IBM works toward replacable biometrics

IDG News Service - Biometric security systems have one particularly critical vulnerability: How do you replace your finger if a hacker figures out how to duplicate it? An IBM research team working on that problem says it has recently cracked a major problem in the area of "cancelable" biometrics.

"Biometrics is more private to you than a number that somebody assigned to you. I cannot cancel my face," said IBM researcher Nalini Ratha, a scientist with the Exploratory Computer Vision Group at IBM's Watson Research Center in Hawthorne, N.Y. "If it is compromised, it is compromised forever."

IBM's idea for navigating that obstacle is to construct a kind of technological screen separating a user's actual biological identification information from the records stored in profile databases. The company is developing software to transform biometric data such as fingerprints into distorted models that still preserve enough actual identification markers to make the distortion repeatable.

Organizations that store profiles can then retain just the distorted model, so that if their databases are hacked, the hacker only has access to that organization's profile, rather than to a user's actual fingerprint.

"The key is that it needs to be irreversible," said Charles Palmer, IBM's department manager for security, networking and privacy research. Otherwise, a hacker can simply reverse-engineer the distorted models to recreate a user's biometric data.

Ratha and several colleagues have been working for years on the cancelable biometrics problem, but a big breakthrough came after they began collaborating with researchers on Palmer's team. "We got them together with the cryptographers and applied cryptographic thinking," Palmer said. "[The cryptographers] said, 'You think that's irreversible? Ha! Here's how you reverse it.' '"

About two months ago, the partnership paid off in algorithms that IBM is reasonably confident are genuinely irreversible. A software demo the company showed to journalists this week is functionally ready for trials, researchers said. "The big technical obstacle was beat down," Palmer said. "Now, it's just getting it into the right product or service." IBM Global Services and the company's Tivoli security and systems management software are two likely areas, Palmer said.

IBM's system wouldn't entirely solve the replaceability problem of biometrics: If a hacker got hold of a user's fingerprint and made a passable model, he could still wreak havoc with it. What IBM's technology could do, however, is significantly narrow hackers' opportunities to gain access to such data. If a user's fingerprints (or facial photographs, iris scans or any other biological marker) aren't stored in any of the systems he uses them to access,