Collaborative Research: Using Generative Models to Evaluate and Strengthen Biometrically Enhanced Systems

协作研究：使用生成模型评估和加强生物识别增强系统

• 批准号: 0430178
• 负责人: Daniel Lopresti
• 金额: $ 28.8万
• 依托单位: Lehigh University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2004
• 资助国家: 美国
• 起止时间: 2004-12-01 至 2008-11-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0430178&HistoricalAwards=false
• 关键词: Collaborative; Research; Using; Generative; Models

Proposal Number: 0430178Title: Collaborative Research: Using Generative Models to Evaluate and Strengthen Biometrically Enhanced SystemsPI: Daniel LoprestiAbstract:This research investigates a new form of attack which poses a potential threat to biometrically-enhanced security mechanisms. Such attacks are "generative" in nature: the attacker works from a model for mimicking an aspect of human behavior and, through direct or indirect knowledge of the targeted user's biometrics, adapts the model to generate attempted reproductions of the user's input. In this context, two types of security mechanisms are studied: biometric authentication, where the user's biometric features are measured by a nonbypassable reference monitor and compared to a stored template; and password hardening, where the user's password and biometric features measured during the entry of the password are combined into a secret key (the "hardened" password) that should be irreproducible even to an attacker with full access to the device and software which create the key. Generative models for handwriting serve as an enabling input to evaluate schemes for performing handwritten password verification and for creating hardened passwords from handwriting. The size of the attacker's search space is quantified assuming that various categories of information have been gleaned (or captured) from the targeted user, as well as employing demographic statistics. Speech synthesis for targeting a specific user's voice is also studied in these same contexts. To the extent possible, techniques are identified for improving password hardening to withstand such attacks.

提案编号：0430178标题：协作研究：使用生成模型评估和加强生物识别增强系统PI：Daniel Lopresti摘要：这项研究调查了一种对生物识别增强安全机制构成潜在威胁的新型攻击。 此类攻击本质上是“生成式”的：攻击者根据模仿人类行为某个方面的模型进行工作，并通过直接或间接了解目标用户的生物识别信息，调整模型以生成用户输入的尝试复制。 在这种情况下，研究了两种类型的安全机制：生物特征认证，其中用户的生物特征由不可绕过的参考监视器测量并与存储的模板进行比较；密码强化，其中用户的密码和在输入密码期间测量的生物特征被组合成一个秘密密钥（“强化”密码），即使对于完全访问创建密码的设备和软件的攻击者来说，该密钥也应该是不可复制的钥匙。 手写生成模型可作为评估执行手写密码验证和根据手写创建强化密码的方案的启用输入。 假设已从目标用户收集（或捕获）各种类别的信息，并使用人口统计数据，则可以量化攻击者搜索空间的大小。 在这些相同的环境中也研究了针对特定用户声音的语音合成。 在可能的范围内，确定了改进密码强化以抵御此类攻击的技术。