

Principle 7 of this Declaration relates to anonymity and is formulated as follows: “In order to ensure protection against online surveillance and to enhance the free expression of information and ideas, member states should respect the will of users of the internet not to disclose their identity. This does not prevent member states from taking measures and co-operating in order to trace those responsible for criminal acts, in accordance with national law, the Convention for the protection of Human Rights and Fundamental Freedoms and other international agreements in the fields of justice and the police.”

The use of anonymity can be legitimate as a tool to protect effectively the fundamental right to privacy and the fundamental freedom of expression. In addition, the use of anonymity can be legitimate in specific situations to protect the possibly threatened interests of the user when completing certain legal acts. Finally, anonymity can be used to protect the interests of a party in a contractual environment. On the other hand, there is a broad consensus that absolute anonymity is not appropriate in all circumstances. Restrictions on the use of anonymity could be justified both from a public law perspective (protecting public interests, for instance protection of national security, territorial integrity, public safety, crime prevention, etc.) as from a private law perspective (mainly for accountability reasons ). In order to reconcile the right to anonymity and the necessary limitations on this right, several solutions for “controlled anonymity” are being proposed. One example is “trustee-controlled conditional anonymity” whereby a previously anonymous individual can be identified only with the help of a trusted third party . The anonymity should only be revoked in specific circumstances, and when it is legally authorised. Revocation should technically only be possible with the help of the trustee.

With a view to facing the possibly increased use of on-line anonymity, to avoid misuse of on-line anonymity and to develop its fair use, governments should be urged to refine on-line anonymity in narrowly tailored regulations. Given the variety of context within which anonymity can be used, regulations on the use of anonymity, possibly supported by self-regulation initiatives, should be specified in terms of their scope of application – namely in which situations is on-line anonymity allowed or not allowed – and in terms of types or degrees of anonymity – namely the modalities of conditional or revocable anonymity vs. unconditional or irrevocable anonymity.

Article 8,3° and annex I of Directive 1999/93 can be seen as a (first) attempt of the European legislator to organise legitimate but controlled anonymity, as it provides that “certification service providers cannot be prevented from indicating in the certificate a pseudonym instead of the signatory’s name and that the name or pseudonym should be identified as such.”

2. Origin, meaning and legal consequences of article 8,3° Directive 1999/93/EC

a. Origin of Directive 1999/93/EC

This directive is the result of a long legislative process, which started in the mid-nineties. One of the barriers for a generalised use of digital signatures was the lack of generally recognised standards. At the European level, the challenge was first taken up by ETSI , with a first report on the requirements for trusted third parties (“certification authorities”) in 1997. Meanwhile, draft national legislation on digital signatures was introduced in some EU Member States. On 22 July 1997 the German Bundestag approved the “Signaturgesetz”. The law offered an administrative framework within which people could make use of digital signatures in a secure manner. Around the same period, legislation on digital signatures was also enacted in Italy. As soon as the first drafts of the national laws in Germany and Italy became public and given the fact that other Member States (such as the UK, Belgium, France, the Netherlands, Denmark and Spain) also started legislative initiatives, or at least called for consultation papers on this subject, the European Commission started seriously to worry about the internal market effects of these legislative initiatives.

Consequently, after having published two communications on the subject , the European Commission started to draft a proposal for a directive. The first draft directive was put forward on 13 May 1998, but the first attempt to achieve a political agreement collapsed, because of a disagreement between Member States, which was due to a misunderstanding about the concept of digital signatures, about the difference between legal rules and standards and about the basic principles behind the German “Signaturgesetz” (which served as model for the proposal, jointly with the United Nations UNCITRAL model-law on Electronic Signatures ).

In April 1999 the European Parliament issued its opinion in first reading on the directive proposal. A few weeks later, the Council came to a common position. The recommendation for second reading of the European Parliament was delivered in October 1999. The directive was finally signed on 13 December 1999 and published in the Official Journal of 19 January 2000. Starting from that date, the Member States had 18 months to transpose the Directive into their national law.

b. Origin and significance of article 8,3° of Directive 1999/93/EC

The original directive proposal contained the following provision on the use of pseudonyms in its article 8 and annex 1:

“[…] 3. Member States shall ensure that, at the signatory’s request, the certification service provider indicates in the certificate a pseudonym instead of the signatory’s name.

4. Member States shall ensure that, in the case of persons using pseudonyms, the certification service provider shall transmit the data concerning the identity of those persons to public authorities on request and with the consent of the data subject. Where according to national law the transfer of the data revealing the identity of the data subject is necessary for the investigation of criminal offences relating to the use of electronic signatures under a pseudonym, the transfer shall be recorded and the data subject informed of the transfer of the data relating to him as soon as possible after the investigation has been completed.”.

Annex I: “[…] (b) the unmistakable name of the holder or an unmistakable pseudonym which shall be identified as such.”

Recital 13 of the preamble makes clear what was meant with these provisions, namely to ensure user confidence in electronic communication and e-commerce by:

Obliging certification service providers to respect data protection legislation and individual privacy

Obliging them to provide certification services also for pseudonyms at the request of the signatory

Laying down in national law if and under what conditions the data revealing the identity of the data subject must be transferred for investigation of criminal offences

Confirming that certification service providers should inform users in advance of their conditions, in particular regarding the precise use of their certificates and limitations of their liability, in writing and in readily understandable language and using a durable means of communications

In its opinion in first reading, the European Commission suggested more than 30 amendments on the directive proposal. Two of them are relevant for the discussion here.

With amendment 26, the European Parliament proposed to add an additional sentence stating that “Certification Service Providers are allowed to indicate in a certificate a pseudonym provided that this is permitted by national legislation in non-electronic commercial relations.”

The European Parliament explained that there are no general rules on pseudonyms for off-line transactions because there is no need for such provisions in off-line transactions and that in principle, consumers can choose to remain anonymous. With this amendment, the European Parliament wanted to establish a necessary tool providing for the possibility to do on-line transactions in the same way as off-line. Nevertheless, this amendment has been rejected by the European Commission, because it would cause implementation problems.

With amendment 27, the European Parliament proposed to add and leave out some parts of article 8,4° directive proposal:

“4. Member States shall ensure that, in the case of persons using pseudonyms, the certification service provider shall transmit the data concerning the identity of those persons to public authorities on request and with the consent of the data subject. Where, in line with Directive 95/46/EC according to national law the transfer of the data revealing the identity of the data subject / signatory to public authorities is necessary for the investigation of criminal offences relating to the use of electronic signatures under with a pseudonym certificates or necessary for legal claims related to transactions done by using electronic signatures with pseudonym certificates, the transfer shall be recorded and the data subject informed of the transfer of the data relating to him as soon as possible after the investigation has been completed.” (Left out: strikethrough, added: underlined)

Although the European Commission had accepted this amendment, neither the amended text, nor the original text has become part of the directive. Apparently, the accepted version was part of the compromise reached by the Council in April 1999, as reformulated in the text of 28 June 1999 . The reformulated text totally left out the above mentioned recital 13 and replaced it by recital 25: “Whereas provisions on the use of pseudonyms in certificates should not prevent Member States from requiring identification of persons pursuant to Community or national law.” Furthermore, it also changed article 8,3° and 8,4° by (1) incorporating them into one paragraph and (2) – radically – changing the content of the article: “[…] 3° Without prejudice to the legal effect given to pseudonyms under national law, Member States shall not prevent certification service providers from indicating in the certificate a pseudonym instead of the signatory’s name.” In addition, the correspondent paragraph of annex I (slightly) changed into “(c) the name of the signatory or a pseudonym, which shall be identified as such.”

c. Significance of article 8,3° Directive 1999/93/EC?

A good way to understand what the European legislator has intended with this provision is to ask why the former versions and amendments have not been accepted: From a comparison between amendment 26 of the European Parliament and the final text of the directive, it can be concluded that the European legislator wanted to make sure that Member States would not prevent certification service providers from allowing a pseudonym in the certificate, even if the respective national law of the Member State does not provide an equivalent for “off-line” situations, in order to avoid implementation problems. From a comparison between (a) the texts which have not been adopted (namely: article 8,3° and 8,4° directive proposal; the 4 “action points” in recital 13 directive proposal; and the above mentioned EP amendment 27) and (b) the final version of article 8,3° as it was motivated by the Council, the following conclusions can be drawn. The European legislator wanted:

To make sure that Member States would not prevent certification service providers from indicating pseudonyms in the certificate (recital 13 directive proposal and article 8,3° Directive 1999/93/EC).

To leave the choice to give legal effect to pseudonyms or not to the Member States (article 8,3° Directive 1999/93/EC). This is not surprising, as recital 17 of Directive 1999/93/EC states that the directive does not seek to harmonise national rules concerning contract law, particularly the formation and performance of contracts, or other formalities of a non-contractual nature concerning signatures. The Directive wants to contribute to the use and legal recognition of electronic signatures within the Community (recital 16).

To leave the possibility to indicate a pseudonym in the certificate to the mere situation when the signatory requests it (recital 13 directive proposal and article 8,3° of the directive).

Not to restrict the authorisation of the transmission of information concerning the identity of persons using pseudonyms to the case of a criminal investigation or court proceedings.

Both the original text of article 8,4° as EP amendment number 27 proposed to provide with the possibility to transfer data concerning the identity of the data subject / signatory to public authorities, for the investigation of criminal offences.

It appears from the motivation of the adopted text, as proposed by the Council, that such a restriction might involve the risk of encouraging the illegal use of electronic communications.

This rule has been “formalised” in recital 25 of Directive 1999/93/EC, which states that the provisions on the use of pseudonyms in certificates should not prevent Member States from requiring information of persons pursuant to Community or national law.

To oblige certification service providers to communicate their (general) conditions to the signatory (recital 13 of the directive proposal and article 8,3° directive).

To ensure that a certification service provider could indicate in a qualified certificate limitations on the use of that certificate cq. value of transactions for which the certificate can be used, provided that the limitations are recognisable to third parties.

Consequently, it does not matter in which way these limitations are made clear (e.g. in writing or using a durable means communication), provided that they are recognisable, not only to the users but to third parties in general.

d. Legal consequences: Specific liability rules concerning the certification service provider issuing pseudonymous certificates

Article 8,3° Directive 1999/93/EC does not affect the contractual relationship between certification service providers and the recipient of a certificate nor the relationship between the certification providers and public authorities.

The following aspects regarding the specific liability regime should be considered:

A service provider issuing a (pseudonymous) certificate is liable for the damage resulting from the inaccuracy and incompleteness of information contained in the qualified certificate at the time of the issuance of the certificate. Indeed, one cannot reasonably expect that the certificate service provider would permanently verify the accuracy of the information. This is a responsibility of the recipient of the certificate, who possibly might have to revoke the certificate.

A service provider issuing a (pseudonymous) certificate should also guarantee that the recipient of the certificate holds, at the time of the issuance of the certificate, the signature-creation data corresponding to the signature verification data given in the certificate. If the certification service provider generates both, he should assure that they can be used in a complementary manner.

Finally a service provider issuing a (pseudonymous) certificate should ensure that the date and time of revocation of the certificate are accurately registered.

The certification service provider is liable for damage caused by non-compliance of the above mentioned obligations, unless the certification service provider proves that he has not acted negligently. It could be envisaged that the certificate service provider registered the revocation of a certificate via a register accessible on his website, but that third parties had no access to the website for a reason out of control of the certification service provider.

The certificate service provider can limit his liability on two grounds, namely by indicating in a qualified certificate limitations on 1) the use of that certificate or 2) the value of transactions for which the certificate can be used, provided that the limitations are recognisable to third parties.

Economic Aspects: Diffusion of Electronic Signatures

Firstly, the basic elements of the economic theory on the diffusion of innovations will be presented, and then its applicability to electronic signatures will be discussed.

Economic Theory

Rogers defines diffusion as “the process in which an innovation is communicated through certain channels over time among the members of a social system” and as a “special type of communication, in that the messages are concerned with new ideas” [ROG03]. An innovation is defined as an “idea, practice, or object perceived as new by an individual or other unit of adoption” [ROG03]. Five attributes of innovations, as perceived by the members of the social system, determine its rate of adoption:

Relative advantage: is the degree to which an innovation is perceived as better than the idea it supersedes. It is not so important if the innovation has an objective advantage, but rather if the individual perceives the innovation as advantageous. Advantages can measured in economic terms, but social prestige, convenience, and satisfaction also can play an important role.

Compatibility: is the degree to which an innovation is perceived as being consistent with the existing values, past experiences, and needs of potential adopters. An innovation that is consistent with the existing values will diffuse more rapidly than one that is incompatible with the norms and values of the social system.

Complexity: is the degree to which an innovation is perceived as difficult to understand and use. Innovations that are easier to understand will be adopted more rapidly than those who require the adopter to develop new skills and understandings.

Triability: is the degree to which an innovation may be experimented with on a limited basis. New ideas that can be tried before the potential adopter has to make a significant investment into the innovation are adopted more quickly.

Observability: is the degree to which the results of an innovation are visible to others. The easier it is for individual to observe the results of an innovation, the more likely they are to adopt. [ROG03]

The innovation-decision process

“The innovation-decision process is the process through which an individual passes from gaining initial knowledge of an innovation, to forming an attitude toward the innovation, to making a decision to adopt or reject, to implementation of the new idea, and to confirmation of this decision.” [ROG03]

Figure 3‑3.1: Model of the five stages in the innovation-decision process [ROG03]

A model of the innovation-decision process is illustrated in Figure 3-3.1. In this model the process consists of five stages [ROG03]:

Knowledge: occurs when a potential adopter is exposed to the existence of an innovation and achieves an understanding of its functionality. In this stage, mass communication channels play a larger role than in later stages of the innovation-decision process.

Persuasion: is the stage in which an individual forms a favourable or unfavourable attitude towards the innovation. In this stage the attributes, as perceived by the individual, play a major role. Also, interpersonal channels are relatively more important at this stage than mass media channels.

Decision: is the stage in which an individual takes steps to make a choice to adopt or to reject the innovation.

Implementation: It is one thing for an individual to decide to adopt an innovation, however this takes place when an individual puts an innovation into use. In the implementation stage, when the innovation is put to use, problems might occur on exactly how to use the innovation.

Confirmation: occurs when an individual seeks reinforcement of an innovation-decision. It is possible that the individual changes the decision if confronted with conflicting messages about the innovation.

Adopter categories

Adopters can be classified into five categories based on their rate of innovativeness. Figure 3-3.2 shows the normal frequency distribution and the approximate percentages of the individuals included [ROG03].

Figure 3‑3.2: Adopter categorisation on the basis of innovativeness [ROG03]

Innovators: Innovators play an important role in the diffusion process. They launch a new idea within the social system by importing an idea from outside of the system boundaries. However, innovators might not be respected by other members of the social system. Innovators need the ability to understand and apply complex technical knowledge and must be able to cope with a high degree of uncertainty about an innovation at the time of adoption.

Early adopters: Early adopters are more integrated in the social system than innovators. This adopter category has the biggest influence and degree of opinion leadership within the system. Potential adopters look at early adopters for advice and information about an innovation. Therefore, early adopters help trigger the critical mass when they adopt an innovation.

Early majority: The early majority adopts innovation before the average members of a system. They do not possess a position of opinion leadership in the system, but interact with a lot of members of the social system. They are not the first to adopt an innovation, but follow with a deliberate willingness.

Late majority: The late majority adopts an innovation after the average member of the system. They approach innovations sceptically and cautiously and adoption results because of economic necessity or increasing peer pressure.

Laggards: Laggards are the last members of a system to adopt. They possess almost no opinion leadership.

Interactive innovations and network effects

An interactive innovation is an innovation that is of little use to an adopting individual unless other individuals with whom the adopter wants to communicate also adopt. Thus a critical mass of individuals has to adopt the innovation before it is of use for the average member of the system [ROG03]. The individuals who have adopted an innovation form a network and with each new member the overall value of the network increases [SV98]. This fundamental value proposition is being called network effects, network externalities, and demand side economics of scale [SV98]. Until a critical mass occurs in the diffusion process the rate of adoption is relatively slow [Fi92]. After the critical mass is achieved the rate of adoption accelerates and leads to a take off in the adoption curve [ROG03].

Rate of Adoption of Qualified Electronic Signatures

Having presented the basic elements of the economic theory on the diffusion of innovations, we now take a look at qualified electronic signatures and their attributes related to their rate of adoption. As stated above, the individual perception of the attributes is the important factor and not the “objective” value of the attributes. Therefore, we try to take educated guesses on how the innovation will be perceived by potential adopters.

Relative advantage

In this case there are two ideas being superseded: handwritten signatures and electronic transactions without signatures. Qualified electronic signatures enable users to conduct legally binding contracts with relying parties that are physically at a different location at any time by communicating over the internet. However, the user is forced to make these transactions at his PC using his signature card and card reader. So while the location of the relying party becomes unimportant, the location of the user making the transaction is fixed. Therefore, qualified electronic signatures will be a supplement of handwritten signatures (when conducting transactions over the internet) and not a substitute. The perceived relative advantage will most likely be the freedom of choice with whom to conduct business, the time independence and the possibility to conduct business at home instead of the necessity to show up at a specific location as for example in dealing with public administration.

In superseding electronic transactions without signatures, qualified electronic signatures take the role of a preventive innovation. Preventive innovations are ideas that are adopted by an individual at one point in time in order to lower the probability that some future unwanted event will occur [ROG03]. Preventive innovations usually have a very slow rate of adoption, because the unwanted event might not happen even without the adoption of the innovation. Therefore, the relative advantage is not very clear cut. Furthermore, qualified electronic signatures can only be used if they are accepted by the relying party. Therefore, the relative advantage is dependent on the size of the network of accepting parties, increasing the network effects described above.

	Private Customers	Companies	Public Administration
	Costs	Benefits	Costs	Benefits	Costs	Benefits
Electronic bid invitations			■	■		■
Electronic tax declaration	■		■			■
Access to public archives	■		■	■		■
Electronic elections	■					■
Application for public documents	■					■
Notifying change of residence	■					■
Electronic dunning procedures			■	■		■
Electronic marketplaces	■	■	■	■	■	■
Automated orderings			■	■	■	■
Online-Banking	■		■	■	■	
Alteration of contracts online	■			■		
Electronic billing			■	■		
Archiving			■	■	■	■
Total	8	1	9	9	4	10

Table 3‑3.1: Distribution of costs and benefits of qualified electronic signatures [LR05]

In order to determine the relative advantage perceived by potential adopters, it is important to take a look at the costs and benefits of qualified electronic signatures. Table 3-3.1 provides an overview of the distribution of costs and benefits.

	Issue of a certificate	Basic fee per year	Sum of a 2-year usage
D-Trust GmbH	41 €	29 €	99 €
Deutsche Post Signtrust	0 €	39 €	78 €
TC Trust Centre	8 €	62 €	132 €
T-TeleSec	23,57 €	42,95 €	109,47 €

Table 3‑3.2: Price strategy of the four major German trust centres [LR05]

Clearly the costs and benefits are not evenly distributed. While public administrations are the major gainers they only marginally contribute to the costs of the infrastructure. On the other hand private customers have to carry the majority of the costs, while gaining almost no benefits. Therefore, the relative advantage will probably be perceived as very low by private customers. Table 3-3.2 shows the price strategy of the four major German trust centres.

All of these trust centres are using a fixed price strategy instead of practicing price differentiation for different customer groups. The prices can be regarded as being rather high if you consider that almost no applications for qualified electronic signatures exist. This leads to further reduction of the perceived relative advantage.

Compatibility

Most signature providers use a PIN to authenticate the signatory. The usage of PINs has a high degree of compatibility since PINs are commonly used to authorise financial transactions for example in online banking or at ATMs. However, some individuals may not perceive a contract signed by means of qualified electronic signatures as a legal binding transaction, even if this is the case. Therefore, the potential adopter should be informed about the legal consequences of using qualified electronic signatures.

Complexity

If we expect the average user to be able to understand the principles of public key cryptography we are asking too much [WHI99]. This, however, might not be necessary. By using qualified electronic signatures the perceived security is rather high and a complete understanding of the underlying principles is not required. For example the use of ATMs is quite common, despite the fact that most users do not understand the underlying processes and security measures. Of course it is of utmost importance that the signature application is easy to use and to comprehend and does not allow the user to give away his private key. On the other hand, the usage of a chip card reader will likely be new to most potential adopters and instalment and maintenance could lead to problems.

Triability

With the way qualified electronic signatures are offered today, there is no triability possible. Customers are charged upfront with an initial fee and have to pay for certification services before they can create qualified electronic signatures. Therefore, potential adopters have to invest a considerable amount, before being able to test potential benefits of the innovation. However, it is possible to test electronic signatures in general by using free software like Pretty Good Privacy (PGP) . But in this case different software with different look and feel, as well as a different certification structure would be tested rather than the one ultimately adopted.

Observability

By being able to verify their own signature the adopter can check the validity of his own signature and demonstrate it to other individuals. However, individuals who have not obtained a qualified electronic signature themselves are not able to verify the signature leading to missing observability. Furthermore, by being a preventive innovation the unwanted prevented event, by definition, does not occur, and thus can not be observed or counted.

Qualified Electronic Signatures in the Innovation-Decision Process

So far, based on the market penetration rate of qualified electronic signatures to date [DK03], we assume that only a fraction of the innovators have adopted the innovation. Furthermore, informally, it is believed, that most potential adopters have not even reached the knowledge stage, meaning they are not even aware that this technology exists. For many new ideas, an innovation might create a need for it. This especially occurs for electronic consumer products such as DVDs or mobile phones [ROG03]. So possibly the awareness of qualified electronic signatures could create a need to adopt. However, so far the lack of an awareness policy and missing marketing efforts, as have been undertaken for other preventive innovations like HIV prevention and seat belt usage, has hurt the diffusion process. Even worse, political signals such as allowing non-qualified electronic signatures for e-government applications like for example the sphinx project in Germany are counterproductive especially in the persuasion phase [ROG03b]. Even if potential adopters develop a favourable attitude towards qualified electronic signatures and decide to adopt, it is actually pretty hard to obtain them, because the personal at the registration authorities is often badly informed and not aware that they even offer these products. Also there has been no effort so far to specifically target early adopters, who are the most influential party in the diffusion process. And even for individuals who actually have adopted, the lack of applications for qualified electronic signatures and the resulting negative feedback could eventually lead to discontinuance of the innovation.

Analysis of Current Efforts to Diffuse Qualified Electronic Signatures

To increase the diffusion of qualified electronic signatures, several initiatives in Europe have been launched in the last couple of years. Some examples are described in [FS04] [CW04] [HVA04]. Common to these initiatives is that they focus on achieving a high penetration rate of signature card within the entire population. As has been seen with other preventive innovations, mere presence and availability does not necessarily lead to adoption of the innovation. One example is the German “Geldkarte”. This smart card enables small electronic payments and is included on most German EC-cards. Despite 60 million cards being distributed in Germany, only 38 million transactions have been made in 2005 (0,63 transaction per user per year) . Therefore, a high penetration rate of signature cards does not necessarily lead to the adoption of qualified electronic signatures, especially if costs and benefits are not fairly distributed and prices remain as high as they are. In addition, the network for qualified electronic signatures does not increase with the distribution of signature cards but with the adoption of the signature. So by simply distributing signature cards, critical mass will not automatically be obtained. One example is the Danish signature initiative OCES. This project has been started by the Danish government in March 2003. It enables every citizen to obtain a free certificate. So far only 145.000 Danish citizens (less than 3% of the population) have obtained such a certificate [HVA04]. Therefore, it might be better specifically to target early adopters instead of trying to reach everyone. Also none of these initiatives has been able to provide any sort of triability of qualified electronic signatures. On the other hand electronic signature could be quite successful, when applied locally, when applications exist and when the costs are covered e.g., by an organisation.

Recommendations to structure the signature market

Based on the analysis above, we will now present some recommendations on how to structure the future market of qualified electronic signatures:

Shift costs and benefits in order to achieve a fair distribution: In order to increase the relative advantage of qualified electronic signatures, as perceived by potential adopters, it is necessary to have a fair distribution of costs and benefits. Price differentiation could be used specifically to target different customer groups. Also, a new price model, as proposed in [LR05], is necessary such that the signatory collects fees for signature verification, reducing their annual costs. Furthermore the acceptance of qualified electronic signatures could be increased by providing monetary benefits for its users. For example, fees for public administration processes could be omitted for users that choose to conduct these transactions online using a qualified electronic signature.

Try to reach a critical mass: It might be helpful to try to gain a critical mass of adopters by using “dumping” prices in the early phases of the diffusion process. Later on these early losses can be compensated by profiting on the ensuing lock-in effects [SV98]. An example of such a business model is the distribution of video game consoles. Vendors of video consoles sell their product with prices below their production costs in order to increase the size of their networks and to create lock-in effects. Later on they profit from selling games to their customer base [Sv98]. The same thing could be applied to qualified electronic signatures and the complementary product of signature verification.

Increase the knowledge: A large marketing campaign is essential to increase the awareness of the technology. This campaign could be financed by either the trust centres or public administration. As stated earlier the awareness of the new technology could trigger a need for it. Also, the gained benefits for public administration could finance the efforts to host such a campaign.

Specifically target early adopters: Early adopters are the most influential group of potential adopters. Therefore it is of utmost importance to place the product within this group in order to reach a critical mass.

Reduce complexity: In order to reduce complexity, mobile qualified electronic signatures might be very helpful. Also, for conventional signatures every effort to make the signature application as easy to use as possible, like for example including chip card reader in PCs, should be undertaken.

Increase triability: By, for example, issuing free 14 day certificates, certification service providers could enable potential customers to experience the product on a limited basis.

Case Study: Mobile Signatures

Mobile signatures are electronic signatures that are created using a mobile device and rely on signature or certification services in a location independent telecommunication environment. They allow signatory mobility beyond fixed, secure desktop workstation with trusted, personal signing equipment [FRR03]. Although using mobile devices for signature creation has several shortcomings (e.g. display size, communication costs, limited computing power), the high market penetration of cell phones and the mobility gained make this effort potentially successful and promising.

Two possible signing approaches in the mobile environment have been proposed in the past: signatures created in centralised signing server environments located at service providers such as mobile network carriers; and electronic signatures created inside the signer’s mobile device using a smart card.

Server Based Electronic Signatures

Server based electronic signatures are signatures created by a service provider for a specific customer. Figure 3-3.3 illustrates such a server infrastructure. With server based signatures it is important to distinguish between signatures that have a corresponding certificate issued under the name of the customer and signatures with certificates issued under the name of the service provider or an employee of this provider.

In the first case it is necessary that the customer transfer his private key to the service provider. However, according to the related EU directive, to achieve the status of an advanced signature the signature has to be created by means that the signatory can maintain under his sole control. By giving away his private key this premise cannot be fulfilled [FRR03]. In the case of signatures whose certificates are issued under the name of the service provider it cannot be assumed that these signatures are the legal signatures of the customer.

They are signatures of the signature service provider and only enable an identification of the provider. Those signatures can achieve the status of advanced signatures with qualified certificates as long as they fulfil the requirements of Annex I and are provided by certification service provider who fulfils the requirements of Annex II. Therefore, the signature service provider acts as a replacement for the customer. However, based solely on the signature of the provider it cannot be verified that the customer really authorised the signature. Neither the integrity nor the fact that the user authorised it can be proven. There are possible technical solutions to accomplish the integrity and accountability of his authorisation but they require a security environment on mobile devices that would enable the device itself to create qualified signatures [RAN03].

Figure 3‑3.3: Sever based electronic signature infrastructure

Client Based Electronic Signatures

Signatures can be created inside the mobile device using a secure signature creation device which has to fulfil the requirements of Annex III. Using a multiple smart card solution, the signature smart card, certified by a certification provider, is inserted into the mobile device which already contains the usual SIM-card. Therefore, the signature process takes place on the mobile device and the user is essentially able to use any signature card available on the market. This can be achieved by either exchanging the SIM-card with the signature card (Dual Chip) or by having an additional chip card reader within the mobile device (Dual Slot). The first solution is very inconvenient for the signatory, since he has to switch off the phone to exchange the cards for the signature creation and again to use the phone functionality. In the latter case, a specialised mobile phone is required that has multiple smart card slots which almost none of the current mobile phones do.

It would also be possible to use a single smart card that contains the SIM telephone functions, as well as the secure signature creation device. This can be achieved either by leaving some free space on the SIM-card, on which the components of the signature creation device can be installed later on, or by shipping SIM-cards with pre-installed signature functionality that has to be initialised and activated.

One proposal is the usage of evaluated smart cards suitable for qualified electronic signatures which are extended by the SIM functionality and usable through a unified interface, e.g. with the USIM specification TS 21.111 . Another approach might be the migration and evaluation of USIM with a full WAP /WIM implementation for the purpose of lawful mobile signing . Evaluation must be carried out with ITSEC or Common Criteria within an evaluation process similar to the evaluation summarised in [FUC00].

Using a single smart card for both functionalities provides the most convenient solution for the signatory. He can sign documents and distribute them via communication services of his cell phone like GPRS or UMTS . To ensure that the requirements of directive are met, it is necessary to provide some sort of reliable access control to the signature functions. The usual PIN used to control the access to the telephone functions is not sufficient, since users can keep their phones and SIMs unlocked for convenience. Like traditional signature cards, SIM-cards can be certified according to security evaluation criteria and are under control of the user.

However, using a single smart card for multiple purposes raises new questions and challenges. The SIM-card is issued by the telecommunication provider, while the SSCD is issued by a certification service provider. Combining both functions in one card raises the question of who will have control over the keys and certificates.

The simple solution is that the deploying service provider also initialises the signature secrets to act as a trust provider for their customers. At first glance this seems reasonable, since some of the European carriers already own and maintain trust centres (i.e. Deutsche Telekom), but there are several shortcomings, which make this approach impractical. First of all the customer wants to leave the store with his SIM-card right away, so he can use his mobile phone instead of waiting several weeks for the certification process to be completed. Furthermore, binding the keys to a carrier creates a great hindrance for the customer if in the future he chooses to switch to a cheaper carrier. From the carrier’s point of view this would of course be advantageous. From the customer’s perspective, however, it would be much better to be able to choose freely between different certification service providers. Also, owing to the lack of success of the signature market so far [LiRo05] most providers will probably be reluctant to invest in building and maintaining their own trust centre to provide certification services. Simply, they do not want to change their distribution channels unless they expect an increase in revenue. Therefore, a different solution for mobile signing and certification is needed, that allows separation of subscriber information and certification services [ROS04].

Certification on Demand

The mobile operator could sell SIM-cards equipped with a key generator for one or more key pair(s) that can be used for the signing functionality. After obtaining the SIM-card from the mobile operator, the customer can then generate the keys and activate the signature component and the public key(s) can be certified by any Certification Service Provider on demand.

Through the separation of the telephone functionality and the (possibly later) certification of the user’s identity by a certification service provider, both functions can be sold separately and can be obtained from different providers. The carrier will probably face increased costs for the signature capable SIM-card but can also expect increasing traffic caused by signature services. All distribution channels will remain unchanged. Figure 3-3.4 illustrates the necessary steps for the distribution of the SIM-card and the certification process.

Figure 3‑3.4: Certification on Demand Protocol

The carrier gives his IMSI /Ki pairs to a card manufacturer.

The card manufacturer returns a SIM card containing an IMSI/Ki pair, a key generator for the signature application and the public key of the RootCA to the carrier.

The SIM card is sold to the customer and the carrier provides a null pin that is used to generate the keys and activate the signing functionality.

The customer generates the keys and activates the signing functionality by entering the null pin.

The customer registers at a Registration Authority of his choice, providing identification information and his public key.

The customer sends his identification information signed with his private key over the air to the Certification Authority.

The Registration Authority sends the public key and the identification information to the Certification Authority.

If the information provided by the customer and the Registration Authority match, the Certification Authority issues a certificate for the customer and sends it over the air to his mobile phone.

The user can verify the validity of his certificate by checking the certificate issued by the RootCA of the Certification Service Provider (CSP).

This protocol makes no changes to the existing distribution infrastructure of mobile operators. The steps 1 to 3 remain the same way they used to be, apart from the fact that the card manufactures puts additional information and functionality (signature key generator, public key of RootCA) on the SIM card. In order to ensure that the card manufacturer does not know the private key of the user the key generation should be done by the card. The customer is not forced to certify his keys and can use the SIM for telephone functionality only. He could also activate the signing functionality without going through the certification process, for example as a security token. If he wants to be able to make legal binding electronic signatures, he has to go through the complete process to obtain a qualified certificate. He can do this by freely choosing the CSP.

The null pin to generate the keys and activate the signing functionality in step 4 is used to ensure that no signatures can be created before the customer has control over the SIM card. If the signature application has been activated before, the user will recognise this when entering the null pin. Step 6 could be omitted but serves as insurance for the customer to ensure that the integrity of his identification information will be preserved. If the customer wants to change his CSP, he only has to repeat steps 5 to 9 with his new CSP. If the customer wants to change his carrier, he has to go through the whole protocol again, but can register with his current Certification Service Provider [ROS04].

Special Aspects of Mobile Signatures

Mobile signatures are made with mobile devices and therefore constraints have to be addressed that are not present in traditional signing infrastructures.

Implementation and security of mobile electronic signatures

A mobile signature creation system is composed of two elements: The signature creation application itself on the mobile device and the cryptographic module on the UICC/SIM card. A generic architecture of mobile signature system is shown on Figure 3-3.5. The cryptographic engine performs the real signature calculation after a successful user authentication.

Figure 3‑3.5: Mobile signature system architecture

In case of using a UICC/SIM card as secure signature creation device, the security of the mobile device components should be guaranteed as well. Communication paths between application modules are especially vulnerable. Some possible attacks on the signature application are presented in Figure 3-3.6.

The mobile signature application fulfils the following functions:

input and formatting of data to be signed

user identification and authentication

hash value calculation

signature attribute visualisation (optional)

cryptographic engine interface

Trusted dialogs (“What You See Is What You Sign”) and ensuring the integrity of temporal data are the most essential problems of the signature application security. Mobile device execution environments when selected as implementation platform for signature application should provide the following features:

user identification mechanism

memory separation between processes

software and data integrity proof

trusted user interface: exclusive use of display and keyboard

Figure 3‑3.6: Security-critical operation in the signature application flow

The majority of today’s mobile devices do not conform to these requirements. Mobile operation systems sharing the mobile market provide minimum security only. Some new solutions, for example, from the Linux community or new platform security additions in Symbian OS v9.1 advance mobile devices in the direction to be personal trustworthy devices.

Data Transfer

First of all, any traffic that is necessary will be charged to the customer. Therefore, it is essential to create as little data traffic as possible in order that the customer accepts the additional costs. In the case of the signature creation, traffic is only necessary for the download of the document to be signed, if at all. In the process of signature verification, several documents, especially the keys of all CAs involved have to be downloaded in order to ensure the integrity of the verification process.

Revocation lists are a particular concern that have to be dealt with. In order to be up to date with the latest revocation lists the customer has to be “online” to get access to the current status of all the signatures and certificates involved. This could lead to lots of data being transferred and much additional cost. Standards such as ISIS-MailTrusT can be useful as well as concepts of server-centric support in document verification [FRI02].

It would also be possible for the CSP to sponsor the additional data traffic in order to get customers to accept and use mobile signatures.

Storage

Mobile devices usually have a limited amount of storage space. This is even more critical if one has to store the data on the SIM-card itself. Therefore, the mobile signature application should, whenever possible, try to store the necessary information on a server of the service provider. This of course is in contrast to the goal of minimising the necessary traffic for signature applications. Therefore, a trade-off has to be struck between cached information and information to be transferred. This is particularly important for the storage of root certificates, certification chains and certificate revocation lists for offline verification. This problem might be solved by increasing storage space on mobile devices and by the ability of modern devices to use external storage such as SDCards.

Possible Applications for Mobile Signatures

Enabling Security Infrastructures

There is a need for corporations to provide their mobile workforce with secure access to the corporate ‘back end’. To date, security tokens have been used to allow this functionality. These tokens are expensive and stored on extra hardware that needs to be carried around and can easily be lost. Putting these credentials on a SIM, that will be placed in the mobile phone, reduces the risk of losing the credential as well as lowering the costs. But some corporations greatly object to leaving their private keys and certificates in the hands of their mobile operator.

With Certification on Demand (COD) the corporation’s IT security department can obtain COD-enabled SIMs from the corporation’s cellular contractor and initialise them for the corporate mobile security infrastructure. The WiTness project sponsored by the European Union implemented such an infrastructure. Figure 3-3.7 shows an application scenario where a “pervasive salesman” has secure, corporate-controlled access to all data available to him in the corporate information system. Access is controlled by a security module based on a SIM with additional security functionality [ROS05].

Figure 3‑3.7: WiTness Pervasive Salesman Scenario

Multilateral secure financial transactions

Storing bank credentials on a SIM may help the migration from plastic to mobile phones. A COD infrastructure allows financial institutions to certify and enable mobile subscribers to use banking services online through their mobile terminal and SIM. Credentials could be certified by the bank itself, like the credentials used on bank cards. Therefore, the bank can still have the control over the credentials while the mobile operator still can issue the SIM cards without giving their IMSI/Ki pairs away to the bank. This would enable the bank, on the basis of the credentials stored in the SIM, to offer services such as transactions, brokerage or checking the account balance. This functionality can and has been realised without the Certification on Demand protocol - but only if the banks and carriers are willing to cooperate. In the Czech Republic T-Mobile [T-Mo05] and the Czech banks agreed to send their critical information to Giesecke & Devrient, a card manufacturer who started producing banking enabled SIMs [G&D05]. However, the COD protocol would enable banks to use SIMs as credentials without having a contract with the mobile operator. In [MUN05] it has been shown that usage of such an infrastructure could be beneficial for mobile brokerage customers, empowering them to react more quickly and more securely to incoming ad hoc messages.

Enabling mobile electronic consent and identity management

Many mobility applications rely on the user’s consent in reducing his privacy in return for a particular service. Examples are location based services on cellular networks, situation based marketing scenarios and tracking technology following users to support them with information they need in-time and in-place. A secure provable electronic consent of users can be achieved using electronic signatures on SIM-created credentials that may contain information about time, intent and recipient of the electronic consent. Research has found SIMs to be on the edge of a global identity management infrastructure [RAN04]. In the near future, personal or role attributes customised for particular application areas (e.g. online dating, identity management) could be managed on SIMs on demand from their owners [ROS05].

Summary and Conclusions

This chapter on public-key infrastructure (PKI) and electronic signatures has covered a basic explanation of the technical infrastructure and the functional principals of cryptographic algorithms used for electronic signing. Basic standards, definitions and terms including those introduced by the European Directive 1999/93/EC have been described in light of their importance in the on-going development of PKIs.

In chapter 3.2 cryptographic signature schemes for various areas of application have been described. In this chapter solutions to meet security requirements and the implementation of additional functionality such as non-deniability (undeniable signature scheme), forgery proof (fail-stop signature scheme) or included encryption (signcryption scheme) are explained.

Security and privacy aspects of PKI and electronic signatures are discussed in chapter 3.3. Security problems arise mainly from the use of general purpose machines for signing (secrecy of the private key may be compromised), the concept of trust in hierarchical systems (who trusts whom for what?) and interoperability and compatibility aspects (such as certificate revocation, adoption of the X.509v3 standard for the internet and name schemes in cyberspace). In addition the limited validity of key pairs raises a number of problems with e.g. the resigning of longer valid contracts or digital archives. The solution to those problems requires some technical effort and raises the costs of the infrastructure required for electronic signatures.

From the privacy perspective the linkability of a certificate with the holder making her or him highly traceable when signing documents or transactions is the main problem of current PKI implementations. The concept of pseudonymous certificates was not very well adopted by the EU member states. Alternatively today’s pseudonymous signature digital credentials have been suggested as an improvement of pseudonymity for certificates used within PKI.

Chapter 3.4 introduces the types of electronic signatures defined in the Directive 1999/93/EC. The legal requirements, legal effects and the probative values for these signatures have been described. Legal provisions on a European level on the use of pseudonyms for electronic signatures have also been discussed. The intent of the European legislator towards pseudonymous electronic signatures is concluded. Essentially, the European legislator wanted to ensure, that the member states would not prevent certification service providers from indicating pseudonyms in certificates while at the same time leaving them the choice to give legal effect to pseudonymous signatures. Certificate providers should be obliged to communicate their conditions to the signatory; they could indicate limitations in a qualified certificate which have to be recognisable to third parties.

The requirements of a service provider which offers pseudonymous certificates have also been concluded. Notably, they are liable for the damage resulting from any inaccuracy and incompleteness of the information contained in the certificates.

Using the established economic model of diffusion of technologies into a market, the following chapter 3.5 compares currently available electronic signatures with five key factors of success in the market defined for technological products and solutions. While a good performance towards compatibility and complexity with today’s PKI is observed, the relative advantage against investigated substituting solutions, triability and observability need substantial improvements, at least in some European member states. This matches with the observed diffusion of electronic signatures in the investigated European markets. From the economic perspective, the diffusion of PKI in the European market has been notably less successful than expected. This chapter suggests six concrete measures to improve the diffusion into the market:

To shift costs in order to achieve a fair distribution

Measures to reach the critical mass of users

Increasing awareness and knowledge about this technology

To especially target the user group called ‘early adopters’

To increase triability e.g. by trial versions of electronic signatures

To further reduce complexity of the private infrastructure required

Chapter 3.6 presents a case study on mobile signatures using the high market penetration of mobile phones. Two approaches are presented: (1) a server based approach that is independent from the client and (2) a client based approach using an improved SIM-card. Technical aspects, basic designs and typical processes needed for mobile signing are presented and discussed. This chapter concludes with a number of possible applications including multilateral secure financial transactions and integration in a user controlled digital identity management system .

Biometrics

Introduction

There are three different concepts to establish a link between a physical person and its digital identity (Figure 4-4.1): Something the person knows such as a secret phrase, password or PIN-code, something the person carries with her such as a token, like a passport and something that the person is i.e. a biometric feature.

Figure 4‑4.1: There are three different concepts (called factors) used to establish a link between a physical person and their digital identity

These three concepts are used alone or in combination to qualify the strength of user identity verification: from 1-factor systems to 3-factors systems, which are considered as most secure, but are also most expensive and complex to deploy and operate. Below are some examples of user identity verification systems with increasing strength:

1 factor:	Password

An object (half of a dollar bill, as seen in movies)

A passport

A fingerprint reader

2 factors:	Credit card + password: ATM bank machines

Scratch list + password: most online e-banking sites

An object + password: spy movies

3 factors:	A biometric system + token + password

Notably, 3 factors systems all incorporate biometrics to provide the “something you are” factor. Biometric recognition, or more simply biometrics, refers to the automatic recognition of individuals based on their physiological and/or behavioural characteristics. Examples of such characteristics will be examined in detail in section 4.2. Essentially, biometrics allows a system to establish or confirm an individual’s identity based on who s/he is, rather than what s/he remembers, such as a PIN code, or what s/he possesses, for example a passport. As such, biometrics offers advantages over traditional authentication systems which cannot discriminate between an impostor who fraudulently obtains the access identifier, for example a password or swipe card, and a bona fide user.

Biometrics represents a special factor in the authentication process. Unlike a secret, a biometric feature is tightly bound to a physical person. Traditional methods to restrict access to secure systems have been passwords and ID cards, however they can easily be guessed and stolen respectively, and thus have proven to be unreliable. Biometrics on the other hand cannot be stolen, borrowed, or forgotten, whereas forging one is usually complex. Typically to forge a biometric credential at least some contact with the legitimate owner of the credential and a physical presence of the impostor is necessary. On the other side a person cannot deny easily that she carries a certain biometric characteristic. This opens the unique possibility to authenticate an uncooperative person or even to prove to an impostor his true identity (negative authentication).

All biometric systems consist of an enrolment phase and a production phase during which the biometric data are actually used. During the enrolment phase, one or more biometric samples are taken from an individual, e.g., image(s) of a fingerprint, of the face or a voice sample. From these samples, biometric data are extracted, a biometric template is created from the data and the biometric template (a so-called reference template) is stored for later use . In the ‘production’ phase, the individual submits his/her biometric characteristics to the biometric system, and the system compares the biometric characteristics of the applicant with the earlier submitted sample or reference template. If the match succeeds, the system will ‘accept’ the individual. If not, the individual will be rejected. One should take into account that the current biometric technologies calculate the match with only a degree of certainty, since the presented biometric characteristics will almost always vary from the image or the template of the enrolment, i.e., the match will never be 100%. The functionalities of biometrics are verification and identification. Verification is a one-to-one process (1:1) of comparing a submitted biometric sample against the biometric reference template of a single enrolee. The reference template could be stored on an individual storage medium, such as a smart card, or in a database, or both. Identification is a one-to-many comparison process (1:N), recognising an individual by distinguishing him/her from other persons whose biometric data are also stored. For an identification system, it is not possible to store the reference templates solely on an individual storage medium. Authentication is also a one-to-one process (1:1) whereby the submitted characteristics are compared to a specific biometric template which could contain the identity information of the individual, in order to authenticate the identity claim. As well as the business and privacy aspects, the technicalities of the biometric methods will be described in more detail below.

Biometric Methodologies

Though the field of biometrics is still in its infancy, it is believed that it will play a critical role in future applications, with special focus on security. Biometrics can offer a number of advantages to various applications, such as electronic commerce, entertainment, access to restricted resources, financial transactions, fight against terrorism, law enforcement, network security, surveillance in airports. These technologies can either replace existing ways of identification and authentication or play a complementary role to the traditional ways, such as PINs, smart cards and passwords.

Several types of biometric identification schemes exist, including:

Face: analyses facial human characteristics

Voice: analyses the tone, pitch, cadence and frequency of a person’s voice

Fingerprint: analyses an individual’s unique fingerprints

Hand geometry: analyses the shape of the hand and the length of the fingers

Iris: analyses the coloured ring surrounding the pupil of the eye

Retina: analyses the capillary vessels at the back of the eye

Vein: analyses the patterns of veins, traces and shapes in the back of the hand and the wrist using infra-red light

Signature: analysis of the way in which a person signs their name

Keystroke dynamics: analysis of the way a person types

The increasing use of biometric technologies however raises questions about their impact on privacy in the public sector, in the workplace, and at home. Privacy mainly refers to every individual’s right to choose and control the use and disclosure of their identity, including their biometrics.

Technological Aspects of Biometric Recognition

The term biometrics derives from the Greek words ‘bios’, which means life, and ‘metrikos’, which means measure. Hence technologies involving biometrics aim primarily at identifying a person’s particular unique features, either physiological or behavioural.

Biometrics can be distinguished into two major categories; physiological (or passive) and behavioural (or active) biometrics. Physiological biometrics refer to human characteristics which are fixed or stable such as fingerprints, hand geometry, iris pattern and, within biometrics technology, facial image and voice patterns. Behavioural biometrics measure characteristics represented by skills or functions performed by an individual at a specific time for a specific reason, for example a signature or keystroke dynamics. Biometric technologies can also be categorised as static, dynamic, or continual. “Static” refers to measurement of a trait that requires no action at the time of verification. “Dynamic” refers to measurement of a trait while an action is taking place. A written signature, for example, can be measured statically or dynamically, i.e. by examining only the written signature after it has been written or by observing the actual process of signing.

A biometric system is used either to identify or verify a person. Identification is the process of comparing a biometric data sample against all those enrolled in the database with their respective biometric data (reference template) in order to find the identity of the person trying to access the system. Verification however involves the process of comparing a biometric data sample against a single reference template of a particular enrolled individual in order to confirm the identity of that person. When a biometric system correctly identifies a person, then the result of the identification process is a true positive, whereas if the system correctly rejects a person as not matching the person, the result is a true negative.

A series of measures have been set as an attempt to define biometric system performance although these are yet to be enshrined in any International Standard. Biometric systems’ performance is usually estimated by the values of the False Acceptance Rate (FAR) and the False Rejection Rate (FRR). FAR refers to the incorrect identification or verification of an unauthorised individual which is considered to be the most serious security error of a biometric system. FRR refers to failure of the system to identify or verify an authorised individual.

Consequently, the FAR measures the likelihood that a biometric system will produce false acceptance, while the FRR measures the likelihood that a biometric system will produce false rejection, both divided by the number of identification attempts. Obviously, both parameters should be low if the system is to offer adequate security levels and avoid user frustration from repeated or irregular rejection respectively. It should be noted however that although the compilation of comparative evaluations to provide some relative indication are possible, little may be known concerning the conditions under which each set of FAR/FRRs was derived, and thus true comparison is proven to be a rather difficult task. Present day biometric sensors claim FARs as low as 0.0001% but practical experience shows levels at a much higher level. There is usually a trade-off between these two values since the FAR and FRR are generally mutually exclusive, i.e. if the FAR is raised then the FRR is lowered and vice-versa.

Two other measures used in biometrics systems are the Failure to Enrol Rate (FTR), which refers to the ability of the system to enrol a biometric for a user, and the Equal Error Rate (EER), which refers to the cross over point when FRR=FAR.

There are two basic concerns regarding these technologies: the error tolerance and the storage of the templates. The setting of the error tolerance of these systems is critical to their performance. Ideally, False Rejection and False Acceptance errors should be low and the manufacturers should quote them both. FAR and FRR are two measurements which can produce widely varying results dependent on the environmental issues, such as physical location, type of user, and security level setting.

Another factor that may affect the FTR is if, for example, biometric data for Keyboard Dynamics is collated from users that use a keyboard in their current login process and is tested with random users, you could reveal two results. A FTR of 0 would result if 100% of the users type on a keyboard in their day-to­day work compared with a random sample of people off the street who may or may not have ever used a keyboard. It is possible that 2 out of a hundred people may fit this profile and therefore produce a FTR of 2%.

Single biometric indicators have to contend with noisy sensor data, restricted degrees of freedom, non-universality of the biometric trait and in some cases unacceptable error rates. Certainly fingerprinting, iris scans, and face recognition are cutting-edge identification technologies, although none alone is infallible, see section 4.3. Multi-biometric systems however can alleviate these drawbacks, combat spoofing, and increase performance by providing multiple evidences of the same identity.

Two general uses of biometrics can be determined [AMB03]:

Identification

Verification of Identity

In both cases reference data are needed to perform the recognition. While in the case of identification the person from which the biometric data is taken is not known and therefore the whole reference database has to be checked (1:n), in the case of verification the biometric data is checked against one reference data set (1:1). Verification is mainly used for access control.

Biometric methods can be divided into two general classes [AMB03]:

Physiological (or passive) methods

Behavioural (or active) methods

The following chapter gives an overview on current biometric methods without trying to be totally comprehensive. Methods which are experimental, not ready for market or which show severe restriction in their use as a primarily method for identification are not introduced. Among those methods are:

Physiological methods

Retina scan

Vein pattern

Ear prints

Etc.

Behavioural methods

Behaviour of sitting

Voice recognition

Movement of the lips

Gait (the way one walks)

Etc.

Physiological (or Passive) Methods

Fingerprint recognition

Fingerprinting has been used since 1901 to identify criminals in Great Britain and subsequently substituted the former Bertillon system which used certain skeletal patterns to identify a person. A year later fingerprinting was applied to analyse crime scenes by detecting fingerprints on objects touched by persons at the scene. About 1910 the first classification system developed by Edward Henry and was subsequently used by police forces and prison authorities throughout the English-speaking world. Since the mid 1980s automated fingerprint identification systems (AFIS) were tested and introduced in the USA and Australia . Following this development, fingerprinting was used more and more as an authentication method for accessing systems (access control, general use, i.e. verification). Today, fingerprint recognition systems are readily available e.g. for the PC where the sensor can be integrated into a mouse or keyboard.

Description of the method

The fingerprint is not genetically defined, but develops randomly in the 3rd month of pregnancy on the tips of the fingers of the foetus [GEO01]. Fingerprinting uses these varying papillary structures on the tips of human fingers. Depending on the system used, seven to nine [AMB03] typical patterns can be differentiated. In addition to major fingerprint features shown in Figure 4-4.2 minor features such as the position of ridge ends and ridge bifurcations are used.

Figure 4‑4.2: Seven common papillary patterns used by the FBI

For identification or verification of large numbers of persons, today automated fingerprint identification systems (AFIS) are used. These systems commonly use six steps for the analysis of fingerprints [BSI04] , see Figure 4-4.3:

Figure 4‑4.3: Steps of analysis of fingerprints by AFIS

Step 1: Scan of the finger tips

To take a picture of the fingerprint different types of sensors can be used:

Optical sensors (also used for latent fingerprints on a crime scene)

Electromagnetic field sensors

Polymeric thin film transistor sensors

Thermal sensors

Capacitive sensors

Pressure sensors

Ultrasonic sensors

These sensors are used online and the picture of the finger tip is directly taken from the sensor. The traditional offline method of scanning a picture of a fingerprint is now used only in rare cases.

Step 2: Optical image optimisation

In this step the orientation of the picture and the optical quality (contrast etc.) is checked and if necessary adjusted automatically. If the result of this step is insufficient for further processing, a new scan is taken.

Step 3: Preparation for classification and extraction of pattern

In this step the papillary lines are extracted from the picture.

Step 4: Classification of pattern

This step is relevant for AFIS which is used particularly for crime investigation and forensic purposes. The fingerprint is assigned to one of three defined classes of fingerprints.

Step 5: Extraction of identified pattern

In this step the individual pattern such as ridge ends and ridge bifurcations and their position on the finger tip are identified using different algorithms.

Step 6: Verification / Identification

In this step the result of step 5 is checked against one (access control) or more (AFIS) stored templates. Determination of a class in step 4 can speed up the identification process because only templates belonging to the same class have to be checked against the sample.

Value of the method

Depending on the sensors and algorithms used the equal error rate can be lower than 1%. In these cases the method can be more reliable than traditional photos e.g. in passports [BSI04]. This method performs very well compared with the seven criteria (seven pillars ) used in [LIB05].

Limitations

A major problem for verification purposes is spoofing of the sensors e.g. with faked fingerprints (see FIDIS deliverable 5.1). To prevent that, testing performed by advanced sensors can be used to detect if the sample is from a living subject [LIB05].

Further limitations result from temporal or permanent changes of the fingerprints, leading to high failure to enrol (FER) rates. These changes may result from certain dermal diseases, injuries or hard labour (such as dirt, abrasion). Using good sensors and recognition software the FER can be less than 5% of the total population. If you look at people working in an office this rate reduces to less than 1% .

Privacy aspects

Certain papillary patterns depend on the nutrition of the mother (and thus the foetus) in the 3rd month of the pregnancy [GEO01]. Various correlations between certain papillary patterns and corresponding diseases have been discussed over the years. Examples are leukaemia and breast cancer which seem to be statistically correlated with certain papillary pattern. A direct correlation in these cases is not known. Another example was published in 1986 where a correlation between certain papillary pattern and two forms of dementia was discovered . Since the 1950s various correlations between certain papillary pattern and human psychological characteristics and even homosexuality have been discussed.

Genetic fingerprinting

Genetic fingerprinting, also called DNA profiling, was discovered and named in 1985 by Alec Jeffreys . It is a method to analyse and compare the DNA from various sources based on the observation that the DNA is unique for every person except for monozygotic (identical) twins. Today this method is applied for e.g., the genome of human beings, animals, bacteria, and plants. In the context of human beings, the method is mainly used to analyse the parentage (paternity tests) and for forensic purpose (e.g. investigation of crime scenes, accidents with many victims or genocide) to identify individuals and suspects from hair, blood, semen and other biological material [JOB04].

Applicable Parts of the DNA

Four genetic fingerprinting mitochondrial DNA molecules and the DNA molecules stored in chromosomes in the nucleus of the cells are used. Each DNA molecule contains four chemical units (called bases):

Adenine (A)

Guanine (G)

Cytosine (C)

Thymine (T)

The bases are lined on a frame structure built of sugar molecules and phosphate groups. Position and sequence of the bases on this frame structure encode the genetic information. The DNA molecules are twisted into a double helix of two complementary strands (see Figure 4-4.4). In this structure each base pairs up with one other base: A with T and G with C. Genetic information is encoded in the sequences of the bases .

Figure 4‑4.4: Structure of DNA	Figure 4‑4.5: Example of different STR alleles on one locus

About 95% of the DNA of human beings do not appear to be coded (so called junk DNA) [AMB03], although new evidence has suggested that this hypothesis is not true . However, for genetic fingerprinting, the non-coded parts (parts carrying no genetic information) of the DNA are used. Notably, so called tandem repeats, which consist of repeats of the same sequence of bases, vary in the number of repetitions to a large extent among different people except for identical twins . Due to that variability they are of special interest when trying to discriminate individuals. The position of the repeats on the genome is called locus.

Currently, two types of tandem repeats are mainly being used for genetic fingerprinting:

Tandem repeats, also called variable number of tandem repeats (VNTR) varying from core units of 2 to 103 bases and 9 to 100 repeats; there are thousands of loci known on each human chromosome,

Short tandem repeats (STR), varying from 1 to 30 repeats (so called alleles, see Figure 4-4.5). From 105 known loci of short tandem repeats (STR) about 20 currently are being used for genetic fingerprinting. STR are widely spread over the genome and some of them are neighboured to coded parts of the DNA [BEN01].

Analytical Procedures

Currently, two methods for genetic fingerprinting are generally being used:

The classical restriction fragment length polymorphism analysis (RFLP analysis), also called single locus probe (SLP) [JOB04], introduced by Jeffreys in 1985, using VNTR. A modern variant of this method is amplified fragment length polymorphism (AmpFLP or AFLP) [BYR01]. This method is largely replaced by variable number of short tandem repeats (VNSTR).

The newer method variable number of short tandem repeats (VNSTR or STRs), used since 1992 [BEN01].

The usual steps for both methods are as shown in Figure 4-4.6 and the result of the procedures is shown in Figure 4-4.7 (for technical details please refer to the Annex):

Figure 4‑4.6: Analytical steps for Genetic Fingerprinting

Figure 4‑4.7: Printout of a gel electrophoresis performed on three samples (1 to 3) and 4 loci (A to D)

Additional methods

Among others commonly two subtypes of the VNSTR analysis are used [BEN01]:

VNSTR analysis on the Y chromosome (Y chromosome STRs; e.g. locus 26-STR )

VNSTR analysis on mitochondrial DNA (mtDNA analysis, e.g. loci HVR1 and HVR2 )

While the Y chromosome is passed through from father to son, the mtDNA is passed from the mother to all children and therefore can be used to establish maternal genealogical lineages. Furthermore mtDNA is quite stable and can particularly be used to analyse old or even fossil samples of DNA.

In addition to the described methods, in forensic DNA analysis single nucleotide polymorphism (SNP) is increasingly being used [JOB04]. This method uses exchanged base pairs in the coded parts of the DNA. It is especially valuable when degraded DNA is being analysed. For identification purposes alone this method is of limited use because of the number of loci (around 50) that have to be analysed to get reliable results. Today this method is seen as an addition to VNSTR, not as a replacement.

Value of the Method

The commonly used methods of genetic fingerprinting described are very reliable for the comparison of DNA samples and thus to identify persons and to clarify parentage. The reliability depends, among other aspects, on the number of analysed loci, the alleles found and the reference population used to determine the likeliness. 0.0000000004% of false positives (meaning that one out of 25 billion people have the same genetic fingerprint) are not unusual under good analytical circumstances. In many cases the reliability can be higher; results such as 1 out of 100 billion people are being discussed . But with respect to the number of parameters and their variable influence on the reliability (e.g. a found allele is, compared to the reference, very common or not) of the method no general statement on the reliability is possible [BEN01].

Technical Limitations

Like every biochemical or chemical analysis, the quality of the results depends on the quality of the samples analysed (e.g. mixed samples with DNA from various persons for various reasons, contamination from bone marrow transplants, see [JOB04]) and the procedures carried out through the analysis. In Germany, one example is known where an error in the analytical procedures led to a false positive . These errors can be reduced simply by using good laboratory practice (GLP) , A and B analysis in independent laboratories, working with external, independent observers and negative controls against staff involved in the analysis. There are numerous special procedures described to minimise problems arising from bad treatment of samples [FUC05]. But the quality of the sample taken from a certain habitat (e.g. a crime scene) remains a limiting factor to the quality of the analysis.

In the context of forensic analysis, depending on the analysed sample and their context, the methods in most cases only gives evidence that an identified person was at the crime scene. A positive identification does not tell directly, that the identified person committed the crime that was investigated. As with other biometric methods genetic fingerprinting can be spoofed e.g. by taking hair etc. from a person not involved to a crime scene. Further technological caused limitations of the methods are the time required to perform an analysis (about 24 hours for a genetic fingerprint) and costs. This limits the use of the method for verification purposes. But further development towards DNA-Chips or micro arrays could change that within a few years [BEN01], [SOK03].

Another limitation is that genetic fingerprinting as described does not work to discriminate identical twins. According to current data this applies to 1 of 250 persons in the world population [LIB05]. Further research to discriminate identical twins is currently being carried out.

Privacy Aspects

Among the possible consequences of the technical limitations discussed are :

Genetic fingerprints taken for forensic purposes can in addition be used to determine the sex and parentage.

In some cases the ethnicity of the person behind the genetic fingerprint can be determined with some likelihood; this possibility was used to analyse the remains of multiple victims .

Due to the neighbourhood of analysed STR to coded parts of the DNA there could be a relation between them and the analysed loci. This was discussed with the locus THO1 and the diabetes type 1 gene where the risk determined by analysis of a certain allele today is 0.12 % higher than the statistically average (0.4%) and thus is of limited practical value [BEN02]. It remains to be seen how this will be judged by commercial interests: insurance companies for example. Nevertheless, in Germany they are requesting to get access to the results of any performed genetic testing after 2011 .

Stored samples of DNA could be abused for other, privacy-invading forms of genetic analysis [JOB04].

In addition ethical issues concerning the way genetic profiles are being stored in databases are being discussed [JOB04].

Some SNP analysis ethical issues including privacy issues are currently not sufficiently evaluated. Due to the use of coded parts of the DNA for this type of analysis, the correlation of genetically caused diseases with the base-pairs found at the SNP-loci can be expected in some cases.

Face recognition

Face recognition is a sub-area of the general object recognition problem requiring the differentiation among objects only subtly varying from each other (i.e. faces) and thus presenting one of the most challenging computer vision problems. It is a non-intrusive biometric method dating back to the 1960s which has many commercial (for example entertainment, film processing, videophone, and teleconferencing), security, industry and law enforcement applications. Potential applications of an effective facial recognition system can be located in law enforcement for mug-shot identification, verification and access control for personal identification such as driving licences and credit cards, surveillance of crowd behaviour, anti-terrorism, as well as enhanced human computer interaction. And what is more, given the fact that humans are the centre of attention of many videos, face recognition systems offer a great number of advantages in areas such as content indexing and retrieval as well as video compression. Face recognition systems also provide additional security in human authentication systems which use other means of authentication, such as smart cards, passwords, etc.

A recent application expected to spread widely concerns the reinforcement of security in mobile phones, PDAs and mobile devices in general through face authentication of the owner of the device. Taking into account the fact that the functionality of mobile devices has increased significantly and has been enriched with a variety of new services including personal information, such as address book, payment data and schedules, the need for protection of this information arises. This need for security combined with the fact that mobile devices are already camera equipped leads to the strengthening of the security of mobile devices by using a face authentication system.

A facial recognition system may cover a wide range of areas, from well-controlled environments to uncontrolled ones, whereas they can be applied either to single images or to sequences of images, i.e. videos. In a controlled environment, frontal and profile images of human faces are captured with a uniform background and identical poses among the persons to be identified. However, the general face recognition task concerns an uncontrolled environment; significantly varying lighting conditions, occluded faces, varying facial expressions, faces appearing in different scales, poses and positions, complex and/or non-static background, complex foreground, more than one face contained in an image. Also, since facial features change through the years due to aging, the system should be robust enough to handle this requirement if the application requires it.

Technical description of the methods

The first task of the system is the detection of faces in the captured images. An image may contain zero, one or more faces. Given an image, the human detection and localisation module aims at automatically and reliably identifying and determining the position of all regions in the image which contain a human regardless of its three-dimensional position, orientation, pose and lighting conditions. Taking into account the fact that the complexity and efficiency of the face recognition step depends on the accuracy of the detection process in locating the human face in the image, the human face detection process can be regarded as very important. Any method used for human face detection/localisation should take into consideration not only the fact that faces are non-rigid and but also that they have a high degree of variability in size, shape, colour, texture, orientation, facial expression and occlusion. In case one or more faces exist in the processed image, then the location and size of each one should be reported to the system so that the marked area will be further processed in order to identify the detected face.

Face detection constitutes a heavily researched area including a great number of developed face detection methods, which can be mainly classified into four categories:

Feature invariant approaches: which aim at detecting invariant facial features, in the sense that these features exist even when the viewpoint, orientation, or lighting conditions vary. The detected features are then used for face localisation. The basis of these methods is the observation that humans are able to easily detect faces in varying conditions and orientations, and thus features or properties invariant to these variable conditions and situations must exist. Examples of such features are the texture of the face (including hair and skin) and the facial colour. The latter is used on the strength of the results of scientific studies which indicate that the difference in the facial skin colour is mainly due to a difference in intensity rather in chrominance, and thus a number of facial skin colour models have been built in different colour spaces. In recent years a number of techniques that combine facial features in order to detect and locate faces have been presented. These features involve facial skin colour, shape and size for the determination of candidate areas in the image and then the verification phase takes place with the candidate areas being investigated for the existence of facial features such as nose, mouth, eye brows and hair.

Knowledge-based methods: which are based on the effort to encode human knowledge of what a typical face looks like. Most often this knowledge is composed by rules which capture the relationships between facial features, regarding their relative distances and positions. Examples of such rules can be the fact that a face includes two eyes which are symmetrical to each other, a nose and a mouth. However there remains the danger that if the rules are strict, then they may fail to detect faces that they do not satisfy all the rules, whereas if they are too general, they may provide too many false positives. Moreover, the detection of faces in different poses becomes a challenging task since all possible cases must be taken into account. Nevertheless, as far as frontal faces are concerned, these methods can efficiently detect them in uncluttered scenes.

Appearance-based methods: the models which are learnt from a large set of training images of faces of variable features with the learned facial characteristics being stored in the form of either discriminant functions or distribution models. These models are used for face detection by being applied to the images to be examined.

Template matching methods: which involve the matching of an input image with standard patterns of a face describing either the face as a whole or the facial features separately. This matching involves the computation of their correlation values and thus the existence of a face is determined by these values. The drawbacks of these methods mainly lie in their inability to provide reliable results in an efficient way in.

The Eigenface approach, one of today’s most advanced methods for face recognition, is described in detail in the annex 2.

Value and (technical) limitations

The Eigenface recognition method has several advantages, such as the fact that no significant low-level or mid-level processing is required before raw intensity data are used for learning and recognition, there are no requirements on knowledge of geometry and reflectance of faces and it is simple and efficient. However the results of the implementation of this method reveal some limitations, such as that its efficiency and accuracy decrease under varying pose and illumination, learning is time consuming. The results concerning feature-based face recognition show good accuracy, with recognition rates of up to 90%.

The use of neural networks in these areas is rather popular achieving high accuracy – varying from 90% to 99% depending mainly on the number and variations of trained samples. However, their use during the feature extraction phase can be rather time consuming due to their complexity and thus are usually used in the pattern recognition phase. The nearest neighbour classifier is rather fast –faster than neural networks especially concerning the training time. Nevertheless, as far as accuracy is concerned, results have shown that a neural network is able to achieve the same accuracy with the nearest neighbour classifier using far less eigenfaces, and a higher accuracy when using the same number of eigenfaces.

Privacy aspects

The main question arising as far as the use of face recognition systems in public areas is concerned is whether it invades privacy. Taking into account the fact that these systems operate based on physical human characteristics that are constantly exposed to the public, many people regard that there stands no matter of privacy invasion as far as the access to images of facial features is concerned. However, there should be notification to people entering a public area where camera monitoring takes place, so that they are given the opportunity to make a choice whether or not they wish to be included in the captured videos. This choice of course is rather fictitious in public areas such airports, however these areas are already video monitored.

An issue concerning face recognition systems used for surveillance and security reasons is what level of official procedure is required for a person’s image to be entered into the image database used by the face recognition video surveillance system. In the case of an arrest warrant having been issued, then things are rather simple. Nevertheless, there remains the danger of abuse of such systems from people simply wanting to track the life of other people. The system for instance is technically able to capture the image of every person entering the area covered by cameras and store it for future use. The only limitation could be the size of the image database. One solution to this could be the maintenance of a record including: the entrance date of the image into the database, the reason for this action, as well as whose request triggered this action. Moreover, there is the possibility that the image databases and the face recognition surveillance systems might be networked together, so that in the case of detection of a particular person in an area (e.g. airport), then similar systems in other areas are notified (for example railway stations, ports and subways). Such a scenario could lead to the unstoppable monitoring of a person’s entire movements.

Another aspect of face recognition is that from a picture a specialist can diagnose various diseases such as marfan-syndrome, down-syndrome or crouzon-syndrome and acne [KRA05].

Iris recognition

Iris recognition was developed in the early 1990s by John Daugman at the University of Cambridge. The method analyses individual patterns of the iris and today is mainly used for verification purposes (access control) e.g. at various airports in Europe and the USA and as a pilot project for non-Schengen travellers in Europe [RAI04].

Description of the method

The complex structure of the iris is not genetically defined, but develops randomly in the 3rd to 8th month of pregnancy in the eye of the foetus . The structure of the iris remains constant throughout the whole life, but in the first years after birth the colour can change through further pigmentation. Today more than 400 different characteristics of these structures can be discriminated [AMB03] of which about 173 are being used for iris recognition . The likeliness that two people have identical structures of the iris is estimated to be 1:1078 [AMB03].

Starting point of the method is a monochrome camera picture taken by near infrared light (NIR) at a distance of 0.1 to 1 meter. The resolution of the taken picture varies from 50 to 140 dpi. Generally the procedure runs through the steps in Figure 4-4.8 [AMB03].

Figure 4‑4.8: Procedural steps for iris recognition

Figure 4‑4.9: Picture of an iris and graphical representation of an IrisCode

For the calculation of the so called IrisCode (a string of 2048 bits) e.g. the Daugman-Algorithm [DAU04] is used. The following picture shows an example of an iris picture together with a graphical representation of the calculated IrisCode. The outer and inner borders of the iris are marked using white lines as in Figure 4-4.9.

The comparison of an IrisCode against a stored template is done mainly using the ‘Hamming Distance’ method [DAU04], [AMB03].

Value of the method

The method is well tested and performs well against the ‘seven pillars’ [LIB05]. Only acceptability was determined to be low. This may change when knowledge and usability of the method can be improved.

Limitations

There are a few known limitations especially in the use of the methods . They apply mainly to:

People having no eye or no iris (so called aniridia; this happens to 1.8 of 100,000 people)

Blind people having problems adjusting their eye to the camera taking the picture

People having pronounced nystagmus (tremor of the eye) having problems getting a proper picture of their iris.

Privacy aspects

Current research gives evidence that from the (raw) picture of the iris certain diseases such as glaucoma and iritis can be diagnosed .

Hand Geometry Measurement

Hand geometry has been used for more than 20 years, mainly in the USA , but examples of the use of this method in Europe are reported as well . This method analyses individual geometric patterns of two fingers or the whole hand and today is mainly used for verification purposes (access control) e.g. at various airports or nuclear power stations in the USA .

Figure 4‑4.10: Example of a commercial available hand geometry reader

Description of the method

For this method the following patterns are used: length of the fingers, their width and height and the bending of the fingers [AMB03]. These structures remain, at least for some significant time, constant.

The starting point of the method is a monochrome three-dimensional picture is taken with a CCD camera. For that purpose the hand is fixed in the reader using pegs (see Figure 4-4.10 ). A picture resolution of 150 dpi is typically used .

Generally the procedure runs through steps shown in Figure 4-4.1194:

To calculate the reference value, 25 to 90 reading points (see some examples in Figure 4-4.12 ) are used. The reference value is 9 to 25 byte long, for the calculation various algorithms are being used. To compare the reference value with a stored template various methods such as the Euclidian distance, the Hamming Distance or neural network methods such as Radial Basis Function (RBF) or Gaussian mixture model (GMM) are being used91. Currently the GMM method seems to lead to the best FAR and FRR values .

Figure 4‑4.11: Procedural steps for hand recognition

Figure 4‑4.12: Examples of reading points used for hand geometry

Value of the method

The method is well established, especially in the USA. Current systems reach FAR between 0.0001% and 0.1% and FRR between 0.0007% and 1.0%91. An equal error rate (ERR) 0.1% has been reported89. The method is used within a pilot project carried out by the American Immigration and Naturalisation Service Passenger Accelerated Service System (INSPASS) . In 2001, 20000 verifications were carried out every month [AMB03].

Limitations

The method needs quite bulky and heavy readers and compared to fingerprinting is more expensive in the infrastructure. The enrolment takes about 30 seconds89. The method needs physical contact with a reader. This leads to some discussions about hygienic concerns [AMB03], especially in Asia. The method is vulnerable to changes of the hand geometry caused e.g. by aging, wearing of jewellery, injuries or diseases such as arthritis and gout. Owing to the rapid change of the geometry of the hand this method can not be applied to children. The uniqueness of the reference value used for the hand geometry is limited. This limits the use of the method to verification purposes .

Privacy Aspects

From the raw picture many diseases such as arthritis, gout or marfan-syndrome can be diagnosed. But reverse calculation from the reference value to the hand geometry seems to be impossible98.

Behavioural (or Active) Methods

Signature recognition

A person’s signature is regarded to be a trusted method for user identity verification, and is used in areas such as law enforcement, industry, security control, financial transactions. People are able to recognise their own signature at a glance, whereas examination of signature authenticity could be regarded as a scientific endeavour. Generally, the verification investigation of handwritten objects, including handwritten signature, is broadly used. Examples of applications are the confirmation of a document’s authenticity, access to controlled documents, as well as the investigation of forgery (concerning contracts, checks, formal agreements, etc.). People use their signature in daily transactions as a transaction-related identity verification means, such as in banks, in their work, when paid, as well as for a means of identity verification for every official document. The way a person signs their name is considered to be a behavioural biometric. An automatic signature verification system is able to verify a person’s identity by examining the person’s signature and comparing it, as well as the way the person writes it (where the system performs on-line processing of the data), to the person’s enrolled signature samples.

Technical description of the methods

The methods used for automatic verification of signatures depend on whether there is real-time input or it is provided as result of scanning and digitising of source documents. Two types of data are mainly collected from a person’s signature; the features concerning the process of signing, such as the time taken to sign, the speed, the acceleration, the pen pressure, the number of times the pen is lifted from the paper, the number of times this happens, the directions (which require additional hardware) and the features specific to the signature. Even if a person manages to duplicate the visual image of another person’s signature, there is great difficulty in duplicating the way that person signs their name. However, taking into account the fact that a person changes their signature as time goes by, the signature verification system should be able to adjust to such slight changes.

In the case of verifying handwritten signatures provided off-line, information such as the speed, the acceleration and the time taken to be written are not available, and thus the signature verification becomes even more challenging. Researchers have reported however that there exist features in a person’s signature that could be considered to be invariant, such as the ratios of tall letter height to small letter height and distance between the letters. A method proposed by Juan J. Igarza et al [IGA03] on on-line signature verification concerns the use of Hidden Markov Models. They used a tablet which obtained values of pressure, X and Y coordinates, per azimuth and inclination for each sample. The signature data is digitised and stored in the database in the form of a matrix. Given the fact that the signature process includes varying factors such as the speed, the size, the rotation, this method includes a pre-processing stage during which time normalisation takes place. The training set is formed using a number of signatures of each person aiming at collecting representative positive examples. Further details of the use of the Hidden Markov Model are described in annex 3.

A model for off-line signature verification aiming at limiting the number of genuine samples used for training was proposed by Santos et al [SAN04]. The number of genuine samples is rather limited and usually less than the number of samples required for training by classifiers such as Hidden Markov Models, neural networks and support vector machines in order to capture the variability in the way a person signs their name. This method includes a set of graphometric features and a neural network classifier. Based on personal methods, two pattern classes are used; a genuine signature set for each person and a forged signature set, which is divided into simple (signature sample of the same shape as the genuine one), random (genuine signature of another person with their signature not necessarily enrolled into the system) and simulated (satisfying imitation of the genuine signature) sets. The genuine signature sample set is used for the production of the training model.

A subset of the features (such as calibre, white spaces, curvature and apparent pressure), which according to graphometric studies are used by experts on suspect document, was chosen and related to static and pseudo dynamic computational features such as space occupation (static), pressure area (pseudo dynamic), stroke curvature (pseudo dynamic), stroke regularity (pseudo dynamic), whereas a grid approach was used for the computation of the features. Thus, for instance the representation of pressure areas is through variability in signature trace width and material deposition in a specific area of the trace, whereas the computation is performed through the gray-level average in the cell Figure 4-4.13.

Figure 4‑4.13: (a) Genuine signature and forgeries (b-d)

They use a method proposed by Can to produce a feature vector to discriminate between genuine signatures and forgery ones, whereas their Euclidean distance vectors are used to provide the input to the neural network. The comparison stage involves two steps; training and verification. Taking into account a small variability (and thus small distance) in the signature samples of the same person, during the first step the distances between samples are computed setting the feature vector to 1 in the case of signatures of the same individual and 0 otherwise. In the second step, the two outputs of the trained neural network refer to two signature samples of the same person and of different individuals respectively. The final decision is based on the combination of all classifiers in a majority vote Figure 4-4.14.

Figure 4‑4.14: The off-line signature verification scheme based on the expert’s approach

Value and technical limitations

An on-line signature verification system performs better than an off-line signature verification system in terms of true positives and true negatives due to both the greater number and difficulty of forge factors taken into account, such as pen pressure, angle, speed. However, both methods require a substantial number of signature samples of the same person leading both to storage, speed and usability drawbacks. The reported results of the on-line signature verification method implemented by Igarza et al were rather satisfying including; FAR: 0% and FRR: 31.52% using 3750 genuine signatures and equal number of forgery ones, whereas in the off-line signature method the average total error in verification is reported to be ~8%. The latest figure is reported to be mainly due to the small training set and moreover the system was not prepared to identify simulated forgery. Generally however a signature verification system is vulnerable to the mood swings of a person, a factor affecting the way a person signs their name.

Privacy aspects

The main threat of a signature verification system lies in “who” has access to the data stored in the database containing the signature samples. Although this issue concerns all biometrics, the seriousness of this threat increases when it comes to signature verification. The reason is mainly due to the fact that signatures are the most widely accepted method of proving identity and thus used in most transactions and especially financial ones. Furthermore, a system performing signature verification can be used in order to track an individual’s transactions, and thus monitor their financial and other behaviour without their knowledge or consent.

Key stroke analysis

Most biometric technologies require special hardware to convert analogue measurements of signatures, voices, or patterns of fingerprints and palm prints, to digital measurements that computers can read. The use of keystroke dynamics, on the other hand, offers a software-only solution, and relies only on an external existing keyboard to produce a digital measurement binding it to standard user ID and password procedures.

Keystroke dynamics looks at the way in which a person types or pushes keys on a keyboard. This technique thus works by detecting patterns of typing on a keyboard by a person and comparing them against patterns previously enrolled. This biometric is based on the typing characteristics of the individuals such as typing error frequency, latencies between keystrokes, duration of keystrokes, inter-keystroke times and force keystrokes. The original technology was derived from the idea of identifying a sender of Morse code using a telegraphy key known as the “fist of the sender”, whereby operators could identify senders transmitting a message by the rhythm, pace and syncopation of the signal taps. During World War II, the Army Signal Corps discovered that an individual keying rhythm on a telegraph key was unique. In the early 1980s the National Science Foundation and the National Bureau of Standards in the United States conducted studies establishing that typing patterns contain unique characteristics that can be identified.

Keystroke dynamics works by monitoring both the typing and characteristics between letters when typing in a (pass)word. Verification is based on the concept that how a person types, in particular their rhythm, is distinctive. Even if intruders guess the correct password, they cannot type it in with the proper rhythm. However, if someone is physically located next to you, for example, they could possibly observe key clicks when typing in a password. However, once an impostor is removed from the environment (causing a lapse in memory), the impostor is unable to replicate the legitimate biometric template.

The main application of this biometric is in “hardening” password entry; providing greater assurance that a password was typed by the same person who enrolled it, by comparing the pace at which it was typed. The username-password paradigm is common throughout virtually all web services and system login programs, whereas passwords are also used for file encryption and authentication to private networks. Although a password is the most widely used identity verification method in the computer security domain, it has proven to be a rather vulnerable means of verifications and thus a fairly weak mechanism for user authentication. A user’s account is entirely compromised if an adversary discovers the user’s username and password. The use of keystroke dynamics can provide a more secure verification system. In case the typing patterns differ, the keystroke-enhanced login system can prompt a personal question in order to proceed with identification.

Keystroke dynamics can also be used for the extraction of profiling information about an individual, which can then be used for the provision of personalised services. Given that this biometric requires nothing more than a keyboard as the interaction device between the human and the system, it is non-intrusive and easily used.

Technical description of methods

Keystroke dynamics utilise the manner and rhythm by which each individual types in passwords and logon codes to create a biometric template. It measures the keystroke rhythm of a user in order to develop a template that identifies the authorised user. A verification system is able to measure the differences in how we type, and use the measurement when verifying different people.

Monrose et al [MON99] proposed a method for the improvement of password security by combining keystroke biometrics with passwords. In this approach, the legitimate user’s typing patterns are combined with the user’s password to generate a hardened password that is convincingly more secure than conventional passwords against both internal and external attackers. This analysis is transparent to users while they are trying to gain system access via a password-authentication mechanism in the normal way (by entering a user ID and password string), whereas it is flexible enough to adjust to gradual changes in a user’s typing patterns. Their method was based on password “salting”, a method in which the user’s password is prefixed with a random s-bit number (the “salt”) before hashing the password and comparing it with an enrolled value. In this method, some or all of the salt bits are determined using the users typing characteristics. During enrolment, the information stored in the user’s database template (similar to UNIX systems) is not just the password (‘pwd’) or the hardened password (‘hpwd’), but also includes:

a randomly chosen (typically 160bit) number (r)

an “instruction table” encrypted with pwd, which contains instructions for the generation of hpwd from the feature descriptor r and pwd. The instruction table is built following the next steps: first, a binary feature descriptor is created by thresholding the user’s keystroke features (typically 15 in number) and afterwards this binary feature descriptor and the random number r are used for the creation of the instruction table using Shamir’s secret sharing scheme.

a “history file” encrypted with hpwd.

During authentication, the system uses the instruction table and the random number r from the user’s database template and the entered authentication password ‘pwd’ and keystroke features acquired during the authentication process for the computation of ‘hpwd’. The latter is then used for the decryption of the encrypted history file. In the case of successful decryption, the user authentication is successful as well and the random number r and the user’s history file in the template are modified. If the opposite occurs, another instance of hpwd is generated but with some error correction, and another effort for authentication is made. Nevertheless, if the authentication is unsuccessful for a fixed number of attempts, the result is authentication failure.

Different technical approaches can be used. Commercial systems tend to rely on methods whose technical operation is easily understood, thus offering “psychological” reliability beyond anything that can be proven by experiments with end-users. These approaches are generally based on classical statistical methods, forming statistical templates of user patterns and performing pattern matching based on well-established metrics. In the research community, the more effective, interesting and often presented methods rely on methods such as neural networks.

Value and limitations

The approach proposed by Monrose et al. is reported to be able to adjust to gradual changes in a user’s keystroke biometrics over time and still maintain the same hardened password, while it is easily used by users and uses actual keystroke data. The expected number of attempts for authentication before a user successfully logs into their account is report to be less than 2 with a reliability of 51.6%, whereas this number slightly increases for the improvement in reliability to 77.1%. This method however runs a risk in the case of a sudden change in the user’s typing behaviour that the user will be unable to log into their account, since the correct hardened password will not be generated. A simple example of such a case is if the user uses a keyboard of different style than their usual one.

It is important to recognise that keystroke dynamics, when layered on user ID and password, incorporates the statistical probability of password access control. Using a statistical formula, we can represent the probability of a security breach with the use of passwords alone.

Selecting a password randomly from 100 possible PC keyboard characters (upper and lower case) that is unknown to an unauthorised user, the probability of a successful password occurrence is P=(l/100)n where “n” denotes the character length of the password. If the probability of selecting a proper password is independent of the probability of a security breach, then this will result in the probability of success as (1-(1- (l/100)”)1) where “t” = the number of tries. The mathematical formula 1- (l/100)n will essentially equate to zero, implying that without knowledge of the password, there is little or no chance of a security breach.

Unfortunately in the real world, this is not the case. Users share their passwords, write them down, select easily guessed passwords and users seldom change them unless they are forced to do so. The vast majority of passwords can be determined far too easily by intruders especially if written on a post-it-note stuck to the computer.

User verification based on recognising Keystroke Dynamics provides a unique level of security for logon and passwords. This technology measures keystrokes to generate the biometric signature. To illustrate the unique statistics of keystroke dynamics, Table 4-4.1 can be derived. When the probability of a security breach in the password only example is multiplied by the factors in the table, one can see that even with full knowledge of someone’s password, the security of a system is still within the acceptable limits because of keystroke dynamics. The proper design of a keystroke dynamics security system can provide additional deterrents to an impostor.

Number of Attempts	Probability of a Security Breach
1	.00001
3	.00003
5	.00005
7	.00007
9	.00009
100	.001

Table 4‑4.1: Probability of a security breach using Keystroke dynamics

An example of the effectiveness of a keystroke dynamics device can be assessed using the following assumption:

Logon Name = known!

Password = known!

Decision point = .01% or .0001

False rejections = 3%

Tries before lockout = 6 attempts

Lockout time = 5 minutes

Every 6 attempts result in a probability of 1 in .0006 of successful access or 6 times in 10,000 tries. The system locks for 5 minutes every sixth try, or must be released by the system administrator, who would notice the attempt. If a 5-minute lockout were implemented, the system would be locked for (10,000/6) x 5 minutes or approximately 140 hours before a successful keystroke dynamics match. This is certainly a deterrent.

The use of passwords is strongly embedded into computer access systems worldwide, so it makes sense that better password management is required. It also opens opportunities for complementary technologies, which can enhance password systems and make them more secure. One such solution is the combination of passwords and biometrics. As biometrics become more accepted within Enterprise IT security, keystroke dynamics are being recognised as an unobtrusive, non-invasive, and very cost effective solution. The only hardware requirement for Keystroke Dynamics is a computer keyboard.

Privacy

The application focus of Keystroke Dynamics recognition is that of verification of computer users at logon time. At this stage, verification is of course totally warranted and no privacy problems arise.

Keystroke biometrics can be collected from virtually anywhere throughout the world via an Internet connection without requiring an individual to be at certain locations with access to specialised hardware. This combined with the fact that recognition of keystroke dynamics can be abused in a way that is extremely difficult to track leads to a serious threat of an individual’s privacy. A simple example could be a chat program that is able to measure users’ typing patterns and perform user identification regardless of the whether the individuals use multiple accounts, nicknames not related to their personal information, different computers at different places, etc. In a similar way and in case of centralised collection of identification data a person’s profile could be built through the tracking of their actions and preferences on the Internet without their permission.

However some of these malicious applications face many limitations for the time being, since both the ability of creation of a centralised collection of such data by these applications is in question, whereas in many cases measurements are not feasible; for instance, a web server is not able to make such measurements, since data is sent in packets containing many key-presses. Moreover, the task of recognition itself includes many limitations. However, pattern recognition systems perform well in many cases: the recognition of password typing is an established example, and the recognition of free typing is a similar application that has also provided successful experimental results. Still, there exists no conclusive study of the size of the threat, i.e., the possibility and/or difficulties of exploiting typing recognition in the environment faced by malicious software.

Soft Biometrics

As already mentioned, biometrics refers to the automatic identification or verification of individuals by using their physical or behavioural characteristics. Nevertheless, up to now no recognition or verification method based on one physical or behavioural feature combines efficiency, universality, robustness to noise in data collection, reasonable protection against spoof attacks, acceptable error rates, satisfying matching rates, and satisfying temporal (especially in real-time applications) and spatial complexity both for training and verification, user-friendliness. This limited ability of the implemented methods is due to not only the limitations of the methods but also to the theoretical upper bound that every biometric has with respect to its ability to distinguish two individuals.

A solution to these limitations is the use of soft biometrics features. Soft biometrics are the human characteristics that provide information about the individual which however is unable to sufficiently differentiate any two individuals and thus identify an individual reliably and uniquely due to its lack in distinctiveness and permanence [JAI04]. These biometrics include information such as gender, eye colour, ethnicity, age and height. In order to perform identification or verification, a system totally based on soft biometrics information cannot provide results with a satisfactory matching rate. Nevertheless, soft biometrics can offer great amelioration to the performance of common biometric systems (e.g., signature verification system, face recognition system, fingerprint identification system) by complementing the identity information of each individual.

Soft biometrics are able to further improve the performance of a biometrics system by tuning the parameters of the system, such as thresholds and even weighting in case of multimodal biometrics systems. A significant improvement that soft biometrics offer is the filtering of large biometric databases; in other words, limiting of the database entries which the traditional biometrics system (e.g. face recognition system) will include to its effort to recognise an individual and thus improvement of the efficiency and speed of the system is achieved, whereas the possibility of false positive is reduced. For instance, if the person to be identified is a blue-eyed child, then the search can be limited to the records that concern persons with this colour of eyes and age group.

Technical description of the methods

The use of soft biometrics requires them to be properly obtained from the user. More specifically, the system should be able automatically to determine the required soft biometric traits (such as height, age and gender) of the person when they interact with the main biometric system (for example the fingerprint identification system). The height of person can be estimated for instance through the use of ultrasonic sensors.

Xiaoguang Lu and Anil K. Jain [LU04] proposed a method for ethnicity recognition (Asian vs. non-Asian) taking into account the fact that human face images include valuable information concerning the person’s gender and ethnicity. The problem is addressed in a machine learning framework, whereas Linear Discriminant Analysis based scheme is used for the two classification task. This latter method is a popular statistical method used for the projection of given multidimensional data to a lower dimension aiming at maximising the ratio of between-class scatter to within-class scatter. Given the fact that images on different scales provide different levels of information, they resize each face image to three different scales with an LDA based classifier built for each one. The nearest neighbour rule is used during comparison, while the matching score is composed by the cosine value of the angle between the test image vector and the training image vector. As expected, the classification result of the test input image is determined by the training image with the best match.

Value and technical limitations

The accuracy of soft biometric systems is vital when they are used complementary to primary biometrics since a false negative result can be caused by false filtering of the enrolled biometrics data leading to overall system performance degradation. The presented ethnicity identification method offers rather promising results with its average accuracy rate reaching 93% involving four categories (Caucasian, South Asian, East Asian and African) and over 3000 test images.

Privacy aspects

One of the main advantages of soft biometrics is the fact that they lack uniqueness and thus the knowledge of a person’s soft biometrics is not enough to threaten the person’s privacy. They are used in a manner complementary to traditional biometrics systems and most of them are exposed during a person’s daily activities.

Security and Privacy Aspects

Security Aspects

Once a technology becomes available, it is used, controlled, manipulated, exploited and compromised by people, thus creating an information system with multiple security vulnerabilities which have to be addressed. Besides the technological aspect of security there are a few other aspects that need further consideration. This is especially so in more complex biometric implementations that take place on a broader-scale (such as border control). Security in the technological artefact can be seen as complementary to two other aspects that will be briefly discussed below. These comprise together the TFI model which separates three different levels, namely the technical, the formal and the informal [DHI96].

Technical

With any emerging security technology, one question is paramount: ‘How reliable is it?’ Two technical issues exist that can be used to quantify an answer, that of a false positive, i.e. concluding that an impostor is actually who they claim to be, and false negative, i.e. being unable to confirm the identity of a valid user. A review of current biometrics technology [JAI04] has indicated that fingerprint identification has a false positive probability of around 0.2%, and a false negative probability of around 0.2%. Face recognition performs worse with a false positive probability of around 1%, and a false negative probability of around 10%. Error-rates to this degree are simply not acceptable in security critical applications even if they are slightly assisted by soft biometrics (see section 4.2.4). For relatively small databases they may be acceptable but in the proposed applications (i.e. border control) whereby centralised databases will hold a staggering 60 million records it will be impossible to stop someone claiming multiple identities .

Beyond the error-prone nature of biometric technology, there is the real possibility of deliberate attack in an attempt to compromise security.

Figure 4‑4.15: A block diagram of a generic biometrics system, with eight potential attack points highlighted. Adapted from [ULU04]

Figure 4-4.15 highlights the significant eight points within the biometric system which are open for potential attack [ULU04]. The extent to which these can be exploited has a direct relation to the overall security of the system. The eight points of attack are:

Utilising an imitation biometric (e.g. a prosthetic finger). Many methods have been developed to produce easily such devices [PUT00], [MAT02] and, in the case of commercially available fingerprint systems, have shown a success rate of between 67 – 100%, mostly dependent on the quality of the original source print (a willing volunteer’s print works better than one lifted from a glass, for example). Methods to counteract these shortcomings, such as identifying if it is real, living tissue are showing some promise [DER03] but there are no guarantees that fraudsters will stop there. On the 28th of March, 2005, a gang of carjackers in Kuala Lumpur first forced the victim to activate the car’s fingerprint-recognition system and then cut off his fingertip . Systems that incorporate ‘aliveness detection’ might not be the solution but could just prolong the suffering of the ‘bio-victims’ or lead to alternative methods.

Although more complex, it is possible to replay previously submitted biometric data to cause a false positive identification. A potential solution to this is for the system to challenge the sensor device with a secure request for additional information. For example, if the system requests the sensor to repeat certain randomly selected parts of the captured data, then the system can establish if the data has really come from the sensor.

By attacking the system at the feature module point, it is possible, albeit unlikely, for an attacker to force the system to produce values unrelated to the sensor input that subsequently generates a false positive result.

Replacing the system generated feature values with known valid ones will result in unauthorised access.

If the matcher can be forced into generating an incorrectly high matching score, then a false positive will result.

The template matching component is particularly vulnerable since incorrect data stored here (through error, collusion or attack) is open to abuse at any time. A template may be added, edited, removed or replaced in order that an invalid user is authenticated. Database security is the key here to reducing vulnerability since unsecured templates can be reverse-engineered and synthetic data added.

By intercepting the transmission of the template data, and replacing the original templates with false data, a false positive can be generated.

By attacking at the decision end of the system, the binary result ‘Yes / No’ can be modified to falsify the result.

Attack (1) is perhaps the most intuitive, whilst the remaining attack techniques require a more intimate understanding of the specific authentication system and typically some degree of access to its inner workings. However, all component parts of the authentication system represent a potentially exploitable issue.

In [SCH99], the two perhaps most pertinent security issues relating to biometrics are highlighted: the lack of secrecy of biometric data (for example, fingerprints are routinely left on objects during everyday activities) and non-replacability (i.e. once a fingerprint has been compromised it cannot be changed). These are in contrast with traditional methodologies such as passwords which remain secret and are easily replaced if compromised.

Formal

Besides getting the technical level straight there are other aspects of security that have to be considered. In the formal aspect there has to be a clear consideration for both principles and policies. Typically, a demarcation that occurs between these two considers principles to be close to higher-level guidelines whereas policies are more specific. Both are important and required in order to cover the formal security aspects. The degree of difference between principles and policies is also important. A security policy must be based on actual behaviour and provide rules that do not jeopardise the security of organisational processes and systems. Security principles on the other hand must serve a complementary role to that of the security policy.

Principles are higher-level descriptions of the broader security scope of an organisation and they serve the purpose of guidance when there is no clear rule to be followed. Decision-making about security related issues can then be inferred from the principles. The problem of course rests with different stakeholders and their respective interpretations of the principles. This means that if we go past the technical level and address these security issues, we still have to consider tackling the formal security aspects by developing principles and policies concerning the handling of biometric templates. Application of standards such as ISO17799 can help in that direction and there has to be a robust audit mechanism for a periodical review of the security policies. There is always of course the question of ‘Who Audits the Auditors’ that has to be further considered.

Informal

Complementary to technical and formal aspects, security can also be enhanced by informal aspects. These cannot be documented like the former two but still are important intangible elements that can be roughly separated into responsibility, integrity, trust and ethics [DHI00]. These are once again complimentary and it is up to organisations (whatever form these may take) to find innovative ways to create a culture that fosters such principles.

Responsibility concerns each individual’s awareness of their roles while integrity becomes extremely important as it is up to individuals to use or misuse the information that they are given access to. In the case of biometrics data, where information concerns identity and critical – to the privacy of individuals – it is crucial that personnel working in this domain do not misuse that information. In addition to responsibility and integrity, trust and ethics are also important if members of an organisation are to follow the norms (which in their turn are influenced by formal aspects). If present, the aforementioned aspects can enhance security as insider fraud is a difficult issue to tackle. Only one corrupt individual is required do all the work. That being the case, some will not even bother with hacking; they will follow a simpler route instead.

By security here, we would like to emphasise that we are looking on the broader security concerns pertaining to the use and handling of data, after biometrics are implemented. This is closely associated with privacy concerns and has nothing to do with the supposed enhancement of security (i.e. controlling national borders and visitors – like the US VISIT program).

What level of security (physical storage, procedural considerations, etc.) will comprise the biometric environment.

What happens after the biometric is digitised? Only one underpaid/corrupt individual is enough to bypass all security measures.

Security Policy for handling the data ­outlining three different aspects: The technical, formal and informal (who has access to what, education and awareness programs that could potentially minimise resistance to change).

Will security wrappers be commercial, off the shelf tools or bespoke? What are the implications for interoperability?

Types of encryption and biometric integration capabilities.

Will biometrics help?

Biometrics can be a means of reliable, fast and secure user authentication: but only if certain conditions are met. It turns also out that some of these conditions are difficult to achieve.

While biometric authentication systems can replace traditional authentication systems and eliminate the need for password or token management, biometric systems themselves require a template management because also biometric templates must be updated from time to time.

Non-biometric authentication systems are often based on secrecy of some data. If such secret data are revealed or there is other confidence the user is in possession of such data then the user is authenticated. We assume that the secret data is shared only by the genuine user and the authentication system, therefore the evidence of having access to such data is sufficient to authenticate the user. We do not have to bother whether the keyboard the user used to type the password is trusted by the authentication system or not.

Biometric authentication systems are based on data that cannot be considered secret. Therefore we cannot successfully authenticate a user only by comparing the biometric data with the template. If biometric data is not secret then any other user could also supply such data. To make biometric authentication secure we have to guarantee that the biometric data come from the user being authenticated and were captured at the time of the authentication.

This implies that the biometric input device must be trusted by the biometric authentication system to provide only genuine measurements. This is in practice not so easy to assure. Typically, the authenticity of the input device should be verified (so that it is not possible to replace the input device with an imitation device that sends fake data), which might require cryptographic keys (and related key management). Next the device should be tamper resistant, otherwise an attacker could replace or disable some components or inject its own data. Safeguarding the tamper resistance of a device of the size of a typical biometric input device is not an easy task. It is in fact a question whether that is at all possible at a high level of security (e.g. comparable with tokens).

Last but not least we have to mention the aliveness test. Biometric authentication system must process only genuine biometric characteristics belonging to the authenticated user. Forged (changed or artificial) biometric data must be rejected. This test must not only check the aliveness of the person but also the relationship between of the person and the captured biometric data (otherwise we could successfully check the brain activity of an attacker but capture a fingerprint of a plastic finger). This is sometimes also called the aliveness test and it is very dependent on the biometric technology. It will be different for the different systems: fingerprint based systems and iris-based system. Currently there is a lack of reliable and inexpensive aliveness tests. Most current commercially available aliveness tests can easily be cheated.

The requirement of the trusted biometric input device limits the use of remote biometric authentication. If a bank wishes to secure the access to its Internet banking biometrically it has to provide its clients with a biometric input device, the authenticity of the device must be verified, a reliable aliveness test must be included and the device must be tamper resistant. This is currently quite difficult to accomplish. The biometric device is in the possession of the client who is able to experiment with it as much as he/she wants.

A constant human supervision of the biometric device/system could avoid some of the previously mentioned requirements. Issues such as whether a guard will notice a thin plastic layer on the thumb are still open to discussion.

Non-biometric systems based on the secrecy of data can relatively easy deal with the situation when the supposedly secret data are disclosed. New secret data are generated and distributed to relevant parties. Biometric systems do not have such an option. Biometric data are (or at least should be) unchangeable and invariant over time. Therefore such a recovery of the security of the system after an incident is not possible.

Biometrics and cryptography

While cryptographic mechanisms are often and successfully used to secure biometric data the role of biometrics in enhancing cryptography (e.g. in the key management) is not so straightforward. It is necessary to realise that biometric data are in no way secret. Systems that incorrectly assume that biometric measurements are secret and base the whole security on the secrecy of biometric data cannot be considered secure.

First of all it is relatively easy to get a copy of the user’s biometric characteristics. People leave fingerprints on everything they touch, and a picture of the user’s face can be easily taken without the user’s consent. Similarly other biometric characteristics can be obtained; there are only few exceptions such as the image of the user’s retina where it is difficult or impossible to obtain biometric data without the user’s consent. Even so, the biometric data could be for example misused by an administrator of a biometric system against another biometric system where the user is also enrolled. It is also difficult to find out that the biometric data bas been disclosed or captured by someone else (in comparison with e.g. a lost or stolen token).

Even if the disclosure of biometric data (and its misuse) is evident, there is not much to be done as the biometrics cannot be changed. Additionally, users only have a limited number of biometric characteristics (i.e. two eyes, 10 fingers etc.) to enrol. Therefore it must be pointed out that biometric data cannot be used as capability tokens in the same way as secret keys or passwords. In secret key or password based access control schemes, a key/password itself can be used as a capability. Knowing a secret key or a password can mean that the user has the right to use certain application. However, this does not apply to biometric data. Advantages of biometric keys (“secret” data derived from biometric characteristics) seem to be very attractive. Such keys could be generated from fresh biometric data only when authorised users are present and after the use could be immediately deleted thus eliminating the need of any key management, which is often the weakest point of a cryptographic system. We can therefore be tempted to create so called “biometric signatures”, i.e., signatures based on biometric characteristics or base traditional symmetric encryption on a key derived from biometric characteristics.

While biometrics are good in authenticating users they cannot be used to authenticate messages or computers. There is no point in adding a biometric signature to a message. If a user’s fingerprint is not secret then it makes no sense to add it to every document he has written. Anybody else could do the same thing. The same holds for any other data derived from biometric measurement including “biometric keys”. It is not possible to derive secret data from public data by a publicly known algorithm. And for confidential/secret algorithms see Kerckhoff’s principle.

Other factors against the use of biometrics-derived keys may include the amount of data that is really 100% invariant over time and the difficulties when getting such an invariant part of the biometric sample. It is clear that a single flipped bit in the decryption key will cause the cryptotext to be decrypted completely incorrectly. Error correction codes can be deployed here but they further reduce the amount of usable information. Therefore it is not possible to base a reliable and secure encryption on measurements that cannot be considered secret, cannot be changed and provide only a low volume of invariant data.

The right place where biometrics can help is securing the private/secret key. Private/secret keys are commonly protected by passwords or PINs. Securing the private key with a biometric system might improve its protection. Even in this case, however, the system will not be a silver bullet. If the signer’s computer is attacked by a Trojan horse, for example, then the system might sign a forged document no matter whether a password, a PIN or some biometrics is used protect the private key.

All smartcard, mobile phone or PDA based solutions are therefore more promising. In such a case the device does all the cryptography as well as the biometric matching. Ideally the device would also comprise the biometric reader. If the biometric measurements are not acquired by the signing device itself, the signing device must verify that the data were really captured by the authentic biometric sensor, otherwise the use of biometrics does not provide real security.

During the signing process the signing device signs the hash value only. The hash is calculated by the application that wishes to sign the document. There is always a possibility that the applications shows one document on the screen, but another document is used to calculate the hash. This hash value is then submitted to the signing device. The signing device typically has no chance to recognise this scenario and signs the supplied hash. The application (e.g., a Trojan horse) can use the signed hash to obtain a correctly signed document with a completely other content than the user approved on the screen. General purpose computers such as PCs are far from being immune to such Trojan horses and as the smartcards have no display to allow the user to see the content of the document being signed, this scenario stands for a serious threat to the very popular combination of a PC and a smartcard.

Instead of the smartcard a more capable and/or intelligent device can be used to sign the documents. Many current palmtops, mobile phones and PDAs are capable of displaying the document first and signing it after the verification of the user and her approval of the content. Although the variety of multimedia documents makes the situation more complicated the use of PDAs, mobile phones and palmtops is a practical option to the use of popular smartcards.

Privacy Aspects

The implementation of biometric technologies is seen by many as an attempt to collect Terabytes of data for intelligence purposes, thus creating a global surveillance infrastructure. In addition to the fact that the effectiveness of biometrics is highly debatable (at least for wide-scale implementations), privacy concerns become even more intense.

The problems from a privacy standpoint take two different perspectives. On one hand we see an excessive control from governments that now have an overabundance of information about their citizens. The ‘Trust me, I am from the government’ quote has not even been accompanied by appropriate legislation since the problems with data protection are many. On the other hand, systematic and systemic failure from government to ‘control’ that information or use it for intelligence purposes gives rise to many different suspicions. On various occasions such inabilities have severely jeopardised the privacy of individuals who may now become even more prone to identity theft or have their personal data exploited in hitherto unexpected ways.

This disproportional exercise of power will lie at the very core of emergent phenomena, resistance to change and reaction to excessive control . With biometrics, the balance is drastically shifted as those able to exercise power will be few in respect of those over whom power is exercised. Citizens’ privacy is put at a disadvantage and too much power now rests with government [DAV94]. People are constantly being categorised, profiled and monitored and their personal data become constantly jeopardised on an unprecedented scale.

Identity theft then becomes just another by-product of such implementations and it comes at a significant cost. According to the 2003 survey of the Federal Trade Commission in the US, over 27.3 million Americans have been victims of identity theft within a period of 5 years. Losses to businesses and financial institutions totalled nearly $48 billion . Numerous other examples point in the same direction; side-effects from economic losses to counter-productivity suggest the need to pause and think about implementation of identity management systems.

Another threat to privacy comes from the implementation of biometrics but in quite a different way. Border control and biometrics lead to massive data collection and storage. However, there are no guarantees that this increasing data collection for one purpose (i.e. processing by governments) is not something that will lead to the repurposing of data and in contradiction to all privacy laws. On the contrary, past experience shows that this has always been the case. Systems are rarely used for the exact pre-conceived applications that their designers had in mind. Users, whether individuals or governments, have always been innovative with the information they collected. Especially now that such information is constructed from an entity that can be endlessly replicated at zero cost, replication and re-purposing become a necessary evil. In the UK for instance, information about 1,500 households can be ‘obtained’ for £250 when the government sells information from the census to junk mailers . An interesting ‘innovation’ comes from Canada which refuses to make public servants’ electronic mail addresses available. Its government does not produce any electronic directories on CD-ROMs, instead it sells information to private firms who resell it in different formats to the public, including CD-ROM . Such examples should come as no surprise. Governments, too, are interested in finding ways to make profit. Even the US pillar of defence, the Pentagon, set up a company selling biochemical suits in the Middle-East through an internet company at a 90% discount; to everyone’s surprise this occurred after 9/11, defying a clear Pentagon policy and was uncovered after a special investigation by the US congress [DEM04]. It is all about supply and demand. The only difference is that with data it is much easier to supply. Privacy will suffer precisely because of this; as more and more data become available, centralised and easier to manipulate, privacy will become severely jeopardised.

A different facet of the privacy problems that biometrics will cause comes from a change in the scope of surveillance. Whereas in the past, border control was simply that, now with the adoption of biometrics the scope becomes totally different. The boundary is reset and besides border control, centralised databases and biometrics allow for the monitoring of movement [ALT03]. This is something new, intensifying privacy concerns and changing the nature of pursuing criminality. The ‘innocent until proven guilty’ assumption is replaced by the opposite notion of ‘guilty till proven innocent’ while biometrics reset the boundaries for surveillance with no evidence of wrongdoing (ibid).

Privacy laws are no less alarming. The US law on data protection covers only US citizens. What can one make of how privacy and data protection are considered when US citizens, in any case, do not fall within the scope of the US-VISIT program? Furthermore, there is no legal basis for the handling of data regarding its collection, sharing, retention, or use. The creation of centralised databases, coupled with the lack of legislation, will create an unchecked surveillance system. Profiling of individuals and their behaviour is only the beginning. Identity theft, data sharing, and so on, will be the unavoidable by-product.

Such attacks against privacy cannot go unheeded. Shielded by a legitimacy stemming from a moral position against terrorism, nation states have embarked on a domination of the individual. Nation states want to maintain their power, and in an age that is characterised by an increased mobility this means that technology has to be incorporated into the schema of collecting, processing, tracking and categorising information. To protect a carefully constructed heroic image, that of the individual helping towards the fight against terrorism and increased scrutiny of identity, governments are abrogating to themselves the right to invade the privacy of their citizens [ANG96]. We have to come to a realisation that new technology has changed many things; politics, economics and society. That change however is no simple, tidy transition. It is more a severe and total dislocation from the past [ANG00]. A wide-range implementation of biometrics is an experiment that may incur great cost for society as a whole, the economy and privacy. While the cost of compliance will explode and interoperability problems will mount, cutting expense, following the easy route and doing it fast will be an option that many countries will follow. Even space programs that have traditionally been enjoying proper preparation, management and funding are sometimes under funded, leading to disasters. The ambitious ‘Beagle 2’ project for Mars Exploration ended up a failure; both the European Space Agency and the UK government failed to monitor the project, address weaknesses, commit funds and prevent organisational failures . What makes us believe that biometrics will work out better?

The message is therefore simple. A wide-range implementation of biometrics will create a highly complex infrastructure. Such an infrastructure will allow for the unrestrained monitoring and profiling of individuals, thus constituting an immense attack against privacy. Potentially, exploitation of that infrastructure will bring with it identity theft on a grand scale for various purposes and an unchecked system of surveillance that again will impact greatly on privacy. Attacks on privacy however will come at a cost that might not be easily quantifiable. No doubt, functionalists who look for answers within technology will have a techno-savvy answer for everything. Special computing techniques, hardware controls and cryptographic systems will all be incorporated on the altar of securing the implementation of biometrics. What is not always understood is that quite often technology is the problem and not the solution. As long as technology is used by people then there will always be aspects that cannot be ‘controlled’ in the cause-and-effect sense. What has to be balanced in the case of biometrics is the potential risk for privacy and its impact. This section argues that there are very serious privacy concerns with systemic complications that should be taken into consideration.

Privacy criteria

International discussion about biometrics lead to a number of questions that can be used for the evaluation of biometrics towards privacy respecting. Main input for this discussion was generated from the Information and Privacy Commissioner of Ontario, Dr. Ann Cavoukian , [BÄU99], the Federal Privacy Commissioner of Australia, Malcolm Crompton , Roger Clarke , [CLA02] and R. Hes, T. F. M. Hooghiemstra and J. J. Borking [HES99]. Further work was done by the European Art. 29 Data Protection Working Party (WP29) resulting in a working documents on biometrics. The following questions to evaluate a biometric system with regard to privacy are developed from the results of this discussion:

Is the biometric system transparent and participation voluntary?

What personal information collected?

Are the biometric and personal data separately stored?

Is bodily privacy being protected (health information/behavioural traits)?

Is covert collection possible?

What data can be linked to “track” people?

Biometrics can be a universal and global unique identifier – are they linkable to a person easily and directly?

Where is the biometric data held?

What is the performance – FAR & FRR?

How is it secured?

What accountability, transparency, and audit arrangements, are in place?

Approaches to privacy-respecting biometrics

Directive 95/46/EC constitutes the general legal framework for the processing of personal data. As stated above, the term “personal data” is defined as meaning “any information relating to an identified or identifiable natural person (…); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental (…) identity”.

Directive 95/46/EC does not mention biometric data as such. However, as biometric data relates in most cases to an identified or identifiable person, it is generally considered that the provisions of the Directive 95/46/EC apply to the processing of biometric data .

For the purposes of this report, the general principles and guidelines will not be discussed. It is assumed that data protection principles are generally known. Specific guidelines for the processing of biometric data have been provided in August 2003 by the Art. 29 Data Protection Working Party (WP29) established by Directive 95/46/EC in a working document on biometrics.

Some national Data Protection Authorities of EU member states, including those of France , Spain, the Netherlands, Germany, Italy and Greece, have also issued opinions on the use of biometric systems in given situations . The recommendations of WP29 which are specific for the use and processing of biometric data in general are summarised hereunder. In addition to the general data protection principles, a biometric system shall take these additional requirements and recommendations into account. The controller of a data processing is in principle responsible and liable for the obligations imposed by the Directive and the national data protection laws.

First of all, ‘raw’ biometric data should not be stored . Raw biometric data may reveal information about a person’s health or race. This information is from a data protection legislation point of view, sensitive information. In addition, this information is in principle not necessary for the verification or identification purposes of the biometric application. Templates, however, may not reveal this information about a person’s health or race. Therefore, and based upon the principle of proportionality, it is generally recommended not to store the raw biometric data, but only the templates. It is clear that the security measures for the database with the raw biometric data, if any, and if required for the envisaged purposes and obtained upon a valid legal ground, shall be of the highest level .

Furthermore, one should take into account that in most systems biometric templates are personal data . WP29 states that while ‘measures of biometric identification or their digital translation in a template form (are) in most cases (…) personal data’, ‘in cases where biometric data, like a template, are stored in a way that no reasonable means can be used by the controller or by any other person to identify the data subject, those data should not be qualified as personal data’ . The question remains what should be considered ‘reasonable means’ in the current state of practice and the evolving techniques of identification. To the extent that a database would use only the digital templates of e.g. voice or fingerprint, or the digital templates of the 2D or 3D picture of the face, without a name, and without any reference, one should examine to what extent the available techniques would permit reconstructing a full image (e.g., of the voice, fingerprint or face) from the templates or to what extent the available techniques would enable the comparison of the biometric templates with existing templates combined with personal data or other personal data held in other databases. If the answer to one of these possibilities were yes, one might conclude that the persons could indeed be identified, directly or indirectly, and that the data contained in the biometric template are personal data to which the data protection rules apply. If the answer were no, one should indeed conclude, in conformity with the definition in the Directive 95/46/EC, that these biometric data are not personal data. One has to conclude, though, that there is presently still some discussion going on about when and under which conditions templates should be considered personal data (e.g., when is the effort unreasonable) and what different criteria could be used .

The template should also preclude processing of data that is not necessary based upon the principle that the processing of personal data should be proportional and not excessive. Biometric data often contain more information than necessary for the identification or the verification functions of the biometric system. The WP29 therefore recommends that the templates should technically be constructed in a way to preclude the processing of data that are not necessary. Unnecessary data should be destroyed as soon as possible.

Furthermore, central storage of biometric data is to be avoided if the identification/verification applications can be carried out without, based upon the principle that the processing should be proportional and not excessive . This means that biometric systems to be developed should be designed in such a way that excessive identification techniques are avoided. Such excessive identification may take place if the biometrics are stored in a central database rather than in an object exclusively available to the user, e.g. a microchip card (smart card), if possible. There are many reasons for this aversion of central storage. Users have no control anymore over their biometric data if it is stored in a central database. In addition, the more data stored in a central database, the more public and private institutions will attempt to gain access to these data for their purposes. Furthermore, if the data are stored in a central database, users do not have knowledge when their data is evaluated or used. Therefore, users have in principle more control over their data if the biometric data are stored locally, e.g. on a card in their possession and the user him/herself has to submit the card to the system knowingly and willingly .

Furthermore, one should avoid the use of a unique identifier by the manipulation of templates. The Directive states that the Member States shall determine the conditions under which an ‘identifier of general application’ may be processed (article 8.7 of the Directive). Fingerprints could in principle be considered as an ‘identifier of general application’. Other biometric data could also serve as such. As stated above, data subjects should in principle retain control over their personal data. In addition, they should be able to object to the processing of their data. For this reason, WP29 finds it desirable to avoid as much as possible that biometric data could be used as a unique identifier to link databases containing personal data. It this view, it is for example recommended that templates and their digital representations are processed with mathematical manipulations (encryption, etc.) with different parameters for every biometric product or system. This should avoid the combination of personal data from several databases through the comparison of templates.

One should also segregate the biometric information from other personal data. Biometric templates shall be secured and encrypted during enrolment and storage. In addition, each controller shall review whether it is necessary to attach in the same database system other individual information (such as e.g., a name, an address, an id-number, …) to the encrypted templates, by which it is directly clear (upon decryption) to whom the encrypted biometric templates belong. If individual information is required, though, any additional individual information directly linked to the biometric data should be avoided if this is not necessary for the purposes of the processing. In order to enhance security, it is therefore strongly recommended to also use encoded data, i.e. biometric data with a reference code instead of the name of the individual and to store the name of the individual and the corresponding code in a separate place, even by a separate authority/company, if possible. Please note that encoded data is also considered to be personal data as long as identification of the data subject remains possible. Only data which is absolutely anonymous does not fall within the scope of the Directive (the identity of the person behind the data cannot be traced back since, e.g., the encrypting code was destroyed).

The controller of personal data shall take all appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access. This applies in particular where the processing involves the processing of biometric data. Integrity and confidentiality are of utmost importance to any biometric application. In addition, special attention shall be given in case of the transmission of biometric data over a network, whether private or public networks. If biometric data are sent over the Internet, the highest security measures shall be taken. The security measures should be designed right from the start. It should be part of a formal process and should result in what is commonly designated as the ‘security architecture’ of the system. Several organisations are developing international standards which are relevant for the security of biometric systems . The elements of such security architecture shall include authentication, access control, data confidentiality, data integrity and non-repudiation. The security measures shall be implemented from the beginning of the processing of the personal data, as of the phase of ‘enrolment’ by the data subjects. In addition to the ‘usual’ security architecture, a biometric system requires enhanced security measures in order to minimise the risks and to guarantee privacy to a maximum extent possible. For example, in the BioSec project, in order to prevent replay attacks, it is advised that key generation will be done for each session with random or pseudo-random numbers by both the host and the smart card/token and that in order to avoid token or host emulation, mutual authentication of both the host and token will be used. Furthermore, also in BioSec, the transfer of the individual’s template to the smart card/token in the enrolment phase shall be done exclusively in a controlled environment.

In addition to the design of an overall ‘security architecture’ (see above), biometric systems require the design and development of a so-called ‘privacy architecture’ . The aim of the ‘privacy architecture’ is to minimise the impact of the biometric system upon the privacy of the data subjects. Above are some requirements and recommendations in order to enhance the privacy of the data subjects upon the processing of their personal data. These requirements and recommendations take the special nature and privacy concerns of biometric data into account. In addition to ‘privacy architecture’, some authors plead upon the design of each new biometric system for a ‘Privacy Impact Assessment’ (PIA) for the identification of the privacy risks . Such PIA should be understood as an analysis of the system as how is dealt with the risks of the biometric data, taking the applicable legislation, recommendations and good practices into account. The ‘privacy architecture’ and the ‘privacy impact assessment’ should interact and accept input from each other.

Current Privacy Research Applied to Biometrics

The International Biometric Group & BioPrivacy

The International Biometric Group (IBG) is an independent biometric research, consulting and technology solutions firm based in the United States . IBG advises government and corporate clients in the effective use of biometrics. IBG’s BioPrivacy Initiative defines best practices as well as deployment and technology guidelines for maintenance of personal and informational privacy in biometric deployments. IBG’s BioPrivacy Initiative uses three evaluative tools to ensure that new or existing biometric deployments are consistent with generally accepted privacy principles:

BioPrivacy Application Impact Framework: it is a tool for evaluating the potential risks of a specific biometric deployment. It defines ten factors critical to identifying potential privacy risks within a biometric application, e.g., if the biometric data are stored in a database, there is a greater risk of privacy invasiveness.

BioPrivacy Technology Risk Ratings: a technology-by-technology assessment of potential privacy risks. E.g., facial scan and finger scan rate as a significant privacy risk because these technologies are capable of operating without user knowledge or consent.

BioPrivacy Best Practices: a list of 25 key precautions which institutions can take to ensure privacy-sympathetic biometric deployments. E.g., original biometric data should not be stored other than for the initial purposes of generating a template.

Although IBG takes into account many concerns which could be raised from a privacy point of view, following up all of the recommendations will not necessarily result in a fully privacy compliant biometric system in accordance with the Directive 95/EC/46. The data protection section of the best practices, e.g., does not make reference to the necessity of a legal basis for the processing of the data or the requirement of proportionality of the processed biometric data, a key element in the European data protection regime.

BioSec is a two-year Integrated Project within the FP6 IST programme which researches towards answers for the (i) unsatisfactory performance of certain biometric methods, in particular the combining of several biometric characteristics for verification/identification purposes, (ii) incompatibility of components, subsystems, biometric data, usage procedures and performance metrics due to lacking standards, (iii) insufficient technological solutions for assuring privacy and ownership of user’s biometric data, and (iv) poor usability as well as problems with general acceptability. The research of BioSec should hence lead to improved performance (i) of novel 3D face and hand method, noise-cancellation based voice verification methods, with emphasis on multimodal biometrics, including face-voice and iris-finger, (ii) towards integration of the different components of a biometric system, including by developing a specific BioSecAPI, (iii) of fake-resistive methods for high security and token-based solutions for enhanced privacy in sensitive applications, and (iv) additional studies on usability and general acceptability. The BioSec consortium also endeavours to actively contribute to the development of biometric standards.

Biometrics as one Aspect of PRIME

The PRIME project (standing for Privacy and Identity Management for Europe) focuses on solutions for trustworthy, user controlled identity management. As such, the use of biometric technologies is investigated in the context of PRIME.

PRIME is basing its research on a search for solutions to a set of well-defined application scenarios. Some scenarios are subject to the development of application prototypes, such as the Air Transport and Security Controls scenario. For simplifying air transport processes and enhancing the airport security, recent technologies such as biometrics are currently investigated. The Airport Transport and Security Controls scenario is related to ambient intelligence, where biometrics can be used to collect and store personal information about trusted or registered travellers.

This scenario foresees the extensive use of biometrics technologies for the purposes of secure identification of airline passengers: an application would be to identify those travellers which belong to the group of “trusted passengers”. Another application would be to support and enhance the current “customer card” or “credit card” function in the future “paperless” travel environment to make sure for instance that the physical person collecting a boarding card is the same as the card holder.

In the traveller scheme called “trusted traveller”, along with customer data and possibly, but not necessarily passport data, the user agrees to give biometric information in order to gain quick access to the check-in and to boarding processes. The main idea of the scenario is to have a user permanently registered by an airline to allow him to be handled more efficiently during the processes involved in air transportation. The condition of being a “trusted person” is verified at enrolment by adequate checks. Here biometrics will be used in the departure process to verify whether the ticket holder is identical to the person for which the ticket has been issued, and to check whether the ticket holder may be accepted for transportation (in the case that he is identified as a “trusted traveller”) or whether he should be referred to a security authority for further verifications. One issue which is particularly important from the data protection point of view is the form of storage of users’ templates, which – depending on the application at issue – can be in the memory of a biometric device, in a central database or in plastic cards, optical cards or smart cards. The latter form enables users to carry their templates with them as identification devices and is currently privileged through Europe.

Viewed from a certain angle, the use of biometric systems might be considered as a privacy-enhancing technology, in so far as it contributes to the reduction of the processing of other personal data like the name, address or a unique identifier of an individual. Biometrics could even serve as a solid basis for safe anonymous and pseudonymous transactions. To this end, the use of anonymous or pseudonymous data should be possible, at least in certain circumstances. Also, it is essential to set up mechanisms to deal with the problems resulting from lost, stolen or damaged tokens (cards). However, those solutions not resulting in centralised storage of biometric data should be promoted.

Privacy-friendly implementation of biometrics

As previously discussed, neither the measurement of biometric data nor the comparison with a stored reference template should be done outside a highly protected and user-controlled infrastructure. There is no good reason to measure, store or compare biometric data in a centralised architecture. It is sufficient that the biometric measurement is processed in a protected and certified way and that the result of the biometric identity verification is transmitted securely to the IMS. The storage of a biometric reference template, the measurement and the comparison process should be under the control of the user (but protected against manipulations of the user) and then be linked in a secure way to a digital credential that does not disclose any biometric information.

First attempts in such a direction are achieved with biometric reference templates on smart cards carried by the user or even cards with match-on-card functions. But a real secure and privacy protecting implementation of a biometric authentication puts all biometric data handling, including the measurement process, into the user’s hands. Given below are two commercial examples of such a system.

In the AXSionics AXS-Card system, the critical step of converting a users’ biometric information into digital credentials is done “close to the user”, and requires only 1-to-1 matching (i.e. does this finger match the authorised owner’s?). In addition, the measurement process can be adapted to the individual quality of the biometric features the person has. Once this is done, it is easy to process the digital credentials against a large central database with minimal computing power and data storage required. In addition, individualised biometric processing raises the usability and the user acceptance, and as the user becomes accustom to their biometric device the false rejection rate drops.

A similar device is offered by ProSection, a Swedish company which offers encryption services for fingerprints where user privacy of this biometric characteristic is preserved. The company uses so-called correlation-preserving encryption tools such that the original fingerprint features are immediately encrypted during enrolment and not stored as raw data. During use, the correlation is compared between the newly submitted and encrypted biometric data and the previously stored and encrypted data. The solution is privacy friendly as there is no need to store the original fingerprint, and the encrypted original fingerprint features cannot be decrypted or recreated again. The solution is different from other encryption services as the encryption preserves correlation since the encrypted templates can be compared and a 100 % match between encrypted templates can be realised.

Biometric Credentials

Access control often relies on authentication. At first a form of authentication takes place and then proper access rights are looked up and granted. The identity of the user can but does not have to be known. Sometimes at first the identity of the user is determined (and verified) and then user rights are based on such known identity of the user. Access rights can also be set pseudonymous or anonymous. For example a shared folder can be protected by a password: anyone who is successfully authenticated by a password obtains relevant access rights.

Access rights can be also stored in the form of credentials. The user supplied credentials are checked and the access is possibly granted. For example the user presents his/her one day ski pass , the ski pass serial number is looked up in a database and if it is found then the user is granted access to the ski lift. The identity of the skier is not known in this case. Such a ski pass could be used/misused by several people and the system would not be able not stop such a behaviour. We could try to require a password to authenticate the skier. The password would limit the misuse by a random finder but would not stop passing the ski pass deliberately to a friend. Therefore multiple-day ski passes are typically bound to an identity of the skier containing for example a photograph, the name and the birthday of the skier. Then the identity of the skier can be (randomly) checked as an additional security measure.

By using biometric authentication we can omit the use of other personal data. If we add a biometric template (e.g. an IrisCode) to the credentials (in our case to the serial number of the ski pass and then we digitally sign this link) then the skier could be verified automatically by the biometric system. No misuse of the ski pass (either deliberate or unintentional) would be possible and still no other personal data is necessary. Moreover the biometric matching can be completely automated and there is no need of the staff to get into contact with the biometric template (or any other personal data).

This could be a privacy-enhancing scenario as no data other than biometric template is necessary. On the other side biometric data are important personal data (possibly even sensitive personal data) and can be used to uniquely identify a person. Therefore credentials containing biometric data can in no way be considered anonymous. Some sources claim [e.g. BioVision] that templates that cannot be used for reconstruction of the original data can be seen as pseudonymous data. This could be, however, problematic as the primary purpose of any biometric template is the unique identification of a person.

Whether to include biometric data in credentials to facilitate the access control or not is a question that depends on the application. There can be situation where this is desirable improvement and in many other cases this will not be a help.

Case Study: Secure Storage Biometric Smart Cards

Biometrics is a key technology capable of providing non-repudiable authentication by positively linking a biometrics template collected at the enrolment time with live biometrics collected from the user. Two-form factor identification is more secure than a single biometrics-based access control (see section 4.1). The possession of a certified card such as a smart card, a form of reliable and secure storage, is the obvious choice. The form factor is not only very convenient for carrying around, but the on-card generation and storage of cryptographic keys enhance both security and privacy capabilities. The most common form of synergy between smart card and biometrics exists in the form of the biometrics templates stored securely in the smart card at the time of enrolment where, during the process of authentication, the template is read back securely into the application. Even though this method is more secure than template storage on a secondary medium and does not involve any communication between the client and a server avoiding network traffic, the biometrics matcher can be still a security risk (see section 4.3.1 and [KOC99]). Recently, a different kind of problem has also emerged.

Smart card systems to date have largely not been interoperable because applications have been built into a proprietary card and terminal operating systems. A series of open industry standards have been developed to address this problem, e.g., Java Card and Global Platform . The introduction of open standard smart card technology has allowed users to gain independence in choosing both smart card and terminal vendors thus allowing them to move away from inflexible and closed proprietary systems. This standardisation has already translated into significantly increased innovation and lower smart card system costs.

There has recently been considerable interest in providing a synthesis of current smart card open standard development with respect to biometric applications. A fingerprint-based application for access control utilising a match-on-card implementation using the recent JavaCard-BioAPI standard is briefly described below.

Java card and the JC-BioAPI

A general purpose smart card, including the Java Card, can be used as a secure storage subsystem for the biometric template. Typically, the biometric templates are generated on a secure client and stored on the card at the time of enrolment. During the process of authentication, the smart card needs to be presented and the application process first ensures that the card can be opened by the process of providing the verification code. Traditionally, the two main constraints impacting this type of application have been the amount of storage available [CAP01] for biometric templates and the speed at which these templates may be read from the card. However, technological developments now mean that these constraints are increasingly becoming less of an issue. However, this type of conventional, storage only option of the smart card has a security deficit in that the personal biometric templates leave the card and are outside of the secure environment of the smart card for the template matching operation. In order to improve the overall security and privacy of the system, the biometric matching should occur on the smart card and the final result cryptographically signed before being passed up to the higher level application. The on-card match function is thus particularly useful in terms of its addition to the overall security of the system. However, any such biometric matching algorithm will face significant constraints in the restricted resource environment that smart cards generally have. The matcher subsystem must use only limited amounts of dynamic memory and use as few computational cycles as possible. Typically the biometric feature extraction is never a candidate for implementation on a smart card because it involves complex signal processing operations that need to be performed in a relatively short amount of time.

In response to the above requirements and recognising the need for application level biometric interoperability on the smart card platform, the Java Card Forum has proposed a Java Card Biometric API. This API addresses the requirement for the secure enrolment of a reference biometric on the java card with the ability to later perform a candidate biometric validation in such a way that the reference data is never exposed outside of the card. The standard has recognised the variety of biometric enrolment and matching algorithms that are both currently in use and being developed by industry. The result is a simple and compact API that supports multiple biometrics on a single card in such a way that application clients and biometric technology may be independently developed.

Figure 4‑4.16: Match-on-card architecture

The JC BioAPI is modelled on the Java Card PIN API and has a separate interface for matching and for enrolling. The architecture uses IBM’s Java Card Open Platform (JCOP) card with an ISO-14443 interface for non-contact readout of the templates.

Figure 4-4.16 shows the architecture of a typical Java Card BioAPI compliant application, which is divided into a server applet and a client applet. The server applet has management functionality which includes biometric enrolment, retry configuration and the provision of shareable interfaces through which one or more client applications can access biometric functionality such as query and match.

When the server applet is instantiated, it creates an instance of a BioTemplate for fingerprints and an instance of a BioTemplate for passwords. The password BioTemplate was included by the Java Card Forum in order to provide a common interface for using passwords either in a complementary fashion or as an alternative.

Broader Social, Political and Economic Implications

Usually, new technologies are entering the market in competition with established technologies – the better solution is expected to win. The market of biometrics and at least in some countries of electronic signatures as well is underlying regulatory approaches. By order of governments, large and complex systems, e.g. the European passport using biometrics, are going to be introduced in a very short time. This chapter discusses the imbalances resulting from the introduction of such systems from a broader socio-economic perspective targeting at current political argument used to introduce them.

There is absolutely no telling where such implementations of wide-scale systems, such as ID documents using biometrics, in a very short time will lead us. Potential technological failures along with a legislative havoc create a complex system that cannot be conventionally controlled (if at all). Chances are that society will eventually react as freedom of information, privacy, online free speech and security of communications are likely to face further restrictions. Reactions might occur in the most subtle ways and some might come from within the system that supports these changes. Some ‘solutions’ will simply not be accepted, others will be too costly to implement, and so on.

Despite such concerns, governments around the globe are heavily influenced from a broader discourse on fighting terrorism. Had it not been for such a discourse, it is highly unlikely that such forceful changes would have been put forward over such a short period of time with little or no consideration for interoperability and security issues. Various examples demonstrate such changes. France has expanded police powers to search private property without a warrant, Germany has loosened its restrictions on monitoring e-mails, phone tapping and bank records, whereas Australia introduced a terrorist law to intercept e-mail [DAV02]. Too much information is collected, government becomes too powerful, and still, effectiveness in fighting terrorism is not improving. In his statement to the US Senate, the Assistant Director of the FBI explained in 2000 why they were using the Carnivor Diagnostic Tool to intercept communications and he brought up examples from terrorism, including Al Qa’ida, well before 9/11 . The system was obviously one more intelligence failure while for a period of two years, FBI and Internet Service Providers (ISPs) co-operated closely for intercepting communications through the Carnivore technology.

Such failures have an underlying reason: complexity. Complexity means that at any given point there are so many sub-systems within a broader domain that it is impossible to monitor all the interactions that take place at the same time . The interconnectedness of several sub-systems is such that the interactions explode in number. This brings systemic complexity and emergent properties at the front stage of attention for emergent problems.

Complexity however at a global scale is something that does not seem to trouble governments and therein lays an additional problem. Initiatives from an international level have fostered the belief that their own initiatives will enjoy a neat hierarchical diffusion at national contexts. This is merely a fallacy that will manifest itself from differences in legislation to national contexts, to interoperability issues between different vendors, security related problems and political agendas. Complex systems simply do not work like that; they overlap, interact and co-evolve [ANG05].The ideal of a neat hierarchical diffusion is how governments perceive the implementation of their decisions. Reality is far removed from this ideal representation and our concern lies on those emergent and unplanned consequences that may have a myriad of adverse results. Furthermore, the more broad-scale the implementations of a technology, the more difficult it becomes to plan thoroughly the system’s uses. Of course, political agendas, adverse results, opportunism by different stakeholders and resistance to change will also find their way in this new governmental venture concerning biometrics. Tension between the United States and the European Union is already becoming evident concerning the implementation of biometrics. With the US deciding that all passports after October 2005 should include a biometric chip, the EU wants the deadline extended to August 2006 in order to ponder the important security and interoperability issues . If not, there are two distinct options. The first option would rush the EU towards an implementation of biometrics without addressing crucial issues and the second option would miss the deadline thus rendering millions of EU citizens no longer eligible for the American visa waiver programme. The EU then would most likely place similar restrictions and transatlantic travellers are likely to face the music of biometric hurdles (ibid).

Different stakeholders will also put forth their own interpretation and interests concerning biometrics. Some designers and engineers may be thinking about security, privacy and non-linkability to an extent that the technological artefacts they build (i.e. biometric devices) would incorporate these elements. At the same time, governments are thinking about profiling, traceability, accountability, preserving and expanding their control. One compromises the other.

In addition to the aforementioned elements there are national and international cultural considerations that have to be made. Reactions to such technologies will vary and some will consider biometrics invasive.

Biometrics as a Solution to What?

Sometimes we easily forget that some practices have become institutionalised and institutionalisation itself is a forceful process that can be very constricting. New practices can become infused with values that go beyond the technical requirements of the task at hand. As a technological innovation spreads, a threshold is reached beyond which the adoption of a certain technology provides legitimacy rather than improved performance. What constitutes an improvement is also something that needs further consideration [MID03].

Biometrics provides an example. The technology has been around for quite a few years but its widespread and large-scale adoption only came about after an initiative from the US Department of Homeland Security, set up after the September 11 terrorist attacks. Not surprisingly, the move started from suggesting that using biometrics in aircraft cockpits would verify that the person about to fly the craft was the bona fide pilot . Legitimacy was sought through the adoption of biometrics in order to recover from – what now appears to be – a series of intelligence failures . This comes as no surprise at all. Individuals, groups, organisations or even countries will often adopt technologies to justify their cause of pursuing further efficiency and effectiveness. Whether such adoption does enhance the perceived efficiency of a target domain is unclear. What is clear though is that biometric technologies are seen as a solution to the problem of security, whereas in fact they address the problem of identity.

Claiming to solve the problem of identity has nothing to do with enhancing security and there has to be a clear separation of the two. Even though biometrics are introduced for application to the middle ground of security and identity issues, there is no evidence that this separation is taking place. All the hijackers of the 9/11 attacks had valid passports and were not on lists of potential terrorists. The terrorists of the future will no doubt have valid biometrics; the only actual change will be in the mode of establishing identity. But terrorists who are willing to die do not care less about that; most will never reach the point where their identity will be checked against a stored template and, in any case, they would be happy to go through the process (especially if it is to become faster and more ‘reliable’ ). Another danger is also clear. Belief in the technology per se, might lead to less scrutiny. Trivial as this may seem to some, the projected association between security and identity is at the very core of arousing privacy concerns and arousing suspicions about the creation of a global surveillance infrastructure; indeed it already exists - but is constantly becoming ever more pervasive.

Another problem is the association between information and intelligence. It was well put by a US security consultancy founder:

“Since 9-11 there have been extraordinary pushes to collect information on US and foreign citizens… But the problem is not that we do not have enough information, it is that we do not have enough intelligence. All you end up getting are more pictures and prints”

This move is seen as part of a wider trend within the US to gather huge amounts of information in an effort to gather intelligence. Again, one issue does not necessarily correspond with the other and it can have other unforeseen consequences as well (like for instance making the US a less attractive destination for tourists). Biometrics in this case serves as the means to digitise information concerning identity but how that information might affect intelligence or give rise to unintended consequences remains uncertain. Perhaps not surprisingly, in an era that is characterised as the ‘information-age’, solutions are being sought within the technological sphere. But sometimes, the cure can indeed be worse than the disease.

Collecting massive amounts of information however has an underlying logic despite our inability to analyse effectively all of it; that of creating a ‘Panopticon’ that acts as a state of continuous ‘visibility’ . This is associated with the idea of surveillance that is powerful even if it’s not actually present or not that powerful at all. In the case, however, of digitised information that is stored in centralised databases, there is a real risk, that of creating an infrastructure that will give rise to a further range of phenomena starting from identity theft to who knows what. We should always have in mind that surveillance works both ways with some interesting reactions from both sides .

Following the short analysis of this sub-section it is worth pondering the question of whether biometrics is really the solution it is famed to be. Emerging problems are hardly taken into consideration – by definition, they cannot be – but the question is what are the potential cost we might suffer and should we proceed to wide scale implementations of such technology? Apart from all security related issues, identity theft and the like, all their implementation might achieve is merely to intensify illegal entry to a country by alternative means.

Additionally, quite often technology solves the wrong problem and what is measured or computerised is irrelevant. The only reason that this occurs is because we have the means to do it, and only ritual makes it important. There is nothing inherently divine or efficient in technology and the power of the ritual should thus not be underestimated. The same stands for biometrics. We now have the means to adopt them but a widespread implementation may be the source for a myriad of emergent problems and unforeseen consequences. Once biometrics’ vendors have become institutionalised and the market has increased, so has the forceful diffusion of the plasmatic ideal that biometrics can help enhance security. This has constantly been projected by such vendors, something that has had its share of impact on how biometrics are viewed. Good-timing in an era where security is considered crucial has of course helped a lot.

The problem though is that every technology implementation optimises a system to a niche and when that niche becomes obsolete or fails, so does the system that is supported by it. Technology is not the solution to confront social, political or economic turmoil; sometimes it is quite the other way round with technology creating the problems (like the recent example between the US and the EU in biometrics). But as governments face uncertainty they produce a knee-jerk response. They adopt technology in order to impose tidiness on their world but surprisingly fail to understand that uncertainty does not conform to a neat computational logic [ANG00]. This comes as no surprise. Humanity has always been arrogant and obsessed with control; control of our lives, the environment, the society, the economy and eventually everything. Technology (in one form or another) has always been part of that control. There is however one thing that most technological systems enjoy in common: occasional failure; sometimes that failure is acceptable, some other times it goes by unnoticed and some others it can be disastrous.

A Social, Political and Economic Outlook

Even though there might be considerable improvements in the technology itself there are clear concerns on the social, political and economic sphere. Privacy issues are considerably alarming and associated with potential breaches in security.

From a social perspective, resistance to change to an unfamiliar technology could manifest itself in various ways and inconvenience designers, users, and other stakeholders or systems. The more resistance to change to such implementations - for whatever reasons (i.e. privacy) - the more likely the attacks on new systems become and the more prone they will be to compromises or security breaches. Systems of such complexity and infrastructural interconnectedness must be deployed with great caution. From this perspective it is vital that additional research is carried out with the aim of examining the acceptability of such technologies at respective national levels and documenting clear contextual factors that are associated with cultural and broader social aspects that might be crucial for the acceptability of such systems; a fundamental element indeed for their success. Such contextual factors for the acceptability of these technologies will also be vital for the coordination of national stakeholders who will be responsible for their national implementation and for attending to several aspects of their deployment like training, public information, etc. It must not be assumed that a one-size-fits-all approach can be followed in the scenario of biometric implementation. Certainly, technological implementation will target such an approach for interoperability reasons but the societal fabric does not conform to the same rules (and still affects all other domains, including technology). Technological approaches are formulated by scientists and engineers but technologies of this type will be used by a population with different demographics, ideas, education and acceptance to the technology itself.

Technology must not be deployed for the sake of it. The US with the SSN number provides a classical example of how a centralised database has given rise to identity theft reaching $48 billion in economic losses over a 5-year period. Re-purposing of data will also be very hard to control once a technological platform of such scope will be in place, something that will systemically have a societal impact of unforeseen consequences.

Information currently provided to the public is not balanced and lacks considerable warnings concerning privacy issues or fails to document how privacy concerns will be handled.

From a political perspective it is worth noting that several countries might be facing constraints on travelling due to another country’s requirements. Such political tensions have only recently become evident where the deployment of biometric-enhanced passports has been delayed in Europe and the US has had to tweak its own passport requirements in order to avoid such a tension (for the VISA-waiver countries). In an era of increased mobility, political tensions of such a nature must be considered internationally as they have their own impact on business, economy, travel and a myriad of other activities.

From an economic perspective there has to be a very clear differentiation between the price of implementation and the cost of such technologies. Most governments (like the one in the UK) talk only about the cost of the technological infrastructure, marketing, training and a few other aspects. Whereas the cost might conform to approximate calculations, the price might accrue dramatically. In such a scenario the economy must be portrayed as a system that interacts with both the social and the political domain. This renders the differentiation between price and cost vital. More research is therefore required to establish the interaction of such systems pertaining to the implementation of biometric technologies and to consider the potential implications of their deployment to other fabrics of the socio-political sphere which in their own turn will affect the economy. Especially in countries where the implementation of biometrics in ID-documents is an opportunity for e-government services or for cooperation between public and private sector, there needs to be more research on how such an implementation will reframe the economic and commercial national and international relations.

Summary and Conclusions

From the technological perspective biometrics is a promising enrichment for the factors or channels of authentication. In chapter 4.1 basic terms and established categories of biometric methods were introduced. Five passive (physiological) and two active (behavioural) methods which demonstrate current state-of-the-art techniques were described and investigated with respect to technical strengths and weaknesses as well as privacy aspects. In contrast to the situation two years ago, biometrics are now tested with higher enrolment numbers under operative conditions. Notably there is a gap between high quality of biometrics under laboratory conditions and the limitations observed under practical implementation.

In addition to active and passive biometrics, soft biometrics have been discussed with respect to their current area of application. Currently they are not used for authentication and verification, but have found applications for statistical purposes e.g., the assignment of an individual to a specific group such as an ethnic group (see FIDIS Deliverable 7.2 for further information on group profiling).

From a technological and economic perspective all biometric methods used today for authentication and verification depend on the following factors:

Quality (low False Acceptance Rates, secure systems with e.g. high tamper resistance and compliance to the privacy criteria of the European Art. 29 Data Protection Working Party (WP 29))

Convenience (easy and quick enrolment, use and maintenance, low False Rejection Rate)

Costs of the infrastructure

In this study technological weaknesses with respect to quality and convenience of the methods were analysed. Many of these methods cannot be used by all people, for example iris recognition (e.g. people with aniridia) or genetic fingerprinting (e.g. monozygotic twins). In addition some methods cannot be used in certain environments. This applies to for example fingerprinting (people doing hard labour may have severely worn papillary structures) or face recognition (light conditions are vital for the quality of this method). For these cases alternative methods are needed when used for authentication or verification. Active biometrics is currently not as reliable as passive biometrics. Perhaps the most notable aspect of biometrics is the connection between quality (in this case FAR) and convenience (in this case FRR) – it is not possible to optimise both factors at the same time due to the inherent connection between them.

Based on an international discussion on biometrics raised in the late 1990s and the work of the European WP 29, privacy criteria for the use of biometrics have been developed and, at least on the European level, well agreed. Implementation of these criteria seems to be possible, in principle, with all of the investigated methods though in some cases it may significantly raise the costs and complexity of the method. Chapter 4.3 describes a number of current initiatives, projects and available systems regarding the actual implementation of these criteria.

Many questions with respect to implementation of privacy criteria are still open from the perspective of currently available solutions. In some cases it is not known if privacy-critical information e.g., concerning health, can be extracted from templates. This is notably not thoroughly investigated in areas where numerous different algorithms are used to generate templates, e.g. for face recognition. Further research is necessary in this area, however it is expected that this will not be driven by the economic sector due to the lack of economic interest. Most data available today is published by researchers in the public sector (universities and public institutes). But trade secrets and restricted support applied to some of these systems and the underlying algorithms, e.g. face recognition, seem to be an obstacle for efficient research in the public sector [BSI03].

Summing up those factors we can characterise biometrics by a “magic triangle” (Figure 4-4.17) deriving from a model originally established for project management. This magic triangle is defined through (1) quality, (2) convenience and (3) costs. At least currently it is impossible to optimise all of these factors at the same time – implementations of biometrics seems to be always a compromise with focus on one, at best two of these factors while the remaining factor or factors show significant weaknesses. Most notably, even when optimised with respect to quality, today’s available biometric systems are simply unsuitable for access control solutions with high security requirements.

Figure 4‑4.17: Magic triangle of biometrics

In general we observe a far reaching international standardisation of methods and data formats for biometrics which are used for forensic purposes. This applies especially to fingerprinting and genetic fingerprinting. Other biometric methods suffer from the lack of standardisation; e.g., face recognition and hand geometry. In accordance to the privacy criteria described by the European WP 29, biometrics which offer no common templates for the area of application e.g., international authentication of persons, should not be used. In addition some algorithms and resulting template formats are subject to patents or copyright which will have an influence on the standardisation process. The case study on secure storage of biometric data on smart cards in chapter 4.4 shows some of the current research and development with respect to standardisation in the area of authentication technologies using biometrics.

Chapter 4 continues with a broader view on social, economic and political implications of the planned introduction of biometrics, e.g. in ID documents such as passports (chapter 4.5). The complexity, the total costs of the introduction of biometrics in large scale projects and the implications on society seem to be underestimated today. More research is therefore required to establish the interaction of such systems pertaining to the implementation of biometric technologies and to consider the potential implications of their deployment to other fabrics of the socio-political sphere which in their own turn will affect the economy. Especially in countries where the implementation of biometrics in ID documents is an opportunity for e-government services or for cooperation between public and private sector, there needs to be more research on how such an implementation will reframe the economic and commercial national and international relations. These aspects will be part of FIDIS Deliverable 3.7 “Study on ID documents”.

Examining current development of biometric techniques themselves, further improvements in the near future are expected. Technological trends will include:

Improvement of sensors e.g. for taking images or aliveness detection

Improvements in algorithms to generate templates

Developments in methods used to discriminate acceptance from rejection

This will result in improved quality, especially in the accuracy, and hence security of biometric solutions. In addition, further integration of systems e.g., bio-chips for genetic fingerprinting, will lead to improvements of functionality and further areas of application of biometrics. However, it seems likely that implementations of biometric systems will remain a compromise between several factors, and limitations of enrolment and application of certain biometrics to specific groups will remain.

Enhancing PKIs using Biometrics

Biometrics can offer significant enhancements to the PKI model and has lead to important improvements in the traditional user authentication area. The co-operation of these technologies brings a lot of promises to the area of secure data exchange and general encryption. A simple example concerns the restriction of the use of a person’s private key used for encryption and decryption. The information needed for the certificate could be based on biometric information. A biometric can be linked to a local or network file encryption in a way that it can ensure the exclusive use of the file by the person who encrypted it.

The BEE Recommendations (IST-20078 BEE) and BioVision

In the discussion whether biometrics could enhance PKIs, one should make a distinction between (1) the use of biometrics in order to secure the access to the private key by the user, (2) the use of the biometric as an electronic signature and (3) the use of biometric characteristics as a private key in a PKI environment. Biometrics could secure the access to PINs or private keys in a PKI environment. Procedures introducing biometrics into a PKI have been identified and described, e.g., in the IST-20078 BEE project. In this project, biometrics, PKI and smart cards were combined in a concrete security solution in order to address the security needs of sensitive e-commerce applications, such as e-banking, e-government and e-health applications. According to the procedure proposed by the BEE project, the Certification Authority stores the key pair and the biometric template of the authorised user, while the user receives a smart card, containing the user’s certificate, the user’s encrypted private key and the user’s encrypted biometric template, stored in the protected memory area of the smartcard. Upon use of the smart card, the user uses a PIN and the designed biometric measurement for unlocking the access to the private key, which is used for the PKI services. It is suggested that the matching of the PIN and the template is done on the card. Specific security concerns for the use of biometrics apply to the use of biometrics in this scenario as well. If the biometrics are included on a smart card, and due to the presently still limited technical possibilities of such smart cards (such as limited storage and processing capacity for match-on-card), the challenges for securing the use of biometrics on such smart card are even more prominent present.

Biometrics could also qualify as an electronic signature. An ‘electronic signature’ is defined in the e-signature Directive as ‘data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication’. Biometric characteristics could qualify as data in electronic form and become attached with other electronic data, in order to identify the user . Other legal systems would also accept biometric identifiers as an electronic signature . The advantages for applications such as e-commerce would be that the use of e.g., a fingerprint, by an individual to confirm an electronic transaction is more reliable for the vendor than the use of an ‘I accept and agree’ key in an e-commerce application. The use of biometrics in this case is however not equal to an ‘advanced electronic signature’, for which it is required that the signature is created ‘using means that the signatory can maintain under his sole control’. Biometric characteristics are not secrets and publicly available for those who intend to forge biometric systems (see also below).

The European Art. 29 Data Protection Working Party (WP 29) has indicated that it favours the use of biometric data as encryption keys as a new technology. One could understand that in that case, biometric characteristics become part of the process of establishing the private key. The challenge of this kind of use of biometrics is not only evidence of coping successfully with the specific dangers and threats to biometric systems (e.g., need for authentication of the biometric input device and aliveness tests (see below)) and the privacy friendly implementation of the use of biometric characteristics (see above, e.g., limiting the use of central database, etc) but also the demonstration that biometric characteristics which cannot be considered as private and secret, comply with the requirement of an ‘ advanced electronic signature’ as that it is created ‘using means that the signatory can maintain under his sole control’.

The use of biometrics in a PKI environment has been briefly touched in the BioVision report on legal and privacy issues . The paper analyses several terms of the e-signature Directive in the light of the use of biometrics. The paper does not state, however, to what extent biometrics could qualify as an electronic signature, whether a ‘simple’ electronic signature, or an advanced one.

ICAO. In 2003, the International Civil Aviation Organisation (ICAO) adopted a global blueprint for the integration of biometric identification information into passports and other Machine Readable Travel Documents (MRTDs). Facial recognition was selected as the globally interoperable biometric for machine-assisted identity confirmation with MRTDs. ICAO also has selected high-capacity, contactless integrated circuit (IC) chips to store identification information in MRTDs -- passports, visas and identity cards. States will have the option of using one or two secondary biometrics to supplement facial recognition for personal identification. A specially developed logical data structure (LDS) will provide a framework for programming data to ensure interoperability of travel documents and a modified public key infrastructure (PKI) scheme will provide security of data stored in the IC chip against unauthorised alteration or access. The MRTDs are requested to follow up on the technical report ‘PKI for machine readable travel documents offering ICC read-only access’. The system, however, actually would only provide for the digital signature of the MRTD by the issuing states with the certificate of the signing state stored on the MRTD chips and a public key management held by the ICAO .

Summary

Chapter 5 summarises research and developments aimed at improving PKI by utilising biometrics. Main approaches such as (1) the use of biometrics in order to secure the access to the private key by the user, (2) the use of the biometrics as an electronic signature and (3) the use of biometric characteristics as a private key in a PKI environment have been discussed. Currently, most of those approaches are either still at the concept level, or in a pilot phase. Further information is available via the BEE project and the BioVision report.

The current regulations of International Civil Aviation Organisation (ICAO) for the integration of biometric identification information into passports and other Machine Readable Travel Documents (MRTDs) are dealing with integration of biometrics and PKI as well. In this case the suggested system only supports the digital signature of the documents by the issuing state and key management handled by the ICAO. More detail on this will be available in FIDIS Deliverable 3.7 “Study on ID documents”.

Conclusion

As with many young and expanding fields, the issues of both Public Key Infrastructures and Biometrics are involved and complex. In this document, such issues, especially those relating to security and privacy have been considered

PKI has proven to be a relatively complex and expensive solution and from the perspective of diffusion into European markets it has been notably less successful than expected. Nevertheless it is still considered to be a very secure technology for authentication and electronic signatures. That said, the core premise underlying the public key cryptography, and thus PKI systems, is that secret keys always remain secret. This is just one of many security issues that PKIs face. In this case technical solutions are available which lead to increasing costs for the users’ infrastructure for electronic signatures. Another critical aspect of PKI systems is the underlying concept of trust (who trusts whom for what?) and the role of the certificate authority (CA) taken therein. In the case of signature fraud in a multilateral, not secured technological system the consequences of this fraud are largely borne by the PKI user, not the CA.

Additionally, PKIs suffer from privacy issues because traditional public-key certificates contain information about the holder. As such, a digital certificate can be traced uniquely to the person to whom it has been issued (or to the device in which it has been incorporated) and can be followed around instantaneously and automatically as it moves through the system. In spite of these threats, the protection of privacy has never been a core issue in the legal and policy discussions about PKI in Europe, though the Directive 1999/93/EC offers the option of pseudonymous certificates. However, the use of such certificates has rarely been implemented into national European legislation so far.

Based on the market penetration rate of qualified electronic signatures to date it can be seen that only a fraction of the potential market has adopted this innovation. Notably, successful implementations can be found especially where the signature is used in a process that has an added value such as within a central organisation.

Informally, it is believed, that most potential adopters have not even reached the knowledge stage, meaning they are not even aware that this technology exists. Possibly the awareness of this technology could create a need to adopt. This study suggests six concrete measures to improve the diffusion of PKI into the market:

To shift costs in order to achieve a fair distribution

Measures to reach the critical mass of users

Increasing awareness and knowledge about this technology

To especially target the user group called ‘early adopters’

To increase triability e.g. by trial versions of electronic signatures

To further reduce complexity of the private infrastructure required

Biometrics has proven to be a more readily acknowledged and understood technology, mainly due to its widely debated introduction into the public sphere. In this document, the two sub-sections of biometric technologies have been analysed, i.e. physiological (passive) and behavioural (active) biometrics. In contrast to the situation two years ago, biometrics are now tested with higher enrolment numbers under operative conditions. Notably there is a gap between high quality of biometrics under laboratory conditions and the limitations observed under practical implementation. For implementations of biometrics with large numbers of users, no data concerning operative costs over several years is currently available.

In this study technological weaknesses with respect to quality and convenience of the biometric methods were analysed. Many of these methods cannot be used by all people, for example iris recognition (e.g. people with aniridia) or genetic fingerprinting (e.g. monozygotic twins). In addition some methods cannot be used in certain environments. This applies to for example fingerprinting (people doing hard labour may have severely worn papillary structures) or face recognition (light conditions are vital for the quality of this method). For these cases alternative methods are needed when used for authentication or verification. Although the potential privacy issues related to this technology theoretically can be largely minimised (by not storing raw biometric data for example), from the point of view of current available solutions many questions towards implementation of the privacy criteria developed by the European Art. 29 Data Protection Working Party (WP 29) are still open. In some cases it is not known if privacy-critical information e.g., concerning health, can be extracted from templates. This is notably not thoroughly investigated in areas where numerous different algorithms are used to generate templates, e.g. for face recognition. Further research is necessary in this area, however it is expected that this will not be driven by the economic sector due to the lack of economic interest.

Importantly, the security reality of biometrics is still a matter of great debate. With any emerging security technology, one question is paramount: ‘How reliable is it?’ Two technical issues exist that can be used to quantify an answer, that of a false positive, i.e. concluding that an impostor is actually who they claim to be, and false negative, i.e. being unable to confirm the identity of a valid user. It seems to be an impossible task to optimise each of the criteria (1) quality (secure and compliant systems towards e.g., the WP 29 privacy criteria with low False Acceptance Rate (FAR)), (2) convenience (low False Rejection Rate (FRR) and fast authentication) and (3) costs at the same time.

A review of current biometrics technology has indicated that current achievable error-rates are simply not acceptable for access control in security critical applications. In addition to the fundamental problems with the technology itself, all systems are open to attack, with the vulnerabilities becoming increased with increasing complexity. This is certainly proving true for biometric systems.

Technological trends in biometric development are (1) the improvement of sensors e.g. for taking images or aliveness detection, (2) improvement of algorithms to generate templates and (3) developments in methods used to discriminate acceptance from rejection (such as neural network technologies). This will result in improved quality, and ultimately security of biometric solutions. In addition, further integration of systems e.g., bio-chips for genetic fingerprinting, will lead to improvements of functionality and further areas of application of biometrics.

It is possible for biometrics to offer significant enhancements to the PKI model. The co-operation of these technologies potentially brings a lot to the area of secure data exchange and general encryption. In the discussion on whether biometrics could enhance PKIs, the distinction has been drawn between (1) the use of biometrics in order to secure the access to the private key by the user, (2) the use of the biometric as an electronic signature and (3) the use of biometric characteristics as a private key in a PKI environment. Currently, most of those approaches are either still at the concept level, or in a pilot phase. Certainly within this structure, it appears that there is great promise for the continued integration of these two technologies.

Within the FIDIS Network of Excellence the results of this document are to be used for further research leading to several future deliverables. One area of research is the application of biometrics and PKI in ID documents such as passports, ID cards or e-health cards.

Certain aspects discussed in this document are also relevant for future work in the area of ID theft / ID fraud and ambient intelligence where authentication plays a central role. Certainly social and legal aspects of today’s technically weak authentications are an on-going matter of discussion there. From an ethical and legal perspective the question of how consent for transfer and processing of personal data defined by the European Directive 95/46/EC can be applied to passive authentication, e.g. using active biometrics, is still open. The solution to this issue is vital for the development of socially acceptable and commercially implementable concepts for ambient intelligent environments and thus also a key area of research within FIDIS.

References

[ALT03]	Alternman, A., “A piece of yourself: ethical issues in biometric identification” Ethics and Information Technology, (5), pp.139-50, 2003.

[AMB03]	Amberger, M., Fischer, S., Rößler, J., “Biometrische Verfahren – Studie zu State of the Art”, Erlangen, 2003. See http://www.wi3.uni-erlangen.de/forschung/Biometrie_StateOfTheArt/Biometrie.pdf

[ANG96]	Angell, I., “Economic Crime: Beyond Good and Evil”, Journal of Financial Regulation and Compliance, 4 (1), 1996.

[ANG00]	Angell, I., “The New Barbarian Manifesto: How to survive the Information Age”, London, Kogan, ISBN 0-7494-3151-2, 2000.

[ANG05]	Angell, I., Demetis, D., “Systems Thinking about Anti-Money Laundering: Considering the Greek Case”, Journal of Money Laundering Control, 8 (3), 2005.

[ASW98]	Asokan, N., Shoup, Victor, Waidner, Michael, “Optimistic Fair Exchange of Digital Signatures”; In: Proceedings of Eurocrypt ’98, LNCS 1403, pp.591–606, Springer-Verlag, 1998.

[BÄU99]	Cavocian, A., “Biometrics and Policing” in Bäumler, H. (Ed.), “Polizei und Datenschutz”, pp.229 – 249, Luchterhand 1999.

[BEL99]	Bellare, Mihir and Miner, Sara, "A forward-secure digital signature scheme", In: Proceedings of Crypto'99, LNCS 1666, Springer-Verlag, 1999.

[BEN01]	Benecke, M., “Genetischer Fingerabdruck in Enzyklopädie Naturwissenschaft und Technik”, 2. Auflage, 6. Ergänzungslieferung, ecomed Verlagsgesellschaft AG & Co. KG, Landsberg, 2001. See http://www.benecke.com/dna.pdf

[BEN02]	Benecke, M., “Coding or non-coding, that is he question”, EMBO reports vol. 3 no. 6, 2002. See http://www.benecke.com/coding.pdf

[BSI03]	Study „BioFace I and II“,German Federal Office for Information Security, Darmstadt 2003.
See http://www.bsi.de/english/publications/BioFace/BioFaceIIReport.pdf

[BSI04]	Study “Evalierung biometrischer Systeme Fingerabdrucktechnologien – BioFinger; Öffentlicher Abschlussbericht”, German Federal Office for Information Security, Darmstadt 2004.
See http://www.bsi.de/literat/studien/BioFinger/BioFinger_I_I.pdf

[BYR01]	Byrd, J. H., Castner J. L., (ed), “The Utility of Arthropods in Legal Investigations”, pp.341-52, CRC Press, Boca Raton, 2001. See http://www.benecke.com/crc2.html

[CAP01]	Cap, C. H., Maibaum, N., Heyden, L., “Extending the Data Storage Capabilities of a Java-based Smartcard”, 6th IEEE Symposium on Computers and Communications, Hammamet, Tunesia 3-5 July, 2001.

[CHA90]	Chaum, David, van Antwerpen, Hans, “Undeniable Signatures“, In: Proceedings of Crypto ´89, LNCS 435, pp.212-216, Springer-Verlag, Heidelberg, 1990.

[CHA95]	David Chaum, “Designated Confirmer Signatures”, In: Proceedings of Eurocrypt´95, LNCS 950, pp.86-91, Springer-Verlag, Berlin, 1995.

[CLA02]	Clarke, R., “Biometrics' Inadequacies and Threats, and the Need for Regulation”, Presentation on the Computers, Freedom & Privacy 2002; see http://www.anu.edu.au/people/Roger.Clarke/DV/BiomThreats.html

[DAU04]	Daugman, J., “How Iris recognition works”, IEEE Trans. CSVT 14 (1), pp.21-30, 2004. See http://www.cl.cam.ac.uk/users/jgd1000/irisrecog.pdf

[DAV94]	Davies, S., “Touching Big Brother: How Biometric Technology will fuse Flesh and Machine”, Information Technology & People (), 4, pp.38-47, 1994.

[DAV02]	Davies, S., “A Year After 9/11: Where are we now?”, Communications of the ACM, 45(9), 2002.

[DEM04]	Demetis, D., “The World on Discount”, Journal of the London School of Economics, SU 3 (1), 2004.

[DER03]	Derakhshani, R., Schuckers, S.A.C., Hornak, L.A., Gorman, L.O., “Determination of vitality from a non-invasive biomedical measurement for use in fingerprint scanners”, Pattern Recognition, vol. 36, pp.383-96, 2003.

[DHI96]	Dhillon, G., Backhouse, J., “Risks in the use of information technology within organizations”, Int. J. Information Management, 16, 1, pp.65-74, 1996.

[DHI00]	Dhillon, G., Backhouse, J., “Information System Security Management in the New Millennium” Communications of the ACM, 43 (7) pp.125-8, 2000.

[FIA87]	Fiat, Amos and Shamir, Adi, “How to Prove Yourself: Practical Solutions to Identification and Signature Problems”, In: Proceedings of Crypto´86, LNCS 263, pp.186-194, Springer-Verlag, Berlin 1987.

[FR95]	Franklin, Matthew K. and Reiter, Michael K., “Verifiable Signature Sharing”; Eurocrypt ’95, LNCS 921, pp.50–63, Springer-Verlag, 1995.

[FRI02]	Fritsch, L., “A secure, economic infrastructure for signing of web based documents and financial affairs”, CBL – Cyberbanking & Law, issue 2, 2002.

[FRR03]	Fritsch, L. Ranke, J., Rossnagel, H., “Qualified Mobile Electronic Signatures: Possible, but worth a try?”, Information Security Solutions Europe (ISSE), Vienna Austria, 2003.

[FUC00]	Fuchß, T., Fritsch, L., “Security Certificates as a tool for reliably software engineering”, Datenschutz und Datensicherheit, pp.514ff, 2000.

[FUC05]	Fuchs, J., Podda, M., “Medical Genomics and Proteomics”, pp. 500-4, Marcel Dekker Inc., New York 2005. See http://www.benecke.com/dnacollection.pdf

[GEO01]	von Hardenberg, I., “Warum Neugeborene mehr wissen, als Große manchmal ahnen”, GEO (7), pp.27-42, Hamburg, 2001.

[GMR88]	Godwasser, Shafi, Micali, Silvio and Rivest, Ronald L.: “A Digital Signature Scheme Secure Against Chosen-Message Attacks”, SIAM Journal on Computing 17/2 pp.281-308, 1988.

[HES99]	Hes, R., Hooghiemstra, T. F. M., Borking, J. J., “At face value: on
biometrical identification and privacy”, Registratiekamer, September 1999. See http://www.cbpweb.nl/en/documenten/EN_av_15_At_face_value.htm

[HVA04]	Hvarre, J., “Electronic signatures in Denmark: free for all citizens”, e-signature and law journal, vol. 1, no1, 2004.

[IGA03]	Igarza, J. J., Goirizelaia, I., Espinosa, K., Hernáez, I., Méndez, R., Sánchez, J., “Online Handwritten Signature Verification Using Hidden Markov Models”, Lecture Notes in Computer Science, pp.391-9, 2003.

[JAI04]	Jain, A. K., Dass S. C., Nandakumar, K., “Can soft biometric traits assist user recognition?”, in Proceedings of SPIE Vol. 5404, Biometric Technology for Human Identification, pp.561-72, Orlando, FL, April 2004.

[JOB04]	Jobling, M. A., Gill, P., “Encoded evidence: DNA in forensic analysis”, Nature (5), pp.739-52, 2004.

[KEN03]	Kent, Stephen T. and Millett, Lynette I. (Eds.), “Who Goes There? Authentication Through the Lens of Privacy”, Committee on Authentication Technologies and Their Privacy Implications, National Research Council, ISBN 0309088968, 2003; see http://www.nap.edu/books/0309088968/html/

[KRA05]	Krause, D., Jachau, K., Wittig, H., Muschke, R., Szibor, R. “Zielführende und persönlichkeitsrelevante Informationen durch konservative erkennungdsienstliche Maßnahmen im Vergleich zur Analyse des DNA-Identifizierungsmusters”; to be published in Rechtsmedizin, 2005.

[KOC99]	Kocher, P., “Differential Power Analysis”, Crypto’99, LNCS 1666, pp.388-97, 1999.

[LAN02]	Langenbach, C. J., Ulrich, O. (Eds.), “Elektronische Signaturen – Kulturelle Rahmenbedingungen einer technischen Entwicklung”, Springer-Verlag, 2002.

[LEE02]	Lee, Byoungcheon and Kim, Kwangjo , “Self-Certified Signature”, Proc. of INDOCRYPT 2002, LNCS 2551, pp.199-214, Springer Verlag 2002.

[LIB05]	Study “Biometrics at the Frontiers: Assessing the Impact on Society” Institute for Prospective Technological Studies (IPTS), Seville 2005. See http://cybersecurity.jrc.es/docs/LIBE%20Biometrics%20March%2005/Biometrics_exec_summ_EN.pdf

[LU04]	Lu, X., Jain, A. K., “Ethnicity identification in Face Images”, Proc. SPIE, vol. 5404, pp.114-23, 2004.

[MAT02]	Matsumoto, T., Matsumoto, H., Yamada, K., Hoshino, S., “Impact of Artificial Gummy Fingers on Fingerprint Systems”, Proc. of SPIE, Optical Security and Counterfeit Deterrence Techniques IV, vol. 4677, pp. 275-89, 2002.

[MID03]	Midgley, G., “Science as Systemic Intervention: Some Implications of Systems Thinking and Complexity for the Philosophy of Science”, Systemic Practice and Action Research, 16 (2), 2003.

[MON99]	Monrose, F., Reiter, M. K., Wetzel, S., “Password hardening based on keystroke dynamics”, 6th ACM conf. Computer and Communications Security, pp. 73-82, 1999.

[MUN05]	Muntermann, J., Rossnagel, H., Rannenberg, K., “Mobile Brokerage Infrastructures - Capabilities and Security Requirements”, 13th European Conference on Information Systems (ECIS 2005), Regensburg, 2005.

[NAL03]	Nalla, Divya and Reddy, K.C., "Signcryption scheme for Identity-based Cryptosystems", Cryptology ePrint Archive: Report 2003/044.

[PET97]	Petersen, Holger and Horster, Patrick, “Self certified keys - Concepts and Applications”, Proc. 3rd Communications and Multimedia Security CMS'97, pp.102-116, Chapman and Hall, 1997.

[PFIT96]	Pfitzmann, Birgit: “Digital Signature Schemes – General Framework and Fail-Stop Signatures”, Lectures on Computer Sciences Volume 1100, Springer-Verlag, 1996.

[PUT00]	Putte, T. Keuning, J. “Biometrical fingerprint recognition: don’ t get your fingers burned”, Proc. IFIP TC8/WG8.8, Fourth Working Conf. Smart Card Research and Adv. App., pp.289-303, 2000.

[RAI04]	Raisch, P., Speech on biometrics at the workshop “Markt der biometrischen Möglichkeiten”, 12th of October 2004.

[RAN03]	Ranke, J., Fritsch, L., Rossnagel, H., “M-Signaturen aus rechtlicher Sicht”,
Datenschutz und Datensicherheit 27, pp.95-100, 2003.

[RAN04]	Rannenberg, K., “Identity Management in Mobile Cellular Networks and Related Applications”, Information Security Technical Report, vol. 9, No. 1, pp.77-85, 2004.

[ROG03]	Rogers, E. M., “Diffusion of Innovation”, Fifth Edition, Free Press, 2003.

[ROG03b]	Roßnagel, A. “Eine konzertierte Aktion für die elektronische Signatur”, Editorial in Multimedia und Recht, Issue 1, 2003.

[ROS04]	Rossnagel, H., “Mobile Signatures and Certification on Demand”, in Sokratis K. Katsikas, Stefanos Gritzalis and Javier Lopez, eds., Public Key Infrastructures, Berlin Heidelberg: Springer, pp.274-86, 2004.

[ROS05]	Rossnagel, H., Royer, D., “Investing in Security Solutions - Can Qualified Electronic Signatures be Profitable for Mobile Operators”, 11th Americas Conference on Information Systems, Omaha, Nebraska, 2005.

[SAN04]	Santos, C., Justino, E. J. R., Bortolozzi, F., Sabourin, R., “An Off-Line Signature Verification Method based on the Questioned Document Expert’s Approach and a Neural Network Classifier”, 9th Int. Workshop on Frontiers in Handwriting Recognition, pp.498-502, 2004.

[SCH00]	Schneier, B, Ellison, C., “Ten Risk of PKI: What You’ re Not Being Told About Public Key Infrastructure”, Computer Security Journal, vol. 16 no. 1, pp.1-7, 2000. See http://www.schneier.com/paper-pki.pdf

[SCH99]	Schneier, B. “The uses and abuses of biometrics”, Comm. ACM, vol. 42, no. 8, pp.136, Aug. 1999.

[SOK03]	Sokol, B., (Ed.), “Der gläserne Mensch – DNA-Analyse”, eine Herausforderung an den Datenschutz, pp.27-8, Düsseldorf, 2003. See http://www.ldi.nrw.de/pressestelle/presse_7_7.htm

[TSE03]	Tseng, S. “Comparison of holistic and feature-based approaches to face recognition”, MBS Thesis, 2003. See http://goanna.cs.rmit.edu.au/~ronvs/teaching/theses/Tseng03.html

[TUR91]	Turk, M., and Pentland, A. “Eigenfaces for recognition”, Journal of Cognitive Neuro Science 3, pp.71-86, 1991.

[ULU04]	Uludag, U. and Jain, A. K. “Attacks on biometric systems: a case study in fingerprints”, Proc. SPIE-EI 2004, pp.622-33, San Jose, CA, January 18-22, 2004.

[WHI99]	Whitten, A., Tygar, J.D., “Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5.0”, 9th USENIX Security Symposium, 1999.

[ZEH97]	Zheng, Yuliang, "Signcryption and Its Applications in Efficient Public Key Solutions", In: Proc. of First International Workshop on Information Security, ISW '97, LNCS 1396, pp.291-312, Springer-Verlag 1998.

Acronyms and Glossary

Aliveness test	Also called liveness test
The process of checking that the captured biometric data originates from the real person being authenticated

API	Application Programming Interface

Authentication	Verification of the identity of a person or process

BEE	Business Environment of Biometrics involved in Electronic commerce

Behavioural biometrics	Also called active biometrics
Biometrics measuring characteristics represented by skills or functions performed by an individual at a specific time for a specific reason (e.g., a signature or keystroke dynamics)

CA	Certificate Authority
Issuer of certificates and (usually) CRLs. It may also support a variety of administrative functions, although these are often delegated.

Certificate	A certificate is information referring to a public key that has been digitally signed by a Certification Authority (CA)

Credential	A general term for privilege attribute data that has been certified by a trusted privilege certification authority

CRL	Certificate Revocation List

DNA	Desoxyribonucleic Acid
DNA-molecules code the genetic information for every life-form.

Dynamic biometrics	Biometrics measuring a trait while an action is taking place

EER	Equal Error Rate
Cross-over point, where FAR = FRR

Eigenfaces	A set of eigenvectors derived from the covariance matrix of the probability distribution of the high-dimensional vector space of possible faces of human beings

Eigenvector	Non-zero vectors which, when operated on by the operator, result in a scalar multiple of themselves

End Entity	A generic term used to denote end-users, devices (e.g., servers, routers), or any other entity that can be identified in the subject field of a public key certificate. End entities typically consume and/or support PKI-related services

ETSI	European Telecommunications Standardisation Institute

FAR	False Acceptance Rate;
Rate of erroneous acceptance of biometric identifiers

FRR	False Rejection Rate
Rate of erroneous rejection of biometric identifiers

FTR	Failure to Enrol Rate
Rate at which enrolment of biometrics in an average population fails due to the missing or weak character of physical or behavioural characteristics used as identifiers for biometrics

GPRS	Global Package Radio System
European standard for mobile communication

Hash	A constant length distillation of a message

IBG	Independent Biometric Group
Independent biometric research, consulting and technology solutions firm based in the United States (see also www.bioprivacy.org)

ICAO	International Civil Aviation Organization

ID	Identifier
An identifier (ID) is a name or string of bits. IDs can be assigned to subjects and objects. An identifier for a subject – with respect to a given community – is any information that uniquely characterizes this subject in this community

ISO	International Organisation for Standardization

JTC	Joint ISO/IEC (International Electrotechnical Commission) technical committee

Kerckhoff‘s principle	In fact one of a set of principles; by default is meant that a cryptosystem should be secure even if everything about the system, except the key, is public knowledge

LDS	Logical Data Structure

MRTDs	Machine Readable Travel Documents

PDA	Personal Digital Assistant

Physiological biometrics	Also called passive biometrics
Biometrics referring to fixed or stable human characteristics (e.g., fingerprints, hand geometry, iris pattern and, within biometrics technology, facial image and voice patterns)

PIA	Privacy Impact Assessment

PIN	Personal Identification Number

PKI	Public Key Infrastructure

Public Key Cryptography	Cryptography in which a public and private key pair is used, encrypting the data at the sender's end and decrypting it at the receiver's end. Since the data is encrypted while it travels the public Internet, no additional security is needed -- it can safely use public networks without loss of confidentiality

RA	Registration Authority
Optional component that can assume a number of administrative functions from the CA. The RA is often associated with the End Entity registration process, but can assist in a number of other areas as well

Repository	A generic term used to denote any method for storing certificates and CRLs so that they can be retrieved by End Entities

SIM	Subscriber Identity Module
Number stored on a chip card inserted into mobile devices to identify them in mobile communication networks using GPRS or UMTS

Static biometrics	Biometrics measuring a trait that requires no action at the time of verification or identification

Tamper resistance	Resistance to tampering (manipulation) by either the normal users of the system or others with physical access to it

Template	A template is the digital identifier calculated from physical or behavioural characteristics of a subject by using biometric methods

Token	Hardware device that performs cryptographic functions and stores cryptographic keys, certificates, and user data

UMTS	Universal Mobile Telecommunication Standard
International standard for mobile communication

WP 29	European Art. 29 Data Protection Working Party

Appendix 1: Analytical Steps for Genetic Fingerprinting

Taking the sample; this step is essential for the quality of the genetic fingerprint

Isolating DNA from the cells; the procedures used are e.g.:

A stain extraction buffer composed of water, salts and an enzyme called Proteinase K dissolves dried stains and lyses cell membranes to get the DNA into solution.

The extract is spun high to coagulate the DNA molecules; the resulting DNA pellets are rinsed several times with buffer solutions followed by organic extraction to remove soluble proteins and carbohydrates.

The DNA is isolated on a filter and reconstituted in a buffer.

Enzymatic restriction: to cut the DNA into specific fragments. Various enzymes, depending on the type of tandem repeats to be analysed (RFLP or VNSTR), are used. For these tandem repeats the following procedure is slightly different:

Using RFLP: no further preparation is carried out at this point.

Using VNSTR and AmpFLP: if there is insufficient DNA for an appropriate analysis, polymerase chain reaction (PCR) can be used to amplify the DNA ; this makes the VNSTR method usable for small samples with small amount of DNA. The PCR procedures are carried out repeatedly in the following steps:

Denaturation: the double helix is split into single-stranded DNA at a temperature of 94°C.

Annealing: a primer is added at 54°C to mark the DNA parts (called templates, in this case the STR-single strands) to be copied. Polymerase, bases and other chemicals are added.

Extension: at 72°C the polymerase works best and copies the STR.

Separation of the fragments: to separate the fragments gel electrophoresis or ion exchange chromatography is used. This separates the fragments by charge and bulk.

Detection; to detect the fragments two main techniques are used:

Fluorescent colours in connection with lasers to stimulate the fluorescence and photographic paper (used with RFLP and VNSTR)

With RFLP after fixing it to a nylon membrane (so called Southern Blot) radioactive marked testing probes in connection with X-ray paper (autorad detection) .

Analysis: there are different ways to analyse the resulting printouts:

Direct comparison of patterns (bars / signals) from different sources and against references; one example is given in Figure 4-4.7 where three samples (1 and 2 are suspects, 3 is a sample from the site of the crime) and four loci are analysed. The comparison shows that the pattern of suspect no. 2 matches with the patterns of the sample from the crime scene. The patterns of suspect no. 1 do not match.

Absolute determination of the alleles of different analysed loci; storage of the results in a database for comparison with later analysed sources .

Further statistical analysis based on b.: The occurrence of each allele on each locus has a certain likeliness with respect to a specific population. For comparison purposes a lot of statistical data on different populations with respect to the most common analysed loci are available. The comparison of the found alleles with the appropriate reference table allows for statements how common the observed allele patterns are in the reference population. Analysing five loci (e.g. FIBRA, SE33, THO1, FGA and VWA/VWF) the result from a given example can be 1 : 25000000000 (25 billions) [BEN01] within a middle European population.

Appendix 2: The Eigenface Approach

As an example, the eigenface approach [TUR91] offers the advantage of efficiency combined with simplicity. It classifies faces based on general facial patterns which include more than just the specific features of the face. In this case, each facial image is interpreted as a two-dimensional set of light and dark areas in a particular pattern with these areas being regarded as the eigenfaces. Eigenfaces decompose a human face the same way Fourier analysis decomposes a signal. In this way, both the trained face images and new face images can be represented as linear combination of the eigenfaces. The initial steps followed by the system are the following:

The system is fed with the images of the humans to be identified (training images). Suppose the each image is NN. Then ΓΓ, ..., Γ are the N1 vectors.

The eigenvalues and eigenvectors are computed (average face vector, mean face, covariance matrix). The mean of the training images is the average face:

Ψ =. The difference of each image from the average face is: .

The scalars and the vectors are the eigenvalues and eigenvectors of the covariance matrix of the face images : C =, with A=[].

Given the fact that AA is a NN matrix the computation of its eigenvalues and eigenvectors is rather impractical and thus taking into account that the matrices AAand AA (KK matrix) have the same eigenvalues and their eigenvectors are related as follows , the matrix used for their computation is AA and the eigenvectors are normalised.

The M eigenvectors (or eigenfaces) with the largest eigenvalues that can be used without important loss of information are found. The first three eigenfaces include mainly luminance and not face information, whereas more than M eigenfaces offer no valuable information for the face.

Each one of the training faces minus the average face is represented as a linear combination of these eigenfaces, in other words is projected into this basis using , with these weights forming the vector : Ω = [].

Each time there is input from the face detection and localisation module of the system to the face recognition module the face image is processed the same way as the training images (normalisation, projection to the eigenspace and representation with vector Ω) and then the distance between the input image and the face space (Ω of each training image) is computed and compared to a threshold. In case, if this distance is smaller than the threshold, then the face is recognised as one of the training images. This distance often refers to the Euclidean distance; however some studies and results have shown that the Mahalanobis distance performs very well.

Feature-based face recognition uses a priori information of the face in order to find local face features or local significant geometries of the face that regard the local features of faces. The initial steps followed by the system are the following:

The system is provided with training images.

Individual features of the face (such as eyes, mouth, head outline, hair and nose) are identified. Quite often the head outline is the first feature to search for since it encloses most of the features.

A-priori information is used to refine the result of the above search in order to locate pre-defined face features.

The same process is applied to the images arriving from the face detection and localisation module, the results of which are compared to the ones of the training images in order to determine the detected individual.

Instead of using a priori information to extract face features, they are located through the finding of important geometries in the face. Manjunath et al. [TSE03] presented a method that performed face recognition in three steps. In the first step features from faces were extracted through the use Gabor wavelets. The second step involved the representation of the extracted face features through a graph-like data structure. This structure was of two types. One type regarded the training images (face gallery set), whereas the other type concerned the images to be processed. The third step involved the matching of the input face graphs to the face gallery set by calculating the distance between them and in this way determining the grade of similarity.

The suitability of a classifier for classifying the produced feature vectors is based on their characteristics. Nearest neighbour and the neural networks classifier are of the most popular ones. The first one saves the average coefficients for each individual and classifies each new face as the person with the closest average. In the case of neural network classifiers, the input face is projected onto the eigenface space in case eigenfaces are used and afterwards a new descriptor derives. The new descriptor is provided as network input and applied to each person’s neural network. The one with the maximum output is selected provided that this is over the predefined recognition threshold.

Appendix 3: Details of the Hidden Markov Model

Signatures are described with the directional normalised angle along with the trajectory of the signature, as derived from the modified algorithm:

with n being the ratio between the signature number of samples and the normalised one number of points, θ the absolute angle of the first segment, (x, y) the normalised acquired points with . The topology of the Hidden Markov Models used was the 6-state L-R (left-right).

Phishing attacks use ‘spoofed’ e-mails and fraudulent websites designed to fool recipients into divulging personal financial data such as credit card numbers, account usernames and passwords, social security numbers, etc.

Official Journal L13 of 19.01.2000, p. 12

These are functions which are easy to evaulate but where it is hard to calculate a preimage. An example is multiplication of large numbers. This is usually an easy operation, however, the inverse function, factoring, is usually hard. One-way functions, where the inverse can be calculated easily by using addtional information are called trapdoor one-way functions.

One of the on-going problems in computer science is determining whether every language accepted by some nondeterministic algorithm in polynomial time is also accepted by some (deterministic) algorithm in polynomial time. The answer of this question has severe impact on cryptography, e.g., if N=NP, no (provable) one-way function exists.

See http://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt

See http://theworld.com/~cme/html/congress1.html

For instance, a survey in the UK found that more than 70% of people would reveal their computer password in exchange for a bar of chocolate: http://news.bbc.co.uk/1/hi/technology/3639679.stm

See: http://www.privacy.gov.au/government/guidelines/index.html

See also Graham Greenleaf’s critical remarks on the draft guidelines: http://austlii.edu.au/~graham/publications/2001/PKI_Submission.html#Heading6

See: http://www.credentica.com/the_mit_pressbook.php

Official Journal L13 of 19.01.2000, p. 12

This is based on (but not limited to) deliverable 4 from the APES-project (APES - Anonymity and Privacy in Electronic Services) –a project of the Flemish government aimed at developing tools and techniques for adding anonymity to on-line services. This program has been tackled both from a technical and from a legal standpoint. It is part of the STWW-program (http://www.iwt.be). For further details on the APES-project, see https://www.cosic.esat.kuleuven.ac.be/apes (deliverable 4 can be found in subsection “documents”).

Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, O.J. L. 281, 23 November 1995, http://europa.eu.int/comm/internal_market/en/dataprot/law/index.htm.

The explanatory memorandum mentions: “information regarding a person is to be seen as personal data as long as someone [= see above, ‘by any other person’] is able to retrieve, with any reasonable means, the person to whom the information is related to. Likewise, coded data – which the controller (= the person responsible for the processing) cannot link with the individual, as he does not possess the necessary keys – are to be seen as “personal data” if the identification can still be obtained by someone else. During the process of anonymisation, information on natural persons looses its characteristic as “personal data”, only if the anonymisation is absolute and if there’s no possible way out of the anonymity with the help of any reasonable means.”

The EU Directive on the processing of personal data defines a controller as “the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data” (Article 2 (d) Directive 95/46/EC).

This also corresponds with the ruling of the Belgian Council of State in its decision no 45.218 of 10 December 1993 that data are anonymous “if from a whole of available data (e.g. town, age, hospital, period of hospitalization) there is reasonably no identification possible” (Raad van State, n° 45.218, 10 December 1993, Vl.T.Gez.1993-1994, 281).

A definition of the concept “pseudonyms” can be found in FIDIS Deliverable D2.1. For a classification of pseudonyms according to their linkability to a person see also: B. PFITZMANN, M. WAIDNER, A. PFITZMANN, Rechtssicherheit trotz Anonymität in offenen digitalen Systemen, Datenschutz und Datensicherung (DuD), Vol.14 n° 5-6. and A.PFITZMANN and M. KOHNTOPP, “Anonymity, unobservability and Pseudonymity, a proposal for terminology”, in H. FEDERATH (Ed.), Designing Privacy Enhancing Technologies, Lecture Notes in Computer Science, LNCS 2009, 1-9, Springer-Verlag, 2001,

Recital 14, Directive on e-commerce.

More information on these topics can be found in the above mentioned APES- report.

This chapter is based on (but not limited to) D2.3.2 of the RAPID-project (Roadmap for European Legal Research in Privacy and Identity Management).

Recommendation 3/97 EU Data Protection Working Party: Anonymity on the Internet, http://europa.eu.int/comm/internal_market/en/dataprot.

Article 29 – data protection working party, WP 37, adopted on 21 November 2000, “Privacy on the Internet, an integrated EU-approach to online data protection”, http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2000/wp37en.pdf.

Working document: ‘On-line authentication services’, adopted on 29 January 2003, http://www.europa.eu.int/comm/internal_market/en/dataprot/wpdocs

Recommendation No.R. (99) 5 of the Committee of Ministers to Member States to the protection of privacy on the Internet, Guidelines for the protection of individuals with regard to the collection and processing of personal data on information highways, adopted by the Committee of Ministers on 23 February 1999 at the 660th meeting of the Ministers” Deputies, http://www.uni-frankfurt.de/fradata/Gesetze/INTER_EN.HTM.

http://www.coe.int/T/CM/WCD/advSearch_en.asp#.

A legal entity (physical or legal personality) is accountable for his acts performed both in a contractual an in a non-contractual environment. If this entity causes damages towards a contract party or any third person, he is principally liable to compensate the damage. Principally, the knowledge of the identity of a party to a contract is not an essential condition for the validity of a contract. However, difficulties may occur if one of the anonymous parties badly implements the contract or if he acted whilst he had no capacity to do that. Such a situation may justify the need for identifying the defaulting contracting party.

The trustee is not necessarily a single entity. The power of the trustee can be distributed among several entities. Typically, a certain minimal threshold of trustees must then cooperate before revocation can be performed. This lowers the level of trust that should be put in an individual trustee.

C. GOEMANS, J. DUMORTIER, Enforcement issues – mandatory retention of traffic data in the EU : possible impact on privacy and on-line anonymity, In, C. Nicoll, J.E.J. PRINS, M.J.M. VAN DELLEN (eds.), Digital Anonymity and the Law, Asser Press, The Hague, 2003, p. 182.

J. DUMORTIER, Directive 1999/93/EC on a Community Framework for electronic signatures, In, A.R. LODDER, H. W.K. KASPERSEN (eds.), eDirectives: Guide to European Union Law on E-Commerce, Kluwer Law International, The Hague, 2002, p. 33 ff. and P. VAN EECKE, De handtekening in het recht. Van pennentrek tot elektronische handtekening., De Boeck & Larcier, Gent, 2004, p. 407 ff.

ETSI is the “European Telecommunications Standardisation Institute”.

Communication ‘A European Initiative in Electronic Commerce’ adopted in April 1997 and communication ‘Ensuring security and trust in electronic communication: Towards a European framework for digital signatures and encryption’, adopted in October 1997. As far as digital signatures are concerned, the latter communication confirmed the Commission’s intention to present a draft directive with the following objectives: (1) to define common requirements for the establishment of certification authorities, (2) to stimulate and coordinate measures of Member States aiming at the legal recognition of digital signatures, (3) to ensure that appropriate regulation will contribute substantially to the rapid take-up of this authentication instrument crucial for secure communication on open networks.

The proposed directive can be seen as a technology-neutral takeover of the concepts of the German Signaturgesetz and the implications of the UNCITRAL-law regarding the legal authority of electronic signatures.

The legislative history of the directive, including the original directive proposal can be found on the Prelex website (http://europa.eu.int/prelex/apcnet.cfm?CL=en), with the following coordinates: COM/1998/297final – 98/0191.

See the Amended proposal for a European Parliament and Council Directive on a common framework for electronic signatures of 29 April 1999 (Celex number 51999PC0195).

Common Position (EC) n° 28/1999 of 28 June 1999 adopted by the Council, acting in accordance with the procedure referred to in Article 251 of the Treaty establishing the European Community, with a view to adopting a European Parliament and Council Directive on a Community framework for electronic signatures, OJ C243, 27 August 1999, p. 0033 (Celex number: 51999AG0028).

See the last page of the published common position (EC) number 28/1999 adopted by the Council on 28 June 1999.

Note: This only considers benefits that are not achievable without the use of electronic signatures

This offer is only for business customers.

PGP Corporation, www.pgp.com

Die Geldkarte der deutschen Kreditwirtschaft, see: http://www.geldkarte.de/shared/data/pdf/praesentation_geldkarte_allgemein_feb_2005.pdf

GSM Association - GSM Statistics, see: http://www.gsmworld.com/news/statistics/index.shtml

Directive 1999/93/EC of the European Parliament and of the Council, 13 December 1999: ‘A Community framework for electronic signatures’, Art.2, 2(c)

Universal Subscriber Identity Module

Specification of GSM available at: http://www.3gpp.org/ftp/Specs/archive/

Wireless Application Protocol

Wireless Identity Module

WAP Forum: Specifications of WAP, WIM; http://www.wapforum.org/

General Packet Radio System

Universal Mobile Telecommunication System

International Mobile Subscriber Identity

Individual subscriber authentication key

ZDNet: 3G Linux phone allows video calling, Web browsing, see http://news.zdnet.com/2100-1040_22-5577700.html

Symbian: Symbian OS Version 9.1, http://www.symbian.com/technology/SymbianOS_v9_prod_descv1.pdf

See http://www.teletrust.de/Dokumente%5Cag8_isis-mtt-compliancecrit-v1.1.pdf

European IST Project “Wireless Trust for Mobile Business” (WiTness), see http://www.wireless-trust.org

Type 3 identity management system, see FIDIS Deliverable 3.1 for further information on types of identity management systems

A template is in fact a digital structured reduction of the biometric sample of an individual. For uniform terms and vocabulary, see also the work of subcommittee 37 of the ISO JTC on biometric vocabulary, document number ISO/IECJTC1/SC37N460.

See http://www.policensw.com/info/gen/u1.html

See http://www.policensw.com/info/fingerprints/finger02.html

Ridges are the lines that flow in various patterns across the fingerprints

Ridge bifurcations are the points where ridges split in two

See http://www.bsi.de/fachthem/biometrie/dokumente/Fingerabdruckerkennung.pdf

The seven pillars are: universality, distinctiveness, permanence of the used characteristics, collectability, accessability, performance, circumvention

See http://www.bromba.com/knowhow/fingerprint.htm

See http://www.ncbi.nlm.nih.gov/entrez/query.fcgi?cmd=Retrieve&db=pubmed&dopt=Abstract&list_uids=
3729743

See http://www.edcampbell.com/PalmD-History.htm

See http://www.geocities.com/southbeach/boardwalk/7151/biobasis.html

See http://www.answers.com/main/ntquery;jsessionid=3x8fnlfr19e3?method=4&dsid=2222&dekey=
Alec+Jeffreys&gwp=8&curtab=2222_1&sbid=lc04b

DNA: Deoxyribonucleic Acid; the genes are composed of DNA

http://www.answers.com/DNA

http://news.bbc.co.uk/2/hi/science/nature/3703935.stm

To discriminate identical twins currently special methods of DNA analysis are being developed; see http://www.benecke.com/clones.html

E.g.: http://www.dnacanada.ca/products/y-chromosome-dna.php

E.g.: http://www.genetree.com/product/mtdna-testing.asp

See: http://encyclopedia.laborlawtalk.com/genetic_fingerprinting

See: http://www.computerbase.de/lexikon/Genetischer_Fingerabdruck

E.g.: http://www.quality.de/lexikon/glp.htm

E.g.: http://www.datenschutzzentrum.de/material/themen/gendatei/dsbk_0502.htm

See: http://www.benecke.com/popscidna.html

See: http://www.heise.de/newsticker/meldung/55372

See http://www.cl.cam.ac.uk/users/jgd1000/

See http://ni.cs.tu-berlin.de/lehre/sem-biometrie/Galkin_Iris.pdf

See http://www.heritage.org/Research/HomelandDefense/lm12.cfm

Picture taken from http://www.cl.cam.ac.uk/users/jgd1000/iriscode.jpg

See http://www.cl.cam.ac.uk/users/jgd1000/iristests.pdf

The seven pillars are: universality, distinctiveness, permanence of the used characteristics, collectability, accessability, performance, circumvention

See http://www.icdri.org/biometrics/iris_biometrics.htm

See http://www.augentagesklinik.com/de/informationen/patienten/irisdiagnostik.php

See e.g. www.cast.uni-linz.ac.at/Courses/CoursesSS2004/BiometricID/Face_Hand.ppt

See e.g. http://www.biometricsinfo.org/handgeometry.htm

See e.g. http://www.informatik.uni-ulm.de/ni/Lehre/WS01/HS-Biometrische-Systeme/ausarbeitungen/Handgeometrie.PDF

CCD: Charged Couple Device

Picture taken from www.recogsys.com

See http://www.ee.ust.hk/~eeship/Papers/MVA02.pdf

Picture taken from http://biometrics.cse.msu.edu/hand_proto.html

See http://www.informatik.uni-augsburg.de/~kimjongh/biometrics/folien/handgeometrie.pdf

See e.g. http://www.biometrics.org/REPORTS/INSPASS2.html

See http://www.cse.msu.edu/~cse891/Sect601/HandGeometry.pdf

See http://bioenabletech.com/biometrics/handgeometry.htm

“Biometric cards will not stop identity fraud”, see http://www.newscientist.com/article.ns?id=dn4393

“Finger chopped off to beat car security”- http://www.newscientist.com/channel/mech-tech/mg18624943.600

Foucault, Micheal. (1977) Discipline and punish: the birth of the prison. Harmondsworth: Penguin

See http://www.ftc.gov/opa/2003/09/idtheft.htm

See http://www.bbc.co.uk/bob/junkmail/

See http://direct.srv.gc.ca/cgi-bin/direct500/TE?FN=faq.htm

See http://www.planetary.org/news/2005/beagle2_spec-report-final-words_0301.html

See http://www.pco.org.hk/english/infocentre/files/cakoukian-paper.doc and http://www.ipc.on.ca/scripts/index_.asp?action=31&P_ID=11433&N_ID=1&PT_ID=11351&U_ID=0

See http://www.privacy.gov.au/news/speeches/sp80notes.doc

See http://www.anu.edu.au/people/Roger.Clarke/DV/Biometrics.html

Please note that in a practical case, one shall determine the applicable national privacy laws and apply such national privacy laws. The Directive 95/46/EC provides only for a minimum protection and needed to be implemented by the EU member states. Leaving the member states a choice in some area’s for its implementation, and not forbidding member states to provide a higher level of protection, the Directive 95/46/EC, although having had a harmonizing effect, did not result in uniform national privacy laws.

For France, see the opinion n° 4-017 of 8 April 2004 which was positive for the installation of a biometric system for access control at the airports of Orly and de Roissy under certain conditions. See also opinion n°04-018 of 8 April 2004 which was negative for the installation of a biometric system in a hospital in Hyères for the time control of employees (see http://www.cnil.fr). The use of biometric data was considered not proportional for these purposes.

Other organisations and projects have also reviewed several aspects of biometric identification methods, including the legal aspects. We hereby refer by way of example to the BIOVISION project, which has resulted in the launch of the European Biometric Forum (see http://www.eubiometricforum.com/), the Council of Europe (Progress report on the application of the principles of convention 108 to the collection and processing of biometric data, February 2005) (see http://www.coe.int) and the Organisation for Economic Co-operation and Development (OECD) (report on the use of biometric-based technologies, 28 April 2004). For a list of projects on biometrics and privacy enhancing technologies in the fifth framework program of the EU Commission, see http://www.cordis.lu/ist/directorate_d/trust-security/projects_fp5.htm.

During the enrolment phase, one collects from an individual ‘raw data’, e.g., a three-dimension picture of the face or hand, a fingerprint, a voice sample, ... also defined as biometric samples (see the proposed uniform terms and vocabulary of subcommittee 37 of the ISO JTC on biometric vocabulary (ISO/IECJTC1/SC37N460).

E.g. a database of crime-suspects’ fingerprints held by police authorities.

See also http://www.cesg.gov.uk

See the working document on biometrics adopted on 1 August 2003 by WP29 at http://europa.eu.int/comm/internal_market/privacy/workingroup_en.htm

See e.g., in the Netherlands, where authors make a distinction between on-line and off-line verification systems. They argue that in case of on-line verification systems, the templates, which are compared with templates combined with other personal data, such as name or registration number, in a database, should be considered personal data, while templates stored on e.g. chip card, for off – line verification, should not be considered personal data upon the condition that no other data is used for the verification which could identify the individual (Van Kralingen, e.a, Het lichaam als sleutel. Juridische beschouwingen over biometrie. Iter reeks, 1997, p.32).

For well defined purposes, central storage may be necessary, e.g., the Eurodac database.

However, if the smart card is equipped to allow contactless reading, additional security measures have to be taken in order to guarantee the control by the data subject.

See e.g., ISO7498-2 Security Architecture reference

See Hope-Tindall, Peter, ‘Privacy Architecture’, presentation to Showcase Ontario 2002, 10 September, http://www.enterpriseprivacy.com/Corp2002/2000-09-10Arch_files/frame.htm

See Hope-Tindall, Peter, ‘Privacy Impact Assessment – Obligation or Opportunity : The Choice is Ours !’, paper presented at the CSE ITS Conference, Ottawa, Ontario, 2002, 16 May, http://www.enterpriseprivacy.com/cseits 2002/ITS%20Material.pdf

See also http://www.bioprivacy.org, Note: IBG should not be confused with the U.K. Government Biometric Working Group (BWG) (see http://www.cesg.gov.uk/site/ast/index.cfm?menuSelected=4&displayPage=4)

See http://www.BioSec.org, which started on December 1st, 2003

See www.prime-project.eu.org

PRIME Frameworkdocument v4 final, p. 49-56 and p. 130-132; see http://www.prime-project.eu.org/public/prime_products/deliverables/fmwk/pub_del_D14.1.a_ec_wp14.1_V4_final.pdf

http://www.axsionics.ch

See http://www.ProSection.com

This is just an example. Due to extreme weather and/or light conditions we do not recommend the use of biometric systems in such an environment.

From Sun Microsystems Inc., http://java.sun.com/ products/javacard/ and http://www.javacardforum.org

Global Platform Specifications, http://www.globalplatform.org/

Java Card Biometric API, http://www.javacardforum.org/Documents/Biometry/biometry.html

Java Vard PIN API, http://java.sun.com/products/javacard/htmldoc/javacard/ framework/PIN.html

IBM JCOP Embedded Security Software, http://www.zurich.ibm.com/javacard

ISO/IEC AWI 14443-4 Identification cards: Contactless integrated circuit(s) cards -- Proximity cards -- Part 4: Transmission protocols (Ed. 1)

See http://www.fbi.gov/congress/congress00/kerr090600.htm

Urry, J. (2003). Global Complexity. Cambridge, Polity Press.

http://www.newscientist.com/channel/info-tech/mg18624956.500

See http://www.newscientist.com/article.ns?id=dn1322

Findings of the final Report of the Senate Select Committee on Intelligence and the House permanent select committee on Intelligence joint inquiry into the terrorist attacks of September 11, 2001 – see http://intelligence.senate.gov/press.htm

“US fingerprint checks get mixed responses” - http://www.newscientist.com/article.ns?id=dn4535

Foucault, Micheal. (1977) Discipline and punish: the birth of the prison. Harmondsworth: Penguin

“Surveillance works both ways” - see http://www.wired.com/news/privacy/0,1848,67216,00.html

Nietzsche, F. (1979) Philosophy and Truth: Selections from Nietzsche's Notebooks of the Early 1870's, Prometheus Books, USA.

Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures, O.J., 19 January 2000, L13/12.

For example see the PenOp project

See e.g. in the United States, The federal Electronic Signatures in Global and National Commerce Act

BioVision, Final report on regulatory aspects and data protection requirements, 23 August 2003, also at http://www.eubiometricforum.com

See also http://www.icao.int/icao/en/atb/fal/mrtd/tagmrtd15/docs/TagMrtd15_WP005_en.pdf

http://www.madsci.org/posts/archives/dec2000/976548855.Ge.r.html

http://www.answers.com/topic/polymerase-chain-reaction&method=6

Since 1995 PCR is the only method used by the Bundeskriminalamt (BKA) in Germany; see H. Schmitter, Der ‘Genetische Fingerabdruck’, in: Bundeskriminalamt (ed.): Festschrift für Horst Herold zum 75. Geburtstag, Wiesbaden 1998, S. 397-426

http://www.rechtsmedizin.uni-mainz.de/Remedneu/molgen/dnameth.htm

http://www.crimelibrary.com/criminal_mind/forensics/dna/3.html?sect=21

For the storage the following format is used: <source name> - <locus name> - allele pattern 1/allele pattern 2. The two patterns result from two possible alleles on the two chromosomes of each human being (except the Y chromosome and people with chromosome 21 trisomy). An example for such a dataset could be: <person name> - FIBRA – 21/21, meaning, that the FIBRA-alleles of this person on both chromosomes are identical and 21 repeats long. Since 1998 the Bundeskriminalamt (BKA) in Germany stores the alleles of 8 loci in the so called gene database. See e.g., http://www.polizei.bremerhaven.de/aktuell/index.html?/faelle/hinweise-dna.html

Title:

Denis Royer

2006-08-30T12:19:00