TWC SBE: Medium: Collaborative: Brain Hacking: Assessing Psychological and Computational Vulnerabilities in Brain-based Biometrics

2015年9月，有报道称，黑客从人事管理办公室(OPM)窃取了560万名美国联邦雇员的指纹记录。这是一个严重的安全漏洞，也是一个更大的问题，因为这些指纹现在被永久性地泄露了，用户无法生成新的指纹。这起入侵事件表明了当前网络安全格局中的两个具有挑战性的事实。首先，生物识别凭证很容易受到损害。其次，如果被盗，无法更换的生物识别设备更容易被盗。这项研究将研究一种新型的生物识别技术，可以避免这两个问题。特别是，这项研究将评估大脑生物识别的优势和劣势。大脑生物识别比指纹更难被窃取，因为目前收集大脑生物识别的技术在没有人的知情和同意的情况下是不可能使用的。重要的是，如果大脑生物识别被盗，也可以被取消。这是因为有大量的大脑网络可以产生独特的活动，这意味着如果一个人的大脑指纹被窃取，他们可以通过接入不同的大脑网络来产生新的大脑指纹。这项调查有可能将现有的身份验证系统转变为更安全、更抗攻击的脑生物识别解决方案；这对高安全应用至关重要。最近的研究表明，在50名用户中，脑生物识别在长达一年的时间内对人的识别是100%准确的。这项研究项目将系统地评估脑纹生物识别的潜在脆弱性，目标是1)展示脑纹对最可能的攻击的抵抗力和健壮性，以及2)针对这种方法最脆弱的方面制定全面的保护计划。特别是，跨学科团队计划调查心理和计算攻击。心理攻击包括试图迫使用户在胁迫下提供他们的脑指纹，或试图通过生物反馈诱骗过程模拟目标脑指纹。计算攻击包括试图通过呈现伪造或被盗的脑纹来绕过脑纹认证系统，具有不同程度的混淆，例如添加噪声，并攻击刺激数据库。该项目将以前所未有的详细程度检查大脑生物识别中的潜在漏洞，并将由此产生的知识转化为实施大脑生物识别的建议，以保护日益脆弱的网络空间。

In September of 2015, it was reported that hackers had stolen the fingerprint records of 5.6 million U.S. federal employees from the Office of Personnel Management (OPM). This was a severe security breach, and it is an even bigger problem because those fingerprints are now permanently compromised and the users cannot generate new fingerprints. This breach demonstrates two challenging facts about the current cybersecurity landscape. First, biometric credentials are vulnerable to compromise. And, second, biometrics that cannot be replaced if stolen are even more vulnerable to theft. This research will investigate a new type of biometric that avoids both of these problems. In particular, the research will evaluate the strengths and weaknesses of brain biometrics. Brain biometrics are more difficult to steal than fingerprints, since current technology for collecting brain biometrics is impossible to use without a person's knowledge and consent. Brain biometrics, importantly, can also be cancelled if stolen. This is because there are vast networks of the brain that generate unique activity, meaning that if a person's brainprint is stolen, they can generate a new one by tapping in to a different brain network. This investigation holds the potential to transform existing authentication systems into more secure and attack-resistant brain biometric solutions; critical for high-security applications.Brain biometrics have recently been shown to be 100% accurate in identifying people, in a pool of 50 users and across a period of up to a year. This research project will systematically evaluate the potential vulnerabilities of brainprint biometrics, with the goals of 1) demonstrating the resistance and robustness of brainprints to the most likely attacks and 2) developing a comprehensive protection plan addressed at the most vulnerable aspects of this method. In particular, the interdisciplinary team plans to investigate psychological and computational attacks. Psychological attacks consist of attempting to force a user to provide their brainprints under duress, or attempting to impersonate a target brainprint through biofeedback entrainment process. Computational attacks consist of attempting to circumvent brainprint authentication system through presenting a counterfeit or stolen brainprint, with varying levels of obfuscation, such as the addition of noise, and attacking the stimuli database. This project will examine potential vulnerabilities in brain biometrics at an unprecedented level of detail, and convert the resulting knowledge into recommendations for implementation of brain biometrics to guard an increasingly vulnerable cyberspace.