The Fishbone model of biometric template security
At Biometrics 2016 in London, I gave a keynote presentation on the state of biometrics policy and privacy, with suggestions for further work. Several aspects of that presentation have garnered follow-up requests, including requests for more information about my discussion of the “Fishbone Model” of biometric template security, a model I like very much and have found helpful in analyzing biometrics installations, procedures, and policies.
The Fishbone Model is a well-known and well-understood generalizable model for analyzing problems. Also known as an Ishikawa diagram, this thinking tool can be applied to many thorny problems in issues ranging from finance to healthcare to education. For biometric template security issues, the specific Fishbone Model I referred to in my talk was conceived and published by the authors Anil K. Jain, Karthik Nanakumar, and Abhishek Nagar in Biometric Template Security, EURASIP Journal on Advances in Signal Processing, p. 4. It is this model I reproduce below.
In this particular model, biometrics template security is well-thought through, with the threats to biometric template security clearly categorized and ordered. An entity seeking to install a biometric system can use the model to begin to analyze the security issues related to their proposed installation, and can begin to take stock of where the vulnerabilities are, and if they have been adequately addressed either technically, procedurally, or in policy, or all of the above. In my keynote, I specifically mentioned a number of security issues with biometric template takeover and spoofing, both of which show up on the Jain, Nanakumar, and Nagar Fishbone model below.
Biometrics is a complex field, and it is doubtful that any single model can fill all voids. But thinking through this model can be a helpful starting point both for analysis and discussion. I have included links to the original Jain, Nanakumar, and Nagar article describing the model in more detail; the article is well worth perusing as it contains a wealth of discussion and further data.
Screenshot of Fishbone model from Anil K. Jain, Karthik Nandakumar and Abhishek Nagar, Biometric Template Security, p. 4. Full article available here.
-Pam Dixon, Executive Director
Related Documents:
Anil K. Jain, Karthik Nanakumar, and Abhishek Nagar in Biometric Template Security, EURASIP Journal on Advances in Signal Processing, Special Issue on Biometrics, January 2008. (External Link to paper.)