Client-Side Biometric Verification Based on Trusted Computing

Jan Vossaert (1) , Jorn Lapon (1) , Bart De Decker (1) , Vincent Naessens (1)

1 KU Leuven - Catholic University of Leuven = Katholieke Universiteit Leuven

Traditionally, a user requires substantial trust in a workstation for correctly handling her credentials (e.g. password/login). Unfortunately, malware and compromised software makes them unsuitable for secure credential management. Credentials are easily stolen and the user cannot trust what is being displayed on her workstation, obstructing informed consent.This paper presents a new solution that addresses these issues. Credentials are bound to the owner using biometrics, effectively impeding abuse through credential sharing and theft. The biometric verification is performed on the client side, preserving the privacy of the user. The solution ensures that the user is correctly informed about the pending authentication, preventing abuse by malware. To demonstrate the feasibility of our approach, a prototype was implemented.

Domaines: Informatique [cs]; Réseaux et télécommunications [cs.NI]

Jan Vossaert, Jorn Lapon, Bart De Decker, Vincent Naessens. Client-Side Biometric Verification Based on Trusted Computing. 14th International Conference on Communications and Multimedia Security (CMS), Sep 2013, Magdeburg,, Germany. pp.34-49, ⟨10.1007/978-3-642-40779-6_3⟩. ⟨hal-01492832⟩