Biometric technology is already changing the world in which we live. However, misconceptions and misinformation regarding privacy breaches, accuracy levels, and security risks are hampering the widespread adoption of biometrics around the world.
In this post, we are focussing on the secure storage of biometric data and we are also going to look at some of the common myths associated with the secure storage of biometric data, the accuracy levels, and the cost of adopting biometric authentication technology.
What is biometric data?
Before we dive into the storage of biometric data, let’s first take a look at what exactly is biometric data and how is it collected.
Biometrics are a way to utilise a person’s physical characteristics to verify their identity and to answer a fundamental security question – are they who they say they are? Biometric information is digitised by converting biometric data (the ridges on a fingerprint, for example) into biometric templates using special formulas or algorithms.
To be useful, biometric data must be unique, permanent, and collectible. Once captured, the biometric is compared and matched in a database. Biometric security solutions include DNA, fingerprint, iris recognition, voice recognition, facial recognition and even behavioural characteristics like the way you type on a keyboard or use your computer mouse.
How is biometric data collected?
When storing, processing and using biometric data for authentication, the first stage is the capture of a person’s biometric identifier (also known as enrolling the person). Once a piece of biometric data is captured it cannot be amended.
Unlike a password, you can’t forget a biometric identifier like your fingerprint or voice. Once this data has been captured, it is then analysed and converted into a biometric template. This is a binary mathematical representation of the original biometric identifier (like a fingerprint for example). To be clear, a biometric template is not an exact copy of the biometric data but rather a file representing unique numerical data points of the data which is converted with a secret, proprietary algorithm.
This template cannot be backwards engineered into a picture of a fingerprint, face, or iris. Hence, digital biometric data is significantly more secure than an exact copy or a photograph as without the proprietary algorithm, no one can decode the biometric template.
How is biometric data stored?
Now we understand more about how biometric data is collected, it’s important to understand how that data is stored.
Biometric templates are binary files and encompass unique traits of an individual’s biometric data. unreadable without the right algorithm. There are several storage-based strategies for biometric data that organisations can employ. These include:
On-device storage
Biometric data can be stored on an end user’s device. This is most common on smartphones that use touch ID fingerprint sensors, such as Apple’s ‘Secure Enclave’.
On-device storage can be used to store biometric data through a chip that holds the data separately to the device’s network. Many of the new biometric bank cards which have been trialled in the last few years work using this system.
When storing the data on the authentication device itself, the organisation implementing the biometric verification process doesn’t have control over it.
This type of biometric storage is especially secure because it does not store any sensitive data on servers in large databases.
Hardware recognition system
A hardware-based recognition system is where the data is stored on a specific piece of hardware and works with the device to recognise the data, without storing the data on the device itself.
This offers a fast response during user authentication as the biometric templates are stored locally and the recognition system does not require any external response.
Portable token
Biometrics stored on portable tokens — security cards or USB drives, for example — work in much the same way as on-device biometric storage. Biometric information is stored on a single device and that device must be presented during authentication for verification purposes.
Biometric tokens tend to be a bit more costly to implement than the alternative because they require both the token and a separate biometric scanner, though the added step also adds another line of security.
Another benefit of storing biometric data on a portable token is that it doesn’t need to be transferred over a network for verification purposes, and so this reduces the risks that can come with network-related vulnerabilities.
Database server
At times, local device storage is not feasible. Large corporations who use biometric authentication to grant special user access and permissions, for example, might prefer biometric database storage as opposed to local device access only.
A biometric database server is one of the more cost-effective methods of biometric data storage, although it is more susceptible to cyber threat due to the network-based approach.
As the data is held on an external server, one of its benefits is that it allows for a multi-location verification process. To reduce the risk of the data being breached, it should be encrypted when transferring over the network. The issue with encryption is deciding where encryption keys will be stored and who will be trusted with access.
Keep in mind however, that even if the system is breached and the biometrics “harvested”, without the secret and proprietary algorithm, the biometric data cannot be interpreted.
Distributed data storage
Distributed data storage is a further method which stores the biometric templates on a server and a device – a method which is essentially a double-backed storage solution.
The biometric data will be broken up into smaller, encrypted files and stored separately on the server and the storage centre of the authentication device.
By storing the data this way, it makes it harder for a cybercriminal to access the data, as they would need to get into both points.
This method offers security and privacy without sacrificing usability or scalability.
Blockchain data storage
Encrypted biometric templates can further be protected by splitting the information into “shares” and storing each individual “share” in separate locations. For example, part or “share” of a person’s biometric template can be stored on the individual’s mobile device and the other on a server or blockchain.
Blockchain is a form of decentralised data storage. The concept of blockchain comes from the notion that publicly stored blockchain data cannot be manipulated without altering other data sets along the “chain”.
How secure is your stored biometric data?
One of the biggest barriers to adoption has been security concerns around the storage of biometric data. However, much of this concern is misplaced. While the storage of your biometric data is obviously important, there are many misconceptions about what a biometric actually “is” and what can be done with it.
Take facial recognition as an example:
- When you create a facial recognition template from a face, whether this is in real-time, in person or using a photograph, the biometric is not the image or the photo and it is NOT the facial image or photo that is stored.
- What is created (i.e. the “biometric”) is actually a proprietary, mathematical interpretation of the subject’s face and any original picture or video is discarded and is not stored. This mathematical interpretation is called the facial “template”. This facial template is proprietary to the facial recognition solution provider.
- It is impossible to interpret or even read this template without the vendor’s secret, proprietary algorithm to decode it.
- Lastly, even when the template is decoded using this secret algorithm, this does not and never can recreate the face used to create the template to begin with. Recreating the original face or photograph from the facial template is simply impossible. It is akin to recreating a complete person from a shoe print left in the dirt.
So, the fear that once a person’s biometric is compromised, that the hacker can recreate the person’s original face, fingerprint or whatever the biometric happens to be, is simply misplaced.
Without the vendor’s secret, proprietary algorithm to decode it, your biometric is useless to a hacker and is still secure. Far more secure than passwords and the like that are either stored in clear text or can be easily decrypted with brute force attacks. Neither of these is possible with a properly created biometric.
Biometric authentication is therefore one of the most secure ways possible to prove that a person is who they say they are.
This leads us nicely into our myth-busting section which aims to dispel some of the common myths around biometrics, particularly around security, cost, and accuracy.
Biometric myth-busting
There are a number of common misconceptions about biometric technology – here are some of the most common questions we see:
1. Can cybercriminals steal my fingerprint or facial ID?
We’ve already touched on this above. However to clarify, biometric data is initially extracted from an image, but the image itself is not what’s used in the authentication process.
The original sample, whether it’s an image of a face, fingerprint, iris or otherwise, is discarded and replaced by a mathematical file called a biometric template. The template is a digital reference of the unique characteristics found in that initial image.
There are a number of methods used to safeguard these biometric templates, including distributed data storage.
“Having biometric data encrypted in this way renders it useless to a hacker,” says James Stickland, chief executive of Veridium. “This can be done without making any organisation the custodian of the data, as biometric templates can be stored in a decentralised location, leveraging this distributed model and effectively minimising the risk of a data breach.”
2. Biometrics are easily replicated
Along with questions around the security of the storage of biometric data, the question as to whether biometrics are easily replicated is extremely common, largely down to the misrepresentation of biometrics in the movies.
“Despite what we see in Mission Impossible or similar action movies, biometrics are actually quite difficult to replicate,” says Dr Toby Norman, co-founder and chief executive of Simprints. “The large majority of vendors have implemented liveness detection and other forms of anti-spoofing within their solutions that render it increasingly challenging to fake a biometric.”
NEC is one of the pioneers of Liveness Detection technology that can analyse images and distinguish between an attempt to spoof a biometric authentication system versus an authentic attempt made by a live human being.
3. Biometric data is unreliable and inaccurate
Whilst detractors of biometric technology question the reliability, biometric authentication has already proven to be far more reliable than traditional authentication methods such as passwords.
Password verification accounts for more than 80 per cent of cyber breaches, according to a 2021 Verizon report. Biometric technology on the other hand boasts much better security performance and high accuracy levels.
Many biometric technologies are not new. Facial recognition and fingerprinting have been around for decades and during that time, technological advances mean that the accuracy of these biometric technologies has advanced. According to a study by the National Institute of Standards and Technology (NIST), fingerprinting has an accuracy of more than 99 per cent and NEC has been a leader in both facial recognition and fingerprint recognition testing carried out by NIST.
4. Biometrics are expensive and aren’t cost effective in the long term
Historically, cost has been a major prohibitor to the wider adoption of biometric authentication technology, however, the advances in technology mean that the cost of biometrics is falling all the time.
“Ultra-accurate face verification is now more or less free in the cloud from vendors such as Microsoft, Amazon and others,” says Andrew Bud, chief executive at iProov. “This makes it possible for even small companies to develop very high-performance systems that cost very little to run.”
Raconteur reported that, “As a result of what’s commonly known as “password fatigue”, many users are regularly resetting passwords and calling IT helpdesks. Veridium estimates that businesses with 10,000 employees spend around $1.9 million annually on password resets. So swapping or enhancing traditional password authentication with biometric data can also mean big cost-savings for businesses.”
FAQs Biometric Data
How are fingerprints stored?
Like forms of biometrics, fingerprints are stored on a biometric template – a digitised version of the fingerprint that has been collected by a fingerprint reader for example. This template is then stored in a database and can only be accessed using a unique algorithm that is capable of “reading” the template and authenticating an individual if there is a match.
How can you protect biometric data?
It is the responsibility of the organisations collecting biometric data to ensure that data is stored securely and we have already touched on some of the tactics being deployed to keep biometric data secure. Biometric authentication is one of the most secure ways of identifying that a person is who they say they are. Biometric systems are extremely difficult to infiltrate and the data stored is redundant without the proprietary algorithm to “read” the stored data. Companies that store biometric data will often deploy anti-spoofing technology, multifactor authentication and other cybersecurity measures to protect the databases where biometric data is stored.
Where does Android store fingerprint data?
Many of today’s modern smartphones include some form of biometric authentication and the most common is fingerprint recognition. It is important to understand that your data is stored securely on your device when you submit your fingerprints as a way of accessing your phone and specific apps.
Your fingerprint data is stored in a Trusted Execution Environment (TEE) – a separate and isolated area in the phone’s hardware.
According to Android Central, “a TEE might use its own processor and memory or it can use a virtualized instance on the main CPU. In both cases, the TEE is fully isolated and insulated using hardware-backed memory and input/output protection. The only way you will be getting in is if the TEE lets you in, and it never will. Even if the phone is rooted or the bootloader unlocked, the TEE is separate and still intact.”
This applies to all mobile devices, not just Android, however, with Android, Google goes one step further with their Trusty TEE – a very small and efficient operating system, appropriately named Trusty OS, runs on the TEE hardware and kernel drivers allow it to communicate with the system.
Summary
Biometric authentication technology is here to stay and over the next decade, we can expect to see an overwhelming adoption of the technology worldwide.
The COVID-19 pandemic has accelerated the need to create frictionless and contactless environments across a wide range of sectors, particularly the travel and hospitality sectors and those businesses that were early adopters of biometric technology are reaping the benefits as they have been some of the first companies to be able to offer contactless experiences throughout the pandemic.
Biometric data is helping to make the world more secure and convenient. Following common-sense guidelines like these will help to not only protect your privacy but help the wider rollout of biometric authentication. You can read more about biometric authentication in our post Which biometric authentication method is most secure.
Related articles
Let’s Connect
Complete our quick and easy contact form and one of the team will be in touch.