Collaborative Research: Using Generative Models to Evaluate and Strengthen Biometrically Enhanced Systems

提案编号：0430178标题：合作研究：使用生成模型来评估和加强生物特征增强系统PI：丹尼尔Lopresti摘要：这项研究调查了一种新的攻击形式，对生物特征增强的安全机制构成了潜在的威胁。 这种攻击本质上是“生成的”：攻击者从模仿人类行为的一个方面的模型开始工作，并通过直接或间接了解目标用户的生物特征，调整模型以生成用户输入的尝试复制。 在这种情况下，两种类型的安全机制进行了研究：生物特征认证，其中用户的生物特征是由一个不可绕过的参考监测和比较存储的模板;和密码强化，其中用户的密码和在输入密码期间测量的生物特征被组合成密钥（“硬化”密码），即使对于具有创建密钥的设备和软件的完全访问权的攻击者也应该是不可复制的。 生成模型的手写作为一个启用输入，以评估方案执行手写密码验证和创建硬化的手写密码。 攻击者的搜索空间的大小是量化的，假设已经从目标用户收集（或捕获）了各种类别的信息，以及采用人口统计数据。 针对特定用户的声音的语音合成也在这些相同的上下文中进行了研究。 在可能的范围内，确定了改进密码加固以抵御此类攻击的技术。

Proposal Number: 0430178Title: Collaborative Research: Using Generative Models to Evaluate and Strengthen Biometrically Enhanced SystemsPI: Daniel LoprestiAbstract:This research investigates a new form of attack which poses a potential threat to biometrically-enhanced security mechanisms. Such attacks are "generative" in nature: the attacker works from a model for mimicking an aspect of human behavior and, through direct or indirect knowledge of the targeted user's biometrics, adapts the model to generate attempted reproductions of the user's input. In this context, two types of security mechanisms are studied: biometric authentication, where the user's biometric features are measured by a nonbypassable reference monitor and compared to a stored template; and password hardening, where the user's password and biometric features measured during the entry of the password are combined into a secret key (the "hardened" password) that should be irreproducible even to an attacker with full access to the device and software which create the key. Generative models for handwriting serve as an enabling input to evaluate schemes for performing handwritten password verification and for creating hardened passwords from handwriting. The size of the attacker's search space is quantified assuming that various categories of information have been gleaned (or captured) from the targeted user, as well as employing demographic statistics. Speech synthesis for targeting a specific user's voice is also studied in these same contexts. To the extent possible, techniques are identified for improving password hardening to withstand such attacks.