The Internet of Things (IoT) is designed to connect, collect and share data through various devices. Machine to machine communications are more frequent today than human to human communications. This communications need to be secured by encryption either symmetric or asymmetric. Everyone has smart devices and everyone might have at least one private key and since the devices are bad at saving them, key derivation might be the answer. This dissertation demonstrates why key management will become crucial in the coming years and why current techniques might be obsolete, thus an investigation of new emerging technologies and techniques is mandatory. Managing keys has two components: generating secure keys and securing the private key once is issued. The trends analysed in this thesis are: Rivest-Shamir-Adleman (RSA) key generation from non-behavioural biometrics, behavioural data as a seed source, and distributed key storage.
The first part of this dissertation is a comprehensive study of multi-biometrics, covering: fusion, security including: template security, key derivation, spoofing, and emerging biometric trends. Spoofing attacks against biometrics are discussed in detail and we’ll demonstrate that a biometric key derivation implementation should use multi- biometrics. The main goal of this chapter is to demonstrate without a doubt that multiple biometric sources have to be used in most biometric applications.
The second part of this thesis is dedicated to the feasibility of implementing a biometric key derivation system without storing the private key. The proposed key derivation system derives a key from user biometrics (single or multiple) and uses that key as seed for RSA. The private key is never stored because it’s derived every time. The key is as secure as the biometric data, thus the system is susceptible to spoofing. This thesis is the first detailed study of a biometric key derivation system under spoofing conditions. We demonstrate that spoofing biometrics can generate the same key leading an attacker to obtain the private key. We propose a practical implementation for a key derivation system using: fingerprint, iris and a fuzzy extractor to generate the biometric key. We run experiments for both single biometric systems (fingerprint and iris) and the multi-biometric system. For the multi-modal system we run experiments when a single trait is spoofed or both and provide a detailed security analysis regarding successful tests and key entropy. Finally we provide a detailed security analysis and implementation blueprint for the proposed key derivation system and we prove that such system shouldn’t be implemented now, unless drastic security measures against biometric spoofing are taken.
The third part of this thesis studies the feasibility of using behavioural biometric data as seed for generation of encryption keys. Almost everyone has a smartphone which is a device with multiple behavioural sensors. The hardest part in generating encryption keys, both symmetric and asymmetric, is the seed. Any encryption system needs a pseudo random number generator (PRNG) to generate the seed. Because a smartphone can acquire vast biometric data, some applications might use this data as a PRNG seed. This way the user can generate it’s own strong encryption keys on the go. We collected data from behavioural sensors and analysed the randomness through all 3 major PRNGs test frameworks. We demonstrate that using data gathered from normal activities such as walking is not random enough, actually it can be predicted and shouldn’t be used for generating encryption keys.
The fourth part of this dissertation deals with key storage. Storing a private key on an encrypted device does little good if the device is left unattended. Another problem is the need to carry the token. In this chapter we propose a new framework for a user centric distributed system, where the user can split the private key and store it on multiple devices. This framework is designed to prevent end users’ most common problem: misplacing the encrypted token somewhere. Further more, we provide a detailed security analysis from which we conclude that the end user has to follow the rules in order for this framework to be effective.