Biometric system security

The terrorist events of 11th September have resulted in an increased focus an security technologies, not only for Internet technology, but also for secure travel, ID documents and government applications. It seems that the usage of biometrics over the last few years has clearly shifted to a solution and application-oriented approach. The adoption of integrated solutions using smart cards, PKI and biometrics will make today's and tomorrow's world much more secure. Although still a relatively new technology, biometrics has been promoted as the ultimate security panacea that an its own fulfils all security needs, making a system simultaneously convenient and secure. But recently the hype seems to have shifted to the opposite point of view, the publications of Matsumoto [14] or similar papers [9,16,17,20,21,23] have proven how easy it has been to spoof fingerprint systems with faked fingers. Even if such findings have already been reported some time ago, these recent publications seem to aggressively towards a general condemnation of the technology, doubting its usability at all. This paper gives an overview of the major aspects of biometric system security, trying to draw a broader picture an security issues of systems using biometrics. Security will be defined and analyzed in a general IT security setup. A special focus an the categorization of attacks and appropriate preventative measures leads to a system solution understanding of biometric system security and thus enables a more distinct view an the applicability and limits of the only technology available today that can really identify humans: biometrics.