An approach to Improve the Match-on-Card Fingerprint Authentication System security

Identity authentication has become an essential component for access control in the Internet of Things (IoT) environment. To overcome the inherent weakness of password-based authentication, many present IoT devices (e.g., commercial banking smart cards) are equipped with the fingerprint authentication mechanism. However, due to the resource constraints of IoT devices, oversimplified authentication schemes are deployed, which compromise system performance significantly. Moreover, fingerprint templates in these existing schemes are unprotected. To address these issues, we propose an IoT-oriented privacy-preserving fingerprint authentication system. The proposed system is composed of four main components: 1) minutiae extraction; 2) the minutia cylinder-code (MCC)-based cancelable binary template, generated by the proposed normalized random projection; 3) the lightweight, privacy-preserving template, built by novel pairwise Boolean operations; and 4) fingerprint matching. Our system can effectively mitigate preimage and hill-climbing attacks. A prototype of the proposed system is developed using a popular open-source platform (i.e., Open Virtual Platforms). Comprehensive experimental results on eight benchmark data sets validate the effectiveness of the proposed IoT-oriented fingerprint authentication system. Our system also achieves equivalent authentication accuracy to that of the unprotected fingerprint authentication systems deployed in the resource-rich, non-IoT environment. More importantly, our system prototype is deployable to commercially available low-cost smart cards, such as Atmel AT24C256C Memory Smart Card 256K Bits. To the best of our knowledge, the proposed system is the first privacy-preserving, cancelable fingerprint authentication system developed in such a resource-constrained IoT setting.

Fingerprint recognition has widespread security applications owing to its uniqueness, permanence, and simplicity in capture. However, conventional fingerprint authentication systems face high false acceptance and rejection rates and susceptibility to spoofing attacks. To address these issues, this study proposes a deep learning-based fingerprint authentication system using a Convolutional Neural Network (CNN) with five convolution layers to derive robust spatial features. The model was trained and cross-validated on the SOCOFing dataset with regularization and data augmentation to enhance generalization and spoof resistance. Experimental results show that the proposed CNN achieved a training accuracy of 99.10% with a loss of 0.0223 and a validation accuracy of 98.89% with a loss of 0.0114. Moreover, the model maintained a low false acceptance rate of 0.33% and false rejection rate of 0.25%, demonstrating its efficacy and credibility for secure and real-time biometric authentication. A rigorous comparison with conventional CNN models and DCCN architectures confirmed that the proposed model provides higher accuracy, lower computational cost, and stronger resistance to spoofing attacks. These findings indicate that the proposed system successfully addresses existing limitations and offers a practical, scalable, and reliable solution for fingerprint verification using deep CNN architectures.

Smart cards and biometrics can be effectively combined for personal authentication over the open network. The combination is achieved as two-step authentications in which the smart card is authenticated based on a Public Key Infrastructure (PKI), and the card-holder is authenticated using the template stored in the smart card based on the biometrics verification. The biometrics verification has to be executed in the card for security purposes. This paper describes that one is fingerprint verification method that can be embedded in a smart card. And the other is biometrics-based personal authentication system in which a smart card, a PKI such as an X.509 certificate, and fingerprint verification technologies are combined.

To heighten the biometrics security level, the biometrics feature extraction and verification need to be performed within smart cards, not in external card readers. However, the smart card chip has very limited processing capability, and typical fingerprint feature extraction and verification algorithms may not be executed on a state-of-the-art smart card. Therefore, this paper presents a system-on-chip (SoC) implementation of the fingerprint feature extraction algorithm which can be integrated into smart cards. To implement the ridge-following algorithm onto the resource-constrained SoCs, the algorithm has been modified to increase the efficiency of the hardware. Each functional block of the algorithm has been implemented in hardware or in software by considering its computational complexity, cost and utilization of the hardware, and efficiency of the entire system. The proposed system operated in 50MHz, and 20~50 minutiae could be extracted from typical 248timestimes292 fingerprint images in real time with our small area implementation (97K gates). Our current implementation developed as an IP for SoCs targeted for ARM CPU and AMBA bus can also be extended for many other smart card configurations

A robust anonymous biometric-based remote user authentication scheme using smart cards

With the spread of the Internet, social networks, messengers, etc. and their penetration into all spheres of life of the modern individual, the number of attempts to obtain unauthorized access to personal information of users is increasing. Accounts are the most vulnerable target for hacking. Among the most common types of attacks - phishing, theft of cookies, use of keyloggers, brute force. Social engineering techniques have become very popular among attackers. Using a password in the form of a set of letters, numbers, and special characters is no longer sufficient to provide the required level of account security. The introduction of combined systems increases the number of identification features and increases data security. Systems based on contactless smart cards, USB keys, hybrid smart cards, bioelectronic systems can be used as additional protection mechanisms. One of the main recommendations for avoiding the consequences of fraudulent actions is double or multifactor authentication to verify the identity of the client (requiring users to provide data, such as a password, using other factors, such as a text message / SMS code or fingerprints). Multi-factor authentication should be used on all available Internet services, where possible, to ensure an acceptable level of security. There are two main types of multifactor authentication: the MFA application, an authentication process that is activated when a user tries to access one or more applications, and the MFA device, an authentication process that immediately activates the MFA at the login point. One of the most common authentication factors is the phone number. Email codes, text tokens, biometric verification, hardware tokens, security issues (secret issues) and more are also used.

With the wide use of personal consumer electronics devices such as smartphones, people store sensitive and confidential information more on their devices. Active authentication (AA) systems continuously authenticate users to reduce possible attacks after a successful login on the device. In this article, we propose match-on-card (MOC) approach for a secure active authentication scheme using touchscreen for smartphones to enhance the security and privacy and decrease the performance overhead on the consumer device. We train a Deep Neural Network (DNN) model, and store the model on the smart card available on the device for user authentication. To implement the user verification on smart cards, we quantize inputs to the model and the model's parameters. A speed-up technique is added to the verification phase to improve the execution time. Evaluation results show that with a well configured DNN model, our on-card authentication reaches an Equal Error Rate (EER) of 2.6% for 15 strokes and verification time of 0.65 second for each stroke. Considering the average user's stroke frequency of 1 stroke/s, our proposed scheme shows the potential for mobile MOC active authentication using touchscreen gestures on consumer devices.

The impacts of smart cards on hospital information systems—An investigation of the first phase of the national health insurance smart card project in Taiwan

One of the most secure medias in where to store personal a sensible data, are smart cards. They can provide security through cryptography and secret keys. Unfortunately, they suffer a lack of security when the card holder identity is to be authenticated. The only way, nowadays, to achieve such a task is through Card Holder Verification Keys, which are closely related to the Personal Identification Number (PIN). The author, aware of this problem, has worked in enabling a Biometric Authentication inside a smart card, in order to provide the same level of security that PINs have, without being able to be copied. After studying several biometric techniques, he has developed, up to today, three of them (based on Voice, Hand Geometry and Iris). Therefore, he has obtained the conclusions needed to integrate the Biometric Authentication into the Operating System of a Smart Card. Using JavaCards, prototypes have been developed, taking several tests to prove the viability of them. Results obtained, specially the ones using the RISC-based JavaCard, show the possibility of launching a commercial product, without going to an expensive masking level of development.

This paper presents a high-secure fingerprint authentication system using ring learning with errors (ring-LWE) cryptography to protect users’ fingerprint data more securely. A delay-optimized high-accuracy scheme for a fingerprint-features extraction approach is proposed to collect necessary features’ information from fingerprint images. In addition, a ring-LWE cryptography scheme using low-latency number theoretic transform (NTT) polynomial multiplications is deployed to speed up the ring-LWE encryption and decryption times. As a result, the processing time of the fingerprint authentication system is significantly reduced, and the fingerprint data are effectively protected. The simulation results show that the proposed NTT multiplication-based ring-LWE cryptography scheme for fingerprint features outperforms the existing works up to 46% and 44% in terms of encryption time and decryption time, respectively. The latency of the whole fingerprint authentication system is less than 160 ms, which makes it suitable for practical applications. Furthermore, performance analysis on entropy and similarity of the encrypted fingerprint features proves the domination of the proposed system compared with the previous systems in terms of confidentiality.

Within the improvement of Information Technology era, many business enterprises, academia institutions and banks in various regions around the world are enthusiastic and looking into the future by producing an all-in-one smart card with Europay, MasterCard and Visa (EMV) protocols for their employees, students or customers. This smart card can be used in different fields such as ID card, debit/credit card, transportations, healthcare, communication networks, loyalty, etc., with high level of security. This paper gives the reader an overview of the evolution of smart card and the important benefits derived over the existing traditional magnetic stripe card. The paper aims to study the following five key elements: Importance of EMV, EMV Implementation in Bahrain, Obstacles and Constraints, Customer Satisfaction, and EMV Future in Bahrain. The results of the study reveals that Bahrain is on its approach towards the EMV migration and will definitely be ready for rollout in the coming few years. It was also demonstrated that even though adopting EMV smart card technology may cost the organization a lot, it would be on the other hand very beneficial to them in many different aspects. Furthermore, it was provided that moving toward smart card in general will differentiate Bahrain and will put her among the leader. This paper can be used as a basis for further researches to improve specific aspects of the evolution of smart card and EMV Migration in the Kingdom of Bahrain or elsewhere. It will also provide a useful input for other local banks and/or organizations that have not proceed towards smart card adaptation yet.

Digital Rights Management (DRM) system is the effective schemes for digital transactions. A novel authentication scheme of DRM system for remote users based on multimodal biometrics (such as iris and face feature) verification and watermarking and smart cards is described in this paper, which include two authentication phases, i.e. the client server authentication and the server authentication. For the client server authentication, we integrate watermarking technique and multimodal biometric system which is based on highly secure iris recognition and face recognition to provide more secure and reliable personal recognition. In watermarking algorithm, face image is chosen to be the host image, iris feature is selected to use as watermark hidden in the host face image. For the server authentication, the proposed scheme is an extended and generalized form of ElGamal signature scheme whose security is based on discrete logarithm problem, which is not yet forged. So the proposed scheme can achieve the rights management of digital content exactly through the illegal user access control. Meanwhile, the bimodal biometrics (iris and face) recognition provides the improvement in the accuracy performance of the system.

In this paper, we use an authentication system that combines Biometrics, Visual cryptography and One-Time password (OTP). We propose a basis matrix construction method for generating shares in visual cryptography technique. Generated shares are in mutually orthogonal groups so that only shares from the same group can reveal the original image. The system provides the user a share of the biometric data and keeps the other share in the server itself. The security of our scheme is based on biometric verification using visual cryptography and hash of a OTP. Therefore, the scheme is appropriate to be used in applications such as smart card and device authentication systems.

Now-a-days, hackers are using many techniques to steal passwords such as shoulder surfing, guessing, snooping, sniffing, etc. There is no strong authentication to protect user data. Proof of identity for authentication serves as the frontline of cyber security. The proposed system provides authentication through three-factor credentials using an IoT testbed. The three factor credentials are password, smart card and biometric scanner for providing more security to user details. This system can be used anywhere, where security is the critical issue. This paper describes encryption and decryption process using AES algorithm and the authentication is provided to the user data using smart card and biometric scanner.

Empowering robust biometric authentication: The fusion of deep learning and security image analysis