Distributed internet services involve multiple heterogeneous applications that communicate with each other. Guaranteeing their security is in general both mandatory and complex. Amongst the many security requirements that have to be guaranteed, secure user authentication is one of the most fundamental. Authentication is traditionally executed only at login phase, based on username and password. However, a single authentication point may not always guarantee a sufficient degree of security, especially in the context of critical systems. In a previous work we proposed a continuous authentication protocol that applies multiple biometric traits to continuously compute its trust in the user. This paper analyzes the security provided by such solution through a qualitative risk assessment, focusing on both threats related to transmission and specific of the biometric system level. Applying a NIST-compliant threat analysis, we identify the main threats and we assess their impact. Finally, we define the required countermeasures which allow us improving the security of our authentication solution.
Internet services have become extremely important and today expose functionalities in a huge variety of fields, from healthcare and education to business and government. These services should be properly protected from cyber-crimes, which can range from theft of confidential information to cyber terrorism. In fact, attacks conducted against Internet services may even have catastrophic consequences. However, guaranteeing their security is a very complex activity and it usually includes a broad set of requirements like authentication, authorization, confidentiality, privacy, and integrity.
In this paper, we especially focus on authentication, which is defined as the provision of assurance
in the claimed identity of an entity [
An interesting alternative is offered by biometric traits, being them physiological or behavioral
characteristics (as fingerprint or keystroke). Unlike passwords and secrets, biometric traits can be
acquired continuously through time, and in some cases without active participation of the user e.g.,
when a camera is used to collect a face image. In [
In this paper, we present a NIST-compliant [
We consider a set of modifications to the protocol that minimize the risk for all the analyzed threats whose risk is relevant (Moderate or higher), as shown in Appendix A and Appendix B. Those countermeasures, or a subset of them where some are alternative each other, are really recommended to be included. 2
A Web service relies on some of the same underlying HTTP and Web-based architecture as
common Web applications; it is susceptible to similar threats and vulnerabilities. Web services
security is based on several important concepts, including authentication, authorization, integrity,
nonrepudiation, confidentiality, privacy [
At application level, many challenges are traditionally met with existing standards relying on
XML frameworks [
The CASHMA Approach for Continuous Authentication
The continuous authentication protocol proposed in [
The CASHMA authentication service includes: i) an authentication server, which interacts with the clients, ii) a set of high-performing computational servers that perform comparisons of biometric data for verification of the enrolled users, and iii) databases of templates that contain the biometric templates of the enrolled users (these are required for user authentication/verification). The web services are the various services that use the CASHMA authentication service and demand the authentication of enrolled users to the CASHMA authentication server. These services are potentially any kind of Internet service or application with requirements on user authenticity.
Finally, by clients we mean the users’ devices that acquire the biometric raw data corresponding to the various biometric traits from the users, and transmit those data to the CASHMA authentication server as part of the authentication procedure towards the target web service.
The CASHMA authentication server is in charge to transmit a certificate to the client. The certificate is composed by the following information: i) Timestamp and sequence number useful to univocally identify each certificate, and to protect from replay attacks; ii) ID is the user ID, e.g., a number; iii) Decision represents the outcome of the verification procedure carried out on the server side; iv) the expiration time of the session - the absolute instant of time at which the session should expire-, dynamically assigned by the CASHMA authentication server.
The execution of the protocol is composed of two consecutive phases: the initial phase (Figure 2), and the maintenance phase. Initial phase. This phase is structured as follows: Step 0 - The user (the client) contacts the web service for a service request; the web service replies that a valid certificate from the CASHMA authentication service is required for authentication. Step 1 - Using the CASHMA application, the client contacts the CASHMA authentication server. The first step consists in acquiring and sending at time t0 the data for the different biometric traits, specifically selected to perform a strong authentication procedure. The application explicitly indicates to the user the biometric traits to be provided and possible retries.
Step 2 - The CASHMA authentication server analyzes the biometric data received and performs an authentication procedure. Two different possibilities arise here. If the user identity is not verified (the global trust level is below the trust threshold gmin), new or additional biometric data are requested (back to step 1) until the minimum trust threshold gmin is reached. Instead if the user identity is successfully verified, the CASHMA authentication server authenticates the user, computes an initial timeout of length T0 for the user session, set the expiration time at T0+t0, creates the CASHMA certificate and sends it to the client.
Step 3 - The client forwards the CASHMA certificate to the web service coupling it with its request. Step 4 - The web service reads the certificate and authorizes the client to use the requested service until expiration time.
The maintenance phase is composed of three steps, analogous to Step 1, Step 2 and Step 3,
repeated iteratively [
Security solutions in place and assumptions
We identify the following initial set of security solutions and assumptions for our security
analysis. First, all communications between the components of CASHMA architecture are through
encrypted communication channels, using Secure Sockets Layer (SSL). With SSL, the channel is
protected against replay attacks using the MAC (Message Authentication Code) computed from the
MAC secret, the sequence number, the message length, the message contents, and two fixed character
strings [
In this section we perform a qualitative risk assessment of the CASHMA protocol, based on the
methodology of NIST SP-800-30 [
In order to describe the details of the risk assessment, we first introduce some useful definitions
from NIST SP-800-30 [
Vulnerability is a weakness in the system security procedures, internal controls, or implementation that can be exploited by a threat source.
The likelihood of occurrence is a weighted risk factor based on an analysis of the probability that a given threat is capable of exploiting a given vulnerability (or set of vulnerabilities). The likelihood risk factor combines an estimate of the likelihood that the threat event will be initiated with an estimate of the likelihood of impact (i.e., the likelihood that the threat event results in adverse impacts). For adversarial threats, an assessment of likelihood of occurrence is typically based on: (i) adversary intent; (ii) adversary capability; and (iii) adversary targeting.
The level of impact from a threat event is the magnitude of harm that can be expected to result from the consequences of unauthorized behavior.
Risk is a function of the likelihood of a threat event’s occurrence and potential adverse impact should the event occur. 3.2
We first determine which types of threat sources are to be considered during risk assessment. We
consider adversarial threat sources only, as opposed to non-adversarial like human errors, structural
failures or natural disasters. The characteristics of the identified attackers are summarized in Table 1
and are adapted from the quantitative security evaluation of [
A Hacker (Hk) represents an external individual having high technological capabilities but moderate resources. An Insider (Is) is an internal attacker, having minimal capabilities and organization-level resources.
The threat events that we consider can be divided in transport level threats: spoofing, forgery,
unauthorized access, eavesdropping, message corruption; and system level threats: brute force attack,
reuse of residuals, insertion of imposter data, component replacement, database compromise, [4], [
In the following sections, we will rate the likelihood of occurrence as a combination of i) the
likelihood that a threat is initiated, possibly related to the attack gain, and ii) the likelihood that a
threat event, once initiated, will result in adverse impact. The likelihood of occurrence determination
is based on authors’ experience and confirmed by the CVSS framework [
The overall likelihood is expressed in a qualitative scale: Very Low (VL), if the threat event is highly unlikely to occur and have adverse impact, Low (L) if it is unlikely, Moderate (M) if it is somewhat likely, High (H) if it is highly likely, and Very High (VH) if it is almost certain.
As discussed in [
The level of risk is determined as a combination of: (i) the impact resulting from the events; and (ii) the likelihood of the events occurring, as summarized in Table 2.
(Threat Event Occurs and Results in Adverse
Impact)
Spoofing. The spoofing threat (masquerade) is a communication level threat that happens when an
entity pretend to be recognized as a different entity, possibly laying the foundation for other threats
like forgery or unauthorized access [4]. For instance, it can be accomplished using stolen user
credentials. Traditional countermeasures are: the usage of strong authentication, avoiding the storage
of secretes (e.g. passwords) in plaintext, avoiding transfer of credentials in plaintext over the wire, and
protecting communication with SSL [
The threat Spoofing S1 specifically refers to step 1 of the CASHMA protocol (Figure 2): the adversary injects believable biometric raw data into a message, claiming to be C, and obtains a valid certificate from the AS. Noteworthy, the attacker needs previous possession of the biometric raw data of the legitimate user. An Insider may be somehow capable of acquiring the biometrics needed, helped by the proximity and knowledge of C habits. In order to perform step 1 of the protocol and act as being C, it should send the data to the AS. This may be harder for Is because we consider that high skills are needed to circumvent the SSL protocol. We consider as Moderate the overall likelihood. On the contrary, if the threat agent is a Hk, it may be hard to obtain access to the set of biometric raw data remotely. If the data are obtained, the Hk may possess enough capabilities to circumvent SSL protocol. The overall likelihood is Moderate also for Hk.
If the attacker is able to accomplish the spoofing attack, it may lay foundations for subsequent threat events: being recognized as C, and obtained a valid certificate, X may send a valid request to the Web Service. For this reason, we determine as High the Impact of this threat. As shown in Appendix A Table 3, the resulting Risk is Moderate for both the attackers.
The threat Spoofing S2 refers both to steps 1 and 2 of the protocol. On step 1, the attacker spoofs the AS, receives the biometric traits of C, with detrimental effects on C’s privacy. In addition it can be used in step 1 of a subsequent iteration of the protocol to act as being C towards AS (Spoofing S1). As a result, we consider High the Impact of this threat. On step 2, instead, if X can corrupt a certificate and claim to be the AS, the corruption probably provides a fake and useless certificate to C. We consider unlikely to spoof the AS for the Insider and Moderate the likelihood of occurrence of S2 for the Hacker.
The threat Spoofing S3 applies to step 3 of the protocol. The attacker spoofs the WS, receiving the request and a valid certificate from C. These data can be useful in step 1 to spoof C (see Spoofing S1). However, a CASHMA certificate integrates information like timestamp and user ID that protect from replay attacks (see also Message corruption M1). For this reason the impact can be considered Moderate: the gain is not so relevant if the obtained data is not useful for the attacker.
The threat Spoofing S4 applies to step 3 of the protocol. The attacker sends a request with a valid certificate, obtaining the access to the service provided by WS. The impact is High, but we consider the successful reuse of a valid certificate unlikely, because it is univocally identified by Timestamp and sequence number.
Possible countermeasures for threats S1-S4 range from sending the message coupled with its digital signature (measure useful for auditing and as a deterrent), adding a further level of encryption using AS’s public key or avoid passing the raw biometric data over the wire.
Forgery. The forgery happens when an entity fabricates information and claims that such information was received from another entity or sent to another entity [4]. For the CASHMA protocol, we discuss two main forgery threats, F1 and F2, shown in Appendix A Table 4.
For threat Forgery F1, the attacker fabricates one or more biometric traits in order to spoof C’s identity. The occurrence likelihood depends on the kind of biometric traits necessary for the authentication, on their FRR (False Rejection Rate) and on the FRR of the system. However, as discussed for threat S1, we consider unlikely to forge a set of traits and provide them continuously for the remote Hk, and moderately likely for the Is. For this reason, even if the threat has a High impact (especially if the application protected is critical), the risk can be considered low for Hk. Instead, we consider a Moderate risk for the Is. An additional countermeasure useful to reduce this risk is to not transmit raw biometric over the wire. This threat is related to Sensor Spoofing (Appendix B Table 8).
The threat Forgery F2 refers to the forgery of a CASHMA certificate. We can consider Unlikely for the Insider attacker to forge a certificate and Moderate the likelihood of occurrence if the threat source is Hk. The impact is High. As a countermeasure, the message containing the certificate sent on step 3 to the WS, should be digitally signed by the sender.
Unauthorized Access. When an entity accesses data in violation to the security policy in force [4] we have the so called unauthorized access threat event. We comment the two threats U1 and U2, Appendix A Table 5. With the threat Unauthorized access U1, we refer to the event of getting (physically or remotely) possession of C’s device or workstation, but not the critical functions only provided through continuous authentication. We consider the likelihood for a remote attacker (Hk) as Moderate, and High for the Is. However, the resulting impact and risk are Low, because as we defined in Section 2.3, no biometric data is stored on the device.
The threat Unauthorized access U2 refers instead to the access to the critical functions/services protected with the continuous authentication. Proper configuration of security permission is able to mitigate this threat. No modifications to the protocol are required in this case. We rate the likelihood and the related risk as Low. No additional countermeasures are proposed for these two threats.
Eavesdropping. Eavesdropping (or Sniffing) is a breach of confidentiality by unauthorized
monitoring of communications [4]. We detect the threats E1, E2, and E3 for CASHMA, shown in
Appendix A Table 6. A sniffing happens when an attacker captures packets from the network and
reads the data content in search of sensitive information like biometric data, secret keys, certificates or
any kind of confidential information. Traditionally, the full encryption of communication, including
credentials, prevents sniffed packets from being usable to an attacker. SSL is an example of
encryption solution [
The threat Eavesdropping E1 refers to the sniffing of the message on step 1, containing the biometric raw data of C. Referring to Section 2.3, the message on step 1 is transmitted through an SSL channel, thus it is encrypted with a session key that only C and AS know. We consider Moderate the likelihood of occurrence for E1 if the attacker possesses high capabilities, as the Hk, and Low if is Is. The impact is High, because obtaining the biometrics may cause identity theft. Possible countermeasures are a subset of what proposed for the Spoofing threats: adding a further level of encryption using AS’s public key or avoid passing the raw biometric data over the wire.
The threat Eavesdropping E2 refers to the sniffing of the message on step 2 or step 3, containing the CAHSMA certificate. Again, we assess the likelihood as Moderate for Hk and Low for Is. The impact can be considered Moderate, as discussed for Spoofing S3 threat, being that the CASHMA certificate contains ID and timestamp that protect from replay attacks.
Message Corruption. The message corruption threats refer to the situation in which the integrity of transferred data is compromised by unauthorized copying, deletion, insertion, modification, reordering, replay or delay [4]. For the CASHMA protocol, we detect the set of message corruption threats shown in Appendix A Table 7. Referring to Section 2.3, the SSL encryption and the MAC address protect the protocol from this threat.
The threat Message corruption M1 happens when the attacker copies and replays one of the messages, for instance the message sent on step 1 containing the biometrics of C. We consider as Low the impact of the simple replaying of a message (without modification) thanks to the SSL encryption already available as discussed above.
The threat Message corruption M2 applies to the deletion of a message sent on steps 1 to 4. If the message on step 1 with biometric traits is deleted, no verification is done. However, it does not have any relevant consequence in terms of security. If the message on step 2 containing the certificate is deleted, the client has to restart from the first step of the protocol. If the message sent on step 3 with the certificate is deleted, the client has to send the same message again, or if the session is expired, restart from step 1. Finally, if the “access granted until timeout” message (step 4) is deleted, C waits for the message until the session expiration. We can consider all these threats together having a Low impact and a resulting Low risk.
The threat Message corruption M3 refers to the insertion of a message in between the information
flow from sender and receiver (from C to AS, from AS to C, from C to WS or from WS to C). The
impact is Moderate, being that the insertion of a message can be used for instance to conduct a
spoofing threat. However, in CASHMA messages from one party cannot be inserted into the other's
output, since they use independent MAC secrets [
The threat Message corruption M4 represents a resequencing attack conducted against AS. Again, it is not likely due to the encryption obtained with SSL. Moreover, the impact is limited. For instance, inverting messages in step 2 and 4 would make C thinking to be able to access the WS, when actually it is not. So it just results in unsatisfied user due to unavailable or delayed service.
For threat Message corruption M5, we can distinguish four events, one for each step from 1 to 4. Step 1: The attacker corrupts the message with the biometric traits of C, but cannot act as C. The corruption makes the verification procedure to reject C, causing a DoS. Step 2: The attacker corrupts the message containing the certificate, alters the timestamp, the sequence number, the expiration time, the decision, with remarkable consequences for the subsequent steps. Step 3: The attacker alters a valid certificate, generated for C when it is being sent to the WS. This impacts the next step. Step 4: if messages are corrupted by X, the WS denies the access for C or grant it for a time window lower than normal, thus provoking a Denial of Service. 3.4
In this section we analyze a set of system level threats, shown in Appendix B Table 4, which are
typical of a biometric system [
Brute force. Brute force attacks in general rely on computational power to crack secrets secured with hashing and encryption. The Brute Force B1 threat refers to the submission of a huge set of biometric traits to the sensors embedded or connected to the client workstation with the objective of finding a trait (or a set of traits) that let the attacker to be authenticated. However, the CASHMA protocol as it is should maintain Low the impact of this threat, because the number of retries is limited, as discussed in Section 0. As a result, also the risk is Low for both the attackers.
Sensor Spoofing. An attacker provides a set of fake physical or digital biometric traits designed to
circumvent the biometric system. The CASHMA system integrates a multi-modal biometric system:
the user has to provide a set of traits in order to be authenticated. The multi-modality itself can be
considered a first defensive measure to this threat [
Reuse of residuals. An attacker gains somehow access to valid biometric data and reuses it. As discussed in the assumptions, no biometric data is saved on client’s device. However, is important to defend from this threat, because the attacker may obtain data in other ways (i.e. through Eavesdropping). The risk is Moderate and the Impact is considered High for the Hk attacker. An effective defensive measure is prohibiting identical samples being used consecutively.
Database compromise. An attacker obtains access to template repository and is able to read,
modify or substitute templates. We consider Low the likelihood of this threat: we assume that the
CASHMA authentication server implements a very efficient and complete set of access control
mechanisms. However, the impact of this threat is very high for template security and users’ privacy,
and, as a consequence, the risk for Hk is Moderate. To reduce the risk, may be necessary to introduce
additional defensive measures as biometric cryptosystems or cancellable biometrics. With cancellable
biometrics, only the transformed data are stored and if these data are compromised, a new transform
can be applied, thus replacing the original template [
This paper presents a qualitative risk assessment of a biometric continuous authentication protocol. The CASHMA protocol guarantees high security of user session, monitoring in background the user’s actions, through a continuous and transparent acquisition of multiple biometric traits, and computing an adaptive, trust-based, timeout. Nevertheless, we show that the introduction of some additional defense measures would considerably increase system’s security.
Our assessment complies with NIST methodology: we identify the main threats both for the transmission and the biometric system level; we assess the likelihood of occurrence and the impact for each threat, distinguishing two different attackers’ profiles. Then, we determined the risk related to each threat occurrence. The assessment highlighted a set of threats whose risk is considerate Moderate and for which we discussed further security countermeasures as additional encryption layers, or templates protection solutions. The modifications are capable of reducing the risk for all the threats considered and for this reason are recommended to be included in the protocol or in the architecture.
In future work, we plan to investigate the possibility to introduce modifications to the CASHMA protocol in order to provide additional security requirements as, for instance, the non-repudiation of user actions.
This work has been partially supported by the project DEVASSES, funded by the European Union's Seventh Framework Programme for research, technological development and demonstration under grant agreement no PIRSES-GA-2013-612569, and by the Joint Program Initiative (JPI) Urban Europe via the IRENE project. [4] ETSI TS 102 165-1 V4.1.1 (2003). Telecommunications and internet protocol harmonization over networks (TIPHON) release 4; protocol framework definition; methods and protocols for security; part 1: Threat analysis. Technical Specification. Appendix A. Risk Assessment and Countermeasures for Transport Level Threats
1) Digital signature of the message. 2) Additional encryption of the message with
receiver’s public key. 3) Do not transmit raw biometric data over the wire:
encrypt biometric data on client-side Risk L M M L
Countermeasures Do not transmit raw biometric data over the wire: encrypt biometric data on
client-side Digital signature of the message.
VL L L L VL L L L
New Risk Assessment Likelihood Impact Risk
L H L L H L L H L
New Risk Assessment Likelihood Impact Risk
L H L
H M M H H H H H
L L L L L L L L
New Risk Assessment
Likelihood Impact Risk Eavesdropping
E1 Eavesdropping
E2 M L M L L L L L L L L M M L
The attacker submits a huge set of biometric traits to the sensors embedded or connected to the client workstation to find a trait (or a set of traits) that let
him/her authenticate An attacker provides a set of fake physical or digital biometric traits designed to circumvent the biometric
system An attacker gains somehow access to
biometric data and reuses it.
An attacker obtains access to template repository and is able to read, modify and substitute the templates.
Hk Is Hk Is Hk Is Hk Is
L M L M M L L VL
L L H H H H VH VH
L L L M M L M L Attacker
Risk Assessment Likelihood Impact
Risk L L L L L VL n/a n/a H H H H H H n/a n/a L L L L L L