Over the last several years, as IT professionals have become more and more active in discussions about physical access control systems, there has been a continual call for convergence, convergence and more convergence. Yet, physical access control systems that are joined with logical access control systems are hard to find. The reason may be found in the cards. Could it be that security managers and IT managers have different requirements for what makes a card secure?
If the card reader can read a card and extract a unique number from it, that is all that is needed in most physical access control security applications. The proximity (or similar) card sends a signal to the reader that says, “I am 10101,” and the reader verifies whether or not 10101 is a number that will direct it to open the lock on the door. The theory is that this is the only 10101 in existence, it has not been duplicated and that the person carrying 10101 is authorised to do so. For most physical access control applications, this suffices.
Most card readers used in physical access control cannot do much more than perform this simple interrogation of the card with a number stored in it. As one surveys such readers from an IT manager’s viewpoint, it becomes clear that their use in a secured, converged system is limited. IT managers, who constantly worry about hackers and other intruders into their data systems, cannot and will not approve such an easy way to get onto their systems. Does this incongruence in credential security make convergence less likely?
What does the IT manager want?
IT professionals want strong authentication credentials – the level of security provided by smartcards. Contrary to proximity cards and their readers, smartcards go through a challenge and response sequence to initiate conversations with the network. Card signatures are checked to make sure the card is indeed authentic and exhibits no tampering. Communications are encrypted using industry standard encryption techniques.
With the price of smart credentials now comparable to that of proximity cards, there seems to be no reason not to deploy smart credentials immediately, even if the only application is physical access control. A smart credential provides a much higher level of security than today’s most popular card credential, the proximity card.
Contrary to door keys, magnetic stripe cards or proximity cards, smart credentials have inherent security that makes them more difficult to duplicate. Mutual authentication ensures that the reader and the card are allowed to talk with each other before any information is exchanged. AES 128-bit key encryption helps protect sensitive information. Diversified keys virtually ensure no one can read or access the holder’s credential information without authorisation. These security features ensure complete and unmodified transfer of information, helping to protect data integrity and prevent outside attacks.
In this way, IT managers are able to see a digital signature – a mathematical scheme for demonstrating the authenticity of a digital message or document. The benefits are numerous. First of all, a valid digital signature gives a card reader – and the access control application – reason to believe that the message was initiated by a known sender and that it was not altered in transit.
Secondly, digital signatures can be used to authenticate the source of messages. Although messages may often include information about the entity sending the message, that information may not be accurate. When ownership of a digital signature secret key is bound to a specific user, a valid signature shows that the message was sent by that user.
Thirdly, in many scenarios, both the sender and receiver of a message need confidence that the message has not been altered during transmission. Although encryption hides the contents of a message, it may be possible to change an encrypted message without understanding it. If a message is digitally signed, any change in the message after signature will invalidate the signature.
The case for single sign-on
The bottom line is that IT systems depend on keeping the private key secret. In most cases, though, the key is stored on the network, protected by a local PIN. Here, the IT manager sees two immediate problems: a PIN can be stolen and the security of the private key depends entirely on the security of the network, the very entity the IT manager wants to protect.
An IT manager would prefer that the private key be stored on the smartcard. Even if the network is hacked, the key is not there; it is on the smartcard in the holder’s wallet or purse. If the smartcard is stolen, the thief will still need the PIN code to generate a digital signature. (This reduces the security of the scheme to that of the PIN system, although only when the attacker possesses the card.)
Thus, it is easy to see why smartcards provide a strong security authentication for enterprise single sign-on (ESSO) within organisations. However, there still remains one problem with all the above. Access to the system starts with a PIN or a card, either of which can be stolen. That is why there is a need for one more improvement that will really make the IT manager happy: biometrics.
Enter biometrics
Enabling an ESSO system with the latest generation of biometric sensors provides a more convenient and more secure solution. Biometrically-enabled electronic software suites further leverage the advantage. With the simple touch of a finger, users can log into multiple applications and provide an irrefutable audit trail.
Both access control and IT managers realise that necessary security solutions cannot interfere with employees doing their jobs effectively, efficiently and safely. With a biometrically-enabled ESSO, one simple enrolment allows multiple uses across the whole enterprise, from entering the employee-only area to going into the warehouse, even using the POS system or entering time and attendance data. This holistic view of enterprise security is vital and provides an integrated identity management system that is much more reliable and cost-effective as it eliminates the problems of having multiple identities tracked over an ever-increasing number of disconnected access points.
When did biometrics become an asset?
The promise of biometrics – worry-free performance seen in the lab – was not fully realised in the field for many years. The core problem has been that conventional biometrics technologies rely on unobstructed and complete contact between the fingerprint and the sensor, a condition that is elusive in the real world, a world that can be wet, dry, or dirty.
However, that was then; this is now. Multispectral imaging is a sophisticated technology specifically developed to overcome the fingerprint capture problems that conventional imaging systems have in less-than-ideal conditions. This more-effective technology is based on the use of multiple spectrums of light and advanced polarisation techniques to extract unique fingerprint characteristics from both the surface and subsurface of the skin. That subsurface capability is important because the fingerprint ridges seen on the surface of the finger have their foundation beneath the surface of the skin, in the capillary beds and other sub-dermal structures.
Unlike surface fingerprint characteristics, which can be obscured during imaging by moisture, dirt or wear, the 'inner fingerprint' lies undisturbed and unaltered beneath the surface. When surface fingerprint information is combined with subsurface fingerprint information and reassembled in an intelligent and integrated manner, the results are more consistent, more inclusive and more tamper resistant.
Creating an identity and access management (IAM) system
Today, decision-makers can finally raise the bar on enterprise security without raising the complexity for their users. Biometrics has become reliable enough to deal with the fundamental issue of knowing ‘who’ to a much higher degree of confidence. Knowing who makes it possible to design systems that enable rather than block and creates a wide range of identity management solutions that span convenient theme park entry to secure ATM transactions. In short, by making biometrics authentication a practical reality, CIOs can lower risks, reduce costs and improve efficiencies. In fact, by linking physical identity to a myriad of digital identities, identity and access management (IAM) solutions become much more powerful.
There is no meaningful access management without first establishing the ‘who’ in transactions. Who is accessing my facility? Who is punching the time clock? Who is withdrawing funds from that ATM? The question is always, “Who?”
Until now most systems, generally based on cards, tokens, PINs or passwords, could not guarantee with any degree of certainty the holder of the card, PIN or password. They are, at best, tools to provide an approximate identity. Thus, a person can present a credential – something they know like a password or something they have like a swipe card – to ‘authenticate’ their identity. But these credentials alone simply cannot substantiate identity.
Thus, while access and authorisation have always been granted to individual people, knowing a password or having a key is only superficially related to the authorised person, and neither can establish who. Only a biometric can do that. Add to that the new reality that most everything we do, buy or access is moving more and more onto smart mobile devices. Because we have so many digital identities to remember, these devices are being used to authenticate online transactions and are the containers for our most secure credentials.
NFC-enabled smartphones are likely to make matters even worse. It is now possible to replace cards with virtual credentials on a smartphone. These credentials, when linked to one’s unique identity, provide an easier, simpler way to pay for merchandise. The customer just taps her smartphone to the cash register. NFC-enabled smartphones could also be provisioned to provide access to buildings, data or devices.
The simple problem here is that virtual credentials still only verify that somebody has the phone. Without a biometric you can only hope that the person using the phone is the person who is authorised to use it.
That shows again why user authentication, and specifically biometric identity management, is becoming more and more important.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version