Collaborative Research: Using Generative Models to Evaluate and Strengthen Biometrically Enhanced Systems

提案号：0430338标题：合作研究：使用生成模型来评估和加强生物特征增强系统[j]: Fabian monrose摘要：本研究探讨了一种对生物特征增强安全机制构成潜在威胁的新攻击形式。这种攻击本质上是“生成”的：攻击者从模仿人类行为的一个方面的模型开始工作，并通过直接或间接地了解目标用户的生物特征，调整模型以生成用户输入的尝试复制品。在这种情况下，研究了两种类型的安全机制：生物特征认证，其中用户的生物特征是由不可绕过的参考监视器测量的，并与存储的模板进行比较；密码加固，即用户的密码和输入密码时测量的生物特征组合成一个密钥（“加固”的密码），即使攻击者可以完全访问创建密钥的设备和软件，这个密钥也应该是不可复制的。手写生成模型作为一种启用输入，用于评估执行手写密码验证和从手写创建强化密码的方案。假设已经从目标用户收集（或捕获）了各种类型的信息，以及使用人口统计数据，攻击者的搜索空间的大小是量化的。针对特定用户声音的语音合成也在这些相同的背景下进行了研究。在可能的范围内，确定了改进密码加固以抵御此类攻击的技术。

Proposal Number: 0430338Title: Collaborative Research: Using Generative Models to Evaluate and Strengthen Biometrically Enhanced SystemsPI: Fabian MonroseAbstract:This research investigates a new form of attack which poses a potential threat to biometrically-enhanced security mechanisms. Such attacks are "generative" in nature: the attacker works from a model for mimicking an aspect of human behavior and, through direct or indirect knowledge of the targeted user's biometrics, adapts the model to generate attempted reproductions of the user's input. In this context, two types of security mechanisms are studied: biometric authentication, where the user's biometric features are measured by a nonbypassable reference monitor and compared to a stored template; and password hardening, where the user's password and biometric features measured during the entry of the password are combined into a secret key (the "hardened" password) that should be irreproducible even to an attacker with full access to the device and software which create the key. Generative models for handwriting serve as an enabling input to evaluate schemes for performing handwritten password verification and for creating hardened passwords from handwriting. The size of the attacker's search space is quantified assuming that various categories of information have been gleaned (or captured) from the targeted user, as well as employing demographic statistics. Speech synthesis for targeting a specific user's voice is also studied in these same contexts. To the extent possible, techniques are identified for improving password hardening to withstand such attacks.