Part 2 – Identity Assurance by Our Own Volition and Memory

Identity Assurance

We believe that the reliable identity assurance (See part 1) must be built on three prerequisite principles as follows.

  • Volition of the User – with Self-Determination,

Identity authentication with no confirmation of the user’s volition would lead to a world where criminals and tyrants dominate citizens.

  • Practicability of the Means – for Use by Homo sapiens

Mathematical strength of a security means makes sense so long as the means is practicable for us Homo sapiens.

  • Confidentiality of the Credentials – by ‘Secret’ as against ‘Unique’.

Being ‘unique’ is different from being ‘secret’. ‘Password’ must not be displaced by ‘User ID’.

These prerequisites are especially important for Self-Sovereign Identity. Any one of them missing, it does not qualify as a valid identity authentication means. Claiming otherwise ends up with spreading a false sense of safety.

The emphasis on volition also indicates that our proposition of EPS presupposes the societies where people respect democratic values and is in return expected to support the democratic values.

Identity Assurance in Emergency

How can we login reliably in a panicky situation?

It is the obligation of the democratic societies to provide the citizens with identity authentication measures that are practicable in these emergencies. Using unforgettable images will help.

Scope of Enterprise

Multi-factor authentications and ID federations (single-sign-on services and password management tools) are operated with the password. The password is also indispensable for the biometric products operated in cyber space as a fallback means against false rejection. And yet, passwords have been hard to manage.

With billions of people suffering the same big digital headache, the problem to be addressed by our solution is huge, Substantial market opportunity is anticipated for the most practicable solutions to the issue of shared secrets for reliable identity assurance.

Specifically, without the reliable digital identity assurance, such emerging industries and critical infrastructures as below would be infeasible.

  • Self-Sovereign Identity
  • Electronic Healthcare
  • Pandemic-resistant Teleworking
  • ICT-assisted Disaster Prevention, Rescue & Recovery
  • Hands-Free Operation of Wearable Computing
  • Hands-Free Payment & Empty-Handed Shopping
  • Humanoid Robots
  • Internet of Things

And, needless to say, Cyber Defense & Law Enforcement.

Recent Developments in Biometrics

Half year ago we felt a big shockwave to have heard a mind-boggling report of unnecessary deaths presumably brought by biometrics misunderstood from India where the biometrics; is mandatory for its Aadhaar-based Public Distribution System. There have since been intriguing new findings.

According to a report from India, actual False Acceptance Rates turned out to be 6% for fingerprints and 8.5% for iris scans in the large-scale use case of Aadhaar, which may look far higher than you have heard. And, a follow-up report says that a lock function has been introduced for the biometrics data.

By the way, the reports refer to ‘failure’ or ‘glitch’ of biometrics, but it is not necessarily correct. ‘False Rejection’ as against ‘False Acceptance’ is inherent in biometrics; there is no biometrics that is free from False Rejection. Let us explain this point closely.

A graph (*1) below shows the False Acceptance Rates (FAR) and False Rejection Rates (FRR) of two biometrics products – one relatively more accurate and the other less accurate.

What this graph indicates is, firstly, that FAR and FRR are not the variables that are independent from each other, but are dependent on each other.

A FAR could be fixed only against a certain FRR, i.e., both variables can be positioned only at the same single point on the same single curve. In other words, the couple of a FAR and a FRR can exist only in a certain combination.

Secondly, it also indicates that the lower a FAR is, the higher the corresponding FRR is. The lower a FRR, the higher the corresponding FAR. That is, FAR and FRR are not just mutually dependent but are in a trade-off relation.

The level of a FAR that rejects a twin would have to bring the level of a FRR that rejects the registered user very frequently. The level of a FRR that eliminates the need of a fallback means would have to bring the level of a FAR that accepts nearly anyone.

Thirdly, also indicated is that the more accurate the biometrics sensor becomes (the lower the Equal Error Rate becomes), the curve goes downwards/leftwards in this graph. But, when a FAR is 0 (zero), the corresponding FRR still remains close to 1 (one). When a FRR is 0 (zero), the corresponding FAR remains close to 1 (one).

Another graph (*2) helps us to grasp how FAR and FRR are mutually dependent and also in a trade-off relation.

Move the threshold to the right (more strict) and we would see the combination of a lower FAR and a higher FRR. Moving it to the left (more lenient), the outcome would be the combination of a higher FAR and a lower FRR.

The presence of False Rejection, however close to 0 (zero) the rate might be, would require a fallback means against the False Rejection.

If the officials responsible for the Aadhaar-based PDS had been informed of the above, they must have provided a fallback means in case of the false rejection. Then this kind of misery could have been avoided. We have to wonder how it was possible that these people were not advised of the issue of false rejection.

The touted merits of biometrics were (a) security higher than passwords and (b) convenience better than passwords. We have been trying to demystify (a) and the actual case of Aadhaar and the like will hopefully be demystifying (b).

Thought Experiment in Two-Factor Authentication

A very strong passwords supposed to not be remembered and written down on a memo should be viewed as ‘what we have’, definitely not ‘what we remember’, so it could be used as one of the two factors along with a remembered password.

Although it may not be able to compete with a 2-factor scheme involving a PKI and OTP-based authenticator, a ‘boring legacy password system’ can be a two-factor authentication system made of ‘what we remember’ and ‘what we have’ just by verifying two passwords per access.

The merit of this plan is that the two-factor effects could be somehow achieved straightaway WITHOUT involving any costs of delivering and certifying the hardware tokens.

This kind of simple no-cost 2-factor schemes could have long been in broad use but it did not happen. We are wondering what prevented it from becoming popular. (Good security solutions come with a big price tag in many cases, so we might have taken it for granted that a solution coming with no big price tag cannot be a good solution. Was it?)

This could be viewed just as a thought experiment or could be considered for practical application between a single factor authentication and a costly heavily-armored 2-factor scheme.

What is needed in Brain-Machine-Interface

As for Man-Machine-Interface for EPS that accepts images in addition to characters, we already can rely on:

  • clicking and tapping on the images randomly positioned
  • typing the characters randomly allocated to images

We will easily be able to rely on:

  • eye-tracking the images randomly positioned
  • voice-recognizing the characters randomly allocated to images
  • voiceless-voice-recognizing the same
  • tapping secret signals on a pad when hearing the sounds that the users had registered (for the blind people)
  • tapping signals when feeling the tactile sensation that the users had registered (for the blind & deaf people)

All the above can be achieved by deploying the off-the-shelf technologies. The next task is the interfaces for the people who cannot rely on any of the above. Here enters the possibility of BMI/BCI.

A simple brain-monitoring of the user’s eye-tracking has a problem in terms of security. The data, if wiretapped by criminals, can be replayed for impersonation straight away. Therefore the data should be randomized as the disposable onetime ones.

One idea is that the authentication system allocates random characters to the images. The users focus their attention on the characters given to the registered images. The monitoring system will collect the brain-generated onetime signal/data responding to these characters. If intercepting successfully, criminals would be unable to impersonate the users because the bugged data are onetime and disposable.

By Hitoshi Kokumai

Alex Tkatch

Dare to Innovate: 3 Best Practices for Designing and Executing a New Product Launch

Best Practices for Designing and Executing a Product Launch Nothing in entrepreneurial life is more exciting, frustrating, time-consuming and uncertain than launching a new product. Creating something new and different can be exhilarating, assuming everything ...
Chris Collins

How The Cloud Put Customers First During COVID-19

Tech’s True Value in a Crisis One of the cloud’s biggest assets has always been crisis preparedness—because when disaster strikes, you don’t have to worry about the viability of on-premise servers or the availability of ...
Juan Pablo Perez Etchegoyen

7 Security and Compliance Considerations for Cloud-Based Business Applications  

Security and Compliance Considerations There’s no doubt on-premises deployments of mission-critical business applications provide more control over data as it resides within the four walls of an organization’s network infrastructure. However, businesses can no longer ...
Kash Shaikh

A Clairvoyant Look Back on 2021

In a lookback from the future, here is what happened in 2021 as reported on January 1, 2022. 2021 was the year that our world worked its way out of the 2020 pandemic and back ...
Ronald van Loon

Reimagine Contact Centers with AI and Cloud

Contact Centers with AI and Cloud Contact centers have experienced overwhelming strain since the onset of the pandemic and for many organizations this chaotic trajectory has continued. In the travel industry, for example, airlines are ...

PROXY SERVICES

The CloudTweaks technology lists will include updated resources to leading services from around the globe. Examples include leading IT Monitoring Services, Bootcamps, VPNs, CDNs, Reseller Programs and much more...

  • Smartproxy

    Smartproxy

    Smartproxy is a rising star in the constantly growing proxy market. Smartproxy offers awarded customer service, impressive performance, and is serious about your anonymity (yes, cybersecurity matters). The latest features developed by Smartproxy are 30 minute long sticky sessions and Google Proxies. Rumor has it, the latter guarantee 100% success rate

  • Bright Data

    Bright Data

    Bright Data’s network is one of the most robust of its kind globally. Here are its stark advantages: Extremely stable connection for long sessions (99.99% uptime guaranteed). Free to integrate with our Proxy Manager which allows you to define custom rules for optimized results. Send unlimited concurrent requests increasing speed, cost-effectiveness, and overall efficiency.

  • Rsocks

    Rsocks

    RSocks team offers a huge amount of residential plans which were developed for plenty of tasks and, most importantly, has been proved to be quite efficient. Such variety has been created on purpose to let everyone choose a plan for a reasonable price, online, rotation and other parameters.

  • Storm Proxies

    Storm Proxies

    Storm Proxies' network is optimized for high performance and fast multi-threaded tools. You get unlimited bandwidth. No hidden costs, no limits on bandwidth. Try Storm Proxies 100% Risk Free. If you are not happy with the service email us within 24 hours of purchase and we will refund you.