Feeds

Report fingers prints as ID scheme's point of failure

Over 75? Show us your retinas instead

Choosing a cloud hosting partner with confidence

Yet more trouble assails the government’s £4.4bn National Identity Scheme (NIS), as an official report puts the boot into the preferred scheme for “exception handling” – and a bunch of techies show how the recommended system can be beaten.

Official trouble comes in the form of the latest annual report (pdf) from the Biometrics Assurance Group (BAG), published very quietly toward the end of June. It is not hard to see why.

The report expresses particular concern over plans for exception handling of fingerprints: “it would be a large part of the NIS (for example, more than 4 million people are over the age of 75 in the UK, a group for which it is hard to obtain good quality fingerprints).”

It continues: “Exception handling has a large impact not only on the technical elements of the Scheme but on business processes, schedules and costs.” BAG’s solution was to urge the Identity and Passport Service (IPS) to adopt iris scans as a 'fallback' to be used when there are problems taking or matching a fingerprint.

In response, the IPS have said that they are looking for suppliers to provide “cost and performance options, with a minimum level of acceptable performance”, because “if the performance can be met without enrolling iris, the programme would cost less and be delivered more easily”.

In other words: budget constraints are already leading the guardians of the NIS to grasp at the cheaper option and hope for the best.

Despite concerns expressed over the proliferation of different fingerprint readers, the IPS has no plans for a coordinated strategy. Its preference “is to impose minimum standards on suppliers rather than mandating hardware”.

This is where the current project may collide with work done by a group of techies over at IEEE. To understand the problem they pose, it is necessary to rewind slightly.

Over the last few years, schools have started to use automated fingerprint identification systems (AFIS) for registration, library book borrowing and cashless catering. The Information Commissioner warns (pdf) that while this does not necessarily breach the Data Protection Act, “those implementing such systems need to be very careful”, because where “interoperable biometric systems were in common use for identification purposes, the consequences of the loss of one’s fingerprint template could be severe”.

That is (in plain English), if the data is readily transferable out of the school system and real fingerprint information could be extracted, there would be a problem.

However, we have nothing to fear because, as Jim Knight, the Minister for Schools and Learners made clear in a Commons Debate in July 2007, these systems “hold an algorithmic representation of a fingerprint — not the recording of a fingerprint”.

He went on: “It is not possible to recreate a fingerprint using the numbers that are stored”.

Whoops! Here come the techies. In a paper published in the April 2007 issue of the IEEE Transactions On Pattern Analysis And Machine Intelligence, they demonstrate how three key levels of information about the parent fingerprint can be elicited from the “minutiae template” that is created by many scanners. If other information, such as the location of singular points is available, then it is possible that the original fingerprint can be reconstructed in its entirety.

“Minutiae” are fingerprint details matched to co-ordinates – and it is these co-ordinates that are used by a number of school systems to create Jim Knight’s impenetrable algorithm.

So the sort of data that could be used to recreate fingerprints is captured by school systems, albeit in encrypted form, although it is not clear whether sufficient details are captured to reconstruct a whole fingerprint.

If this does turn out to be the case, then it would appear that while one part of government is busy basing the new NIS on a one-strike method of validating id, another bit is equally busy making that method less secure through its desire to see library books returned on time.

Joined up government? Probably not. ®

Beginner's guide to SSL certificates

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
YARR! Pirates walk the plank: DMCA magnets sink in Google results
Spaffing copyrighted stuff over the web? No search ranking for you
In the next four weeks, 100 people will decide the future of the web
While America tucks into Thanksgiving turkey, the world will be taking over the net
Microsoft EU warns: If you have ties to the US, Feds can get your data
European corps can't afford to get complacent while American Big Biz battles Uncle Sam
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.