{"id":1984,"date":"2012-07-30T19:00:07","date_gmt":"2012-07-30T23:00:07","guid":{"rendered":"https:\/\/www.m2sys.com\/blog\/?p=1984"},"modified":"2022-06-17T06:08:35","modified_gmt":"2022-06-17T10:08:35","slug":"black-hat-iris-biometrics-attacks-dont-tell-the-whole-story","status":"publish","type":"post","link":"https:\/\/www.m2sys.com\/blog\/biometric-resources\/black-hat-iris-biometrics-attacks-dont-tell-the-whole-story\/","title":{"rendered":"Black Hat Iris Biometrics Attacks Don’t Tell The Whole Story"},"content":{"rendered":"
\"An<\/a>
Is it really that easy to re-engineer an iris image? Not so fast…<\/figcaption><\/figure>\n

Planet Biometrics released an article today “Iris attacks no surprise to iris recognition inventor<\/strong><\/a>” which details an interview with John Daugman, Professor of Computer Vision and pattern Recognition at Cambridge\u00a0in response to the recent Black Hat conference paper that hacked into an iris system and re-engineered images to fool a recognition device. \u00a0Professor Daugman is credited with developing and patenting the first algorithm for iris recognition which is still widely used across the world.<\/p>\n

Professor Daugman acknowledges in the article:<\/p>\n

“This is a classic ‘hill-climbing’ attack that is a known vulnerability for all biometrics….the vulnerability in question, which involves using an iterative process to relatively quickly reconstruct a workable iris image from an iris template, is a classic “hill-climbing” attack that is a known vulnerability for all biometrics.”<\/em><\/p>\n

The primary vulnerability in the Black Hat conference paper was the full disclosure and access to the Iris Code template, as well as having the ability “to generate an IrisCode template from an image, and to do so repeatedly and iteratively.” In other words, without access to the encoding algorithm or to a hardware device that implements it, the “attack” would not have been possible. Be that as it may, the Black Hat scientists did have access to the encoding algorithm but not all iris biometrics algorithm research and developers give access to the Software Development Kit (SDK) that is needed in order to perform the “attack.”<\/p>\n

According to Daugman, this should be a sign, “to maintain cryptographic security on IrisCode templates” to maintain the highest level of security and thwart would be system attacks. Daugman went on to say that in addition to cryptographic security, there is also the issue of iris hardware detecting an artificial iris vs. a real one. Most of the higher quality iris biometrics recognition systems on the market are equipped with sophisticated technology to detect the presence of an artificial eye and tell when they are being spoofed. The bottom line is that a quality, modern iris biometrics recognition system would not have been fooled by the re-engineered iris image used in the Black Hat conference paper.<\/p>\n