Sensor Uses Body's Electrical Signature To Secure Devices
coondoggie writes with word that a "group of researchers is proposing a sensor that would authenticate mobile and wearable computer systems by using the unique electrical properties of a person's body to recognize their identity. In a paper [presented Monday] at the USENIX Workshop on Health Security and Privacy, researchers from Dartmouth University Institute for Security, Technology, and Society defined this security sensor device, known as Amulet, as a 'piece of jewelry, not unlike a watch, that would contain small electrodes to measure bioimpedance — a measure of how the body's tissues oppose a tiny applied alternating current- and learns how a person's body uniquely responds to alternating current of different frequencies.'"
Yet more ways to use "infallible" dowsing rods and iris gazers to "do identity". It always comes down to this: By definition biometrics are easier to fake than to replace. This makes them unsuitable for "casual" identification, as opposed to "adversarial" identification, ie working out it was you that stole the cookie from the jar. We're not all criminals, you know. Worse, most identification isn't adversarial, but casual, and on top of that you don't just have but a single identity. Yet that's what all this is invariably targeted at: adversarial, and just the single identity. Just stop it already. I'll take the inconvenience of using a key to unlock the door, or showing a loyalty card with a fake name on it, thanks. At least that key and its lock can be replaced without surgery.
In cybersecurity news, it was found today that a mannequin made of jello and floating grapes successfully duplicated the unique electrical signature of Mark Zuckerberg's body.
Sorry, but gray text on gray background is making my eyes bleed.
Device generates the signature, then it exists in a digital form and can be replicated or spoofed.
Like any other biometric measure, it can be faked.
Electrical properties of living creatures are not really known for being stable, particularly among sick people, the intended users for this device. Good thing that the summary has so little to do with the paper, because the summary is pretty silly
Calling it Amulet while having the form factor of a watch is somewhat misleading, I was thinking how a necklace could possibly have a secure enough interface to the body to measure the required responses.
But that's the least of my worries. Body impedance can be dependent on quite a lot of things, such as hydration, and skin resistance, which is again dependent on many factors, such as the temperature, stress, etc. Could such a small device carry a sophisticated enough algorithm to reliably and quickly account for all these factors to establish the identity? Or would I need to wear the device for months so it can learn all my electrical characteristics? What if I gain implants later on: a pacemaker or artificial heart would significantly alter my impedance, likely requiring a re-calibration.
If these problems can be worked out,the technology has promise. If not, a coordinating watch for a personal area network still seems like a good idea, some way or another...
Hyperbole: I use it liberally!
Seriously, the first four comments are all about how easy this will be to fake out!
I'm going to make a comment about how awesome science is.
SCIENCE!
Biometric is great, but it's only useful locally to the biometric hardware. Beyond that, all there is is ones and zeroes, whether they originated from a biometric sig or not. I suppose you could use these biometrics to generate a key pair...but then you have a problem both of non-repudiation (the actual bits of the private key are compromised...what can you do?) and unintentional repudiation (I'm pregnant, now I can't log into my bank account).
If your bitterest enemies are people who hack the heads off civilians, then I would say you're doing something right.
cover your eyes, or they will find you...
If it's looking for bioelectrical signatures, it likely will have more trouble identifying you when you are dehydrated, drunk, high, out of breath (from running or experiencing a heart-attack), etc...
I'm sorry, but I'm afraid I can't let you do that right now because you are not Dave...
On the other hand, if you loosened the identification threshold so these kind variations didn't matter, there probably wouldn't be much entropy left in that identification scheme. Someone with a simliar height and build would probably be easily mistaken for you.
Perhaps this is the next amazing biometric authentication technology that can accurately identify users without any false positives... This still don't change the problem that like all other biometric data it cannot be re-issued if ever compromised.
I wonder what are the implications for the Quantified Self movement (life loggers, self trackers, etc.)? Perhaps, this signature could be used as a anonymous biometric ID that could link together data from different tracking devices?
-------
I am trying to quantify and gamify my everyday life. Please follow my experiment at www.measuredme.com
Just a small nitpick (the error is in the article too).. It's Dartmouth College, not Dartmouth University... ( Those that love Dartmouth will be quick to point this out.. It stems from http://en.wikipedia.org/wiki/Dartmouth_College_v._Woodward )
that all cryptographers or other folks who make this sort of thing assume that everyone wants: 1 password, 1 username, 1 identification and the like? I figure that the people making these things are the people who are most keyed into technology, and are therefore incredibly cognisant of the need for multiple/anonymous identities. So, I would assume that folks doing research NOT DIRECTLY RELATED to squashing dissidence would sort of avoid a one ID system, right?
Side note. Cognisant is spelled right, regardless of what the little red squiggly line tells me.
This device is not Key Card for a Computer. This is a medical Device. I know this is a terriable faux Pas but I read the article and more importantly the associated PDF about the "Amulet" http://www.cs.dartmouth.edu/~sorber/papers/sorber-amulet.pdf
To sum up the Amulet is a medical device that can measure certain medical data on its own but is really there to coordinate several devices and facilitate data transmsion to a medical source. The Amulet has two means to verify it is on the correct person, the first is a active "Motion Password", move the Amulet in a predetermined fashion to unlock, and the second is the passive biometric check - which isn't give much detail. Once the correct user is determined its assumed that the device is remains unlocked till removed.
The Amulet is a replacement for Other mobile medical tracking devices because they can either be lost or in the case of a smart phone, hacked or borrowed to a friend.
So long story short this is a special purpose medical device not a general purpose Biometeric Key that the Summary insinuates.
"We are the Borg, and we will assimilate you!"...
I'm sure it works great - until you rub a balloon on your head! One simple party trick and boom! You're locked out of everything!
How does my electrical signature change when I'm hung over?
I was just thinking about this the other day! This would be great for these modern bathroom scales to id the user - the impedance measure only needs enough accuracy to distinguish between the family members whose weight is close enough. They already measure impedance for body fat anyhow.
But I also wondered how much your signatures would change if you, let's say, drank a bottle of beer, or ate something salty.
So that's how the alien weaponry in District 9 worked. Alien physiology would be significantly different from human, and the guns could only be used when one of those aliens held it.
What do gay people have against turtles?
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
The interaction between chemistry, biology & electro-magnetics is fascinating for me.
In the Anglophone world we have books like "The Body Electric". In Chinese and Russian there's much, much more. There's a sense we're building on 100's years of science (I use that term in a definition you may not agree with).
I was able to alter my bioimpedence using my mind in a test at the science museum in London. I'd like to know if it was just me passing harder on the contacts or sweating a bit more...
Where can I read more on this subject?
A blog I run for the wealth