in Transport Smartcard Schemes

collarlimabeansSécurité

23 févr. 2014 (il y a 3 années et 5 mois)

60 vue(s)

Public Attitudes to the use of Biometrics
in Transport Smartcard Schemes



Phil Blythe


Professor of Intelligent Transport Systems

Director:Transport Operations Research Group,

University of Newcastle upon Tyne



SNF Northern Showcase Event, Kingston Park, 26
th

October 2004

Structure


Why Biometrics


Identity Theft


Authentication and
Identification Options


Biometric
Characteristics


Assessment of Options


Applications of
biometrics in Transport


Attitudinal
Questionnaire


Summary of Findings

TORG Research in Area of Smartcards


TORG is an established centre of excellence
in the area of smartcard research.


Research covers application development,
standards, policy, innovative service delivery,
market/business analysis and expert advice
to Governments, local authorities and
agencies.


Developed an innovative solution for smartcard applications
software for a high
-
speed multi
-
lane electronic tolling and

Congestion charging application

Coordinated a highly successful Integrated Applications of
Digital Sites project In the 4th Framework which developed
a framework for future citizen
-
based Smartcards. More
than 2 million cards are now in use.

Developed the University smart campus card using
the DISTINCT architecture

Integrated Transport Smartcard Organisation has developed
an Interoperable ticketing specification for the UK. TORG
undertook the initial auditing role for the ITSO steering
committee As well as a study of the implication for legacy
smartcard ticketing schemes




TORG is a member of the Transport Card Forum Steering Committee

and advises on smartcard standards and emerging technologies

TORG is a member of the eEurope smartcard charter

TORG is a member of the North East Regional Smartcard
Consortium Steering Committee. They provide advice and
research to support the development of a region
-
wide local authority
and transport smartcard scheme

TORG provided expertise to the eEnvoy’s Smartcard Policy
Working Group ( SCPWG) which is developing a policy Framework
for the future of Government Smartcards

TORG provides expertise on policy and standardisation to European
and International bodies

Why Biometrics?


Smartcards are increasingly being used as a
payment and access token by the
transportation sector.


High value ticketing (such as an annual rail
pass) and the need to ensure the card
-
holder
is indeed who he or she is claiming to be
suggest some form of authentication may be
required for certain applications.


Following 9/11 criminal activity is not the only
concern and identity fraud for terrorist
purposes is also a major worry.


Biometrics may offer some solutions to this
problem


but not yet well researched within
the transport sector

Why? Identify Fraud


The total cost of all types of economic fraud in
the United Kingdom is thought to be at least
£13.8 billion per annum (Cabinet Office, 2002).


Of this identity theft/fraud is estimated to cost
the economy a minimum of £1.3 billion each
year, split equally between the public and
private sectors (Secretary of State, 2002).


Whilst in America some 1,200 people suffer
from identity fraud each day (Etzioni, 1999).


There is growing consensus, between the
public and private sectors that the amount of
identity fraud is growing in the UK

The problem is increasing!


Figures from CIFAS, the United Kingdom’s
fraud prevention service showed an
increase of identity fraud of 462% in 2000
compared to 1999 and an increase of a
further 122% in 2001 (Cabinet Office, 2002).


3 Elements that make an identity


1. Biographical identity

-

Which builds up
over time. This covers life events and how a
person interacts with structured society


2. Attributed identity

-

The components of a
person’s identity that are given at birth,
including their full name, date and place of
birth, parents’ names and addresses.


3. Biometric identity
: Attributes that are
unique to an individual, i.e. fingerprints,
voice, retina, facial structure, DNA profile,
hand geometry, heat radiation, etc.




Source: Cabinet Office 2002

Categories of Authentication

1.
Something you know



This generally
involves a password, personal identification
number code, a secret handshake, mother
maiden name etc.

2.
Something you have



This generally
involves some type of ‘token’ to allow
access, e.g. a key, a ticket etc.

3.
Something you are



This is a unique
individual living trait of some kind that an
individual possesses i.e. biometrics.


Level of security increases from 1
-
3



Level of Security

Source: Smartcard Alliance (2002)

A Preference for Biometrics


Biometrics are preferred over the other
categories of authentication, because:


The person who wishes to ‘gain access’ has to
be physically present at the point of
identification.


Biometrics removes the need to remember or
carry any form of token that can be forgotten,
borrowed, lost or stolen.


So, what are the biometric
techniques available?


Primary Characteristics and Requirements:


Universality



Every person must have the
characteristic.


Uniqueness



There must be sufficient
variability of the characteristic in the population
that the application will be used within (no 2
people can be exactly the same).


Persistence


The characteristic must not
change with time or be changeable.


Collectability



The characteristic must be
easily accessible for collection in a quantitative
measurement.


Main Biometric Behavioural and
Physical Characteristics

Physical


Antibody signatures


Blood chemistry


Deoxyribonucleic acid (DNA)


Ear structure


Face


Finger Fingerprint


Hand geometry


Iris scan


Nail bed analysis (ridges in finger
nails)


Odor (scent) analysis


Retina scan


Skull measurement


Sweat pore analysis


Teeth


Vascular (vein) heat patterns


Voice verification (pioneering
technique)

Behavioural


Gait recognition (manner of
walking)


Keystroke dynamics analysis
(typing patterns)


Signature (look)


Signature geometry (look as well as
pen pressure, signature speed etc.)


Driving style


…etc

To be practical?


For transport services the biometric
measure must be:


Readily accessible


Storable (on a smart card/in a central
system)


Non
-
intrusive


Fast(ish) to process


Secure and fraud
-
proof


Address privacy and DPA concerns


…. and be reliable to measure….


….. at an acceptable cost.


Which culminates in a current market
share for the leading techniques:

13%
36%
17%
5%
7%
20%
2%
Voice
Fingerprint
Face
Signature
Iris
Hand
Other
Source, Logica 2002

Considering applications in the
Transport Sector


Airport Security


Airport Check
-
in


General Travel ID


Passport Control


Vehicle Security


Vehicle Preferences
(customised to a
particular driver)


Access Control

Transport Sector Applications


Employees ID


Secure Parking


High
-
Value Ticketing


Identification of
Individuals who may be
exempt from charges
(i.e congestion
charging)


Driving licence

Template: On ID Card?

Hand/Finger Scan



Retina Scan

Determining which biometric
techniques may be acceptable


Prior to considering
what biometric
techniques are most
applicable for
implementation in the
transport sector it is
necessary to obtain a
‘feel’ as to how such
techniques are
perceived and
understood by the
public and which, if any,
is accepted by them

Public attitudes Questionnaire


In the summer of 2003 a questionnaire was
designed that to examine 4 aspects of attitudes
to biometrics
:


To establish whether the population know what biometrics are.


To establish whether the potential user population would be
willing to use a biometric authentication systems in order to
identify themselves.


To establish which would be the most preferred options for the
way a biometric system is setup e.g. storage template method,
most preferred biometric authentication method, etc.


To establish if a biometric system was introduced would there
be a need to educate users how to use it.


Questionnaire


The questionnaire was piloted in July
2003


Surveys took place in Newcastle and
Manchester in July to September 2003


Second Round Surveys
February/March 2004

Sample population by age

61 Or Over
51 To 60
41 To 50
31 To 40
21 To 30
20 Or Under
Missing
Frequency
100
80
60
40
20
0
9
39
52
58
92
8
Female respondents: 130

Male respondents: 127

No gender declared!: 2


Knowledge of biometrics

Knew What Biometrics Means
No
Yes
%
100
90
80
70
60
50
40
30
20
10
0
Gender
Female
Male
Missing
51
47
49
51
Overall:


Yes: 53 responses (20%)

No: 206 responses (80%)


Similar response for

Knowledge of smartcards

Consider themselves IT literate

Consider Themselves To Be IT Literate
No
Yes
%
100
90
80
70
60
50
40
30
20
10
0
Gender
Female
Male
Missing
61
46
38
54
Overall


73% (186) IT Literate

26% (71) not IT Literate

IT Literate by Age

Consider Themselves To Be IT Technology Literate
No
Yes
%
100
90
80
70
60
50
40
30
20
10
0
Age Category
61 Or Over
51 To 60
41 To 50
31 To 40
21 To 30
20 Or Under
Missing
7
32
9
20
20
15
25
21
41
Willingness to accept a smartcard identity
card in order to access certain service?

Willingness To Accept Smart Card ID Card
Def initely
Probably
Unsure
Probably Not
Def initely Not
Frequency
160
140
120
100
80
60
40
20
0
62
146
34
14
Most Preferred Biometric Method

Most Preferred Biometric Method
No Pref erence
Voice
Signature
Iris
Hand
Fingerprint
Face
Missing
Frequency
100
80
60
40
20
0
25
7
11
48
26
94
39
9
Least Preferred Biometric

Least Preferred Biometric Method
No Pref erence
Voice
Signature
Iris
Hand
Fingerprint
Face
Missing
Frequency
80
60
40
20
0
25
63
70
33
4
12
42
10
Rank order of preference

Biometric
Method

Most Preferred
Frequency

Least Preferred
Frequency

Most


Least
Preferred
Frequencies

Rank Order
Preference

Fingerprint

94

12

82

1
st

Hand

26

4

22

2
nd

Iris

48

33

15

3
rd

Face

39

42

-

3

4
th

Voice

7

63

-

56

5
th

Signature

11

70

-

59

6
th

Would you accept a smartcard Identity card if it
contained your preferred biometric method?

Willingness To Accept Biometric Smart Card ID Card
Def initely
Probably
Unsure
Probably Not
Def initely Not
Frequency
160
140
120
100
80
60
40
20
0
65
144
30
12
0
20
40
60
80
100
120
140
Missing
Would definitely not use
Would probably not use
Unsure
Would probably use
Would definitely use
Banking
Transport
Willingness to accept most preferred biometric
method on a bank card or transport card?

Willingness to accept most preferred
biometric method on a bank card
?

Willingness To Accept Most Preferred Biometric Method For Banking
Def initely
Probably
Unsure
Probably Not
Def initely Not
%
100
90
80
70
60
50
40
30
20
10
0
Gender
Female
Male
Missing
45
50
71
56
33
54
50
29
44
67
Breakdown by

Gender

Preference for the storage of the
biometric template

Preferred Method For Storage of Anonymous Biometric Template
WNLBISAT
No Pref erence
On A Smart Card
Central Database
Missing
Frequency
120
100
80
60
40
20
0
40
51
114
53
Would you have privacy concerns if you knew
a Government Organisation had a copy of
your biometric template?

Privacy Concern Level
Def initely
Probably
Unsure
Probably Not
Def initely Not
Missing
Frequency
100
80
60
40
20
0
49
66
43
84
15
0
10
20
30
40
50
60
70
80
90
100
Would use
Would Probably use
Unsure/no opinion
Would probably not use
Would definatly not use
Passport
Airline Boarding
Access Control
High value PT tickets
Charging Exemptions
Driving Licence
Use of biometrics in Transport

Summary


Smartcards clearly offer new means of
payment and access to transport services.


Authentication and the validation of a
persons identity is likely to become more of
an issue as fraud and identification theft
increases


DVLA, Passport Agency and Home office are
all advancing plans for biometric smartcards


Revisions to Homeland Security Act (USA)

Summary (2)


Biometrics offers a range of methods for
uniquely identifying the individual


However, in practice many of these techniques
are not practical for implementation in the
transport environment, either due to cost,
complexity, the intrusive nature of the biometric
or privacy concerns


Few members of the general public are yet
aware and knowledgeable of biometrics of
smartcards


Because of that they tend to select
authentication methods that they are familiar
with and understand (like a finger print)

Summary (3)


A majority of respondents would be willing to have a
biometric on a smart card for general government, transport
and banking applications (with varying degrees of
enthusiasm)


Feel that the biometric information should be retained on
the smartcard


Would have privacy concerns if a Government Agency held
such information


Need for education and making the case why such
biometrics may be needed


New round of surveys are complete


will determine
whether attitudes have changed in the past 18 months and
whether there is now a greater general knowledge of
biometrics and associated issues.