A Survey of Security and Privacy Issues for Biometrics Based Remote Authentication in Cloud <s> Introduction <s> Establishing identity is becoming critical in our vastly interconnected society. Questions such as "Is she really who she claims to be?," "Is this person authorized to use this facility?," or "Is he in the watchlist posted by the government?" are routinely being posed in a variety of scenarios ranging from issuing a driver's license to gaining entry into a country. The need for reliable user authentication techniques has increased in the wake of heightened concerns about security and rapid advancements in networking, communication, and mobility. Biometrics, described as the science of recognizing an individual based on his or her physical or behavioral traits, is beginning to gain acceptance as a legitimate method for determining an individual's identity. Biometric systems have now been deployed in various commercial, civilian, and forensic applications as a means of establishing identity. In this paper, we provide an overview of biometrics and discuss some of the salient research issues that need to be addressed for making biometric technology an effective tool for providing information security. The primary contribution of this overview includes: 1) examining applications where biometric scan solve issues pertaining to information security; 2) enumerating the fundamental challenges encountered by biometric systems in real-world applications; and 3) discussing solutions to address the problems of scalability and security in large-scale authentication systems. <s> BIB001 </s> A Survey of Security and Privacy Issues for Biometrics Based Remote Authentication in Cloud <s> Introduction <s> With their increasing popularity in cryptosystems, biometrics have attracted more and more attention from the information security community. However, how to handle the relevant privacy concerns remains to be troublesome. In this paper, we propose a novel security model to formalize the privacy concerns in biometric-based remote authentication schemes. Our security model covers a number of practical privacy concerns such as identity privacy and transaction anonymity, which have not been formally considered in the literature. In addition, we propose a general biometric-based remote authentication scheme and prove its security in our security model. <s> BIB002
Amount of digital content has been growing day by day with the exponential increase in number of devices connected to Internet. High volume data not only demand for huge storage space, but also looking for intelligent processing in a cost-effective manner. The popular choice in such cases is the cloud environment, which provides unlimited storage space, on demand service, parallel processing and rapid distribution of data. Cloud service provider provides a flexible way for users to access their data from anywhere and at any time. The flexibility of data usage however takes away control from the data owner. Thus the manner in which data are accessed, and by whom, is essentially under the control of cloud service provider. In such a scenario, the authentication of user is very important, so as to guarantee security of data and privacy of data source. Remote user authentication mechanism is useful in distributed domain to identify validity of remote users. There exist several techniques for remote authentication. Some of the essential requirements for enhancing quality of remote authentication in cloud are given below. • Third party cloud service provider is not able to retrieve original data, or associated metadata stored in cloud. • Ensure that an impostor cannot be impersonated as a legitimate user. • System should be capable to respond to any incoming valid request. • No intruder is allowed to modify original message. • If timestamps are used, then it must be synchronized. • System must optimize bandwidth usage in a cost effective manner. Password-based authentication with smart card can be used to identify the validity of a remote user. Traditional identity-based authentication mechanisms are mainly based on password, which are very easy to break because of its simplicity. Cryptographic secret keys can also be used in remote authentication framework. Major drawback is that they are difficult to memorize, lost or even be stolen. As a result, it is very difficult to identify valid users accurately. As opposed to traditional password based remote user authentication, biometrics based authentication is increasingly popular because of its reliability BIB002 and efficiency to authenticate remote users. Cloud based remote authentication provides enhanced security by using biometrics traits BIB001 such as fingerprint verification, keystroke analysis, ECG analysis, iris analysis, facial analysis, handwritten signature verification etc. Each biometrics trait used in authentication has its own strengths and weaknesses. Biometrics based authentication may be unimodal having single biometrics trait or multimodal, combining multiple biometrics features. Cloud based biometrics technology has high potential market value and attracts interest of many researchers from all around the world. Cloud framework and remote authentication technique have several challenges of their own. Preserving a balance between security and privacy is a major concern in remote framework of cloud. Privacy is the ability to decide what information should go where. Security acts as significant safeguard for privacy by protecting data. Security and privacy are often considered from two complementary angles. Despite a couple of surveys of biometrics authentication or remote authentication, a comprehensive survey of biometrics based remote authentication in cloud does not exist. The main objective of this paper is to study the balance between security and privacy in biometrics based remote authentication and point out the research gap in this domain. The contributions of this paper are as follows. ─ To extensively survey some of the existing schemes that may be used for biometrics based remote authentication in cloud and determine general trends. ─ To discuss open issues for future research area. The rest of the paper contains the following. Section 2 gives a brief introduction of security challenges faced by biometrics techniques. Section 3 presents an extensive survey of some of the existing schemes in this area. Section 4 gives a comparative analysis of this study. Section 5 presents the open research issues in this area, and section 6 concludes the paper.