Nova Southeastern University NSUWorks CEC Teses and Dissertations College of Engineering and Computing 2016 Assessing the Efectiveness of a Fingerprint Biometric and a Biometric Personal Identifcation Number (BIO-PIN™) when used as a Multi-Factor Authentication Mechanism Robert B. Batie Nova Southeastern University, Assessing the Effectiveness of a Fingerprint Biometric and a Biometric Personal Identification Number (BIO-PIN™) when used as a Multi-Factor Authentication Mechanism By Robert B. Batie Jr. A Dissertation in partial fulfillment of the requirements for the degree, of Doctor of Philosophy In Information Systems College of Engineering and Computing Nova Southeastern University 2016 An Abstract of a Dissertation Submitted to Nova Southeastern University in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy Assessing the Effectiveness of a Fingerprint Biometric and a Biometric Personal Identification Number (BIO-PIN™) when used as a Multi-Factor Authentication Mechanism By Robert B. Batie Jr. December 2016 The issue of traditional user authentication methods, such as username/passwords, when accessing information systems, the Internet, and Web-based applications still pose significant vulnerabilities. The problem of user authentication including physical and logical access appears to have limited, if any, coverage in research from the perspective of biometric as ‘something the user knows.’ Previous methods of establishing ones’ identity by using a password, or presenting a token or identification (ID) card are vulnerable to circumvention by misplacement or unauthorized sharing. The need for reliable user authentication techniques has increased in the wake of heightened concerns about information security and rapid advancements in networking, communication, and mobility. The main goal of this research study was to examine the role of the authentication method (BIO-PIN™ or username/password) and time, on the effectiveness of authentication, as well as the users’ ability to remember the BIO-PIN™ versus username/password (UN/PW). Moreover, this study compared the BIO-PIN™ with a traditional multi-factor biometric authentication using multiple fingerprints (without sequence) and a numerical PIN sequence (noted as "BIO+PIN"). Additionally, this research study examined the authentication methods when controlled for age, gender, user’s computer experience, and number of accounts. This study used a quasi- experimental multiple baseline design method to evaluate the effectiveness of the BIO- PIN™ authentication method. The independent, dependent, and control variables were addressed using descriptive statistics and Multivariate Analysis of Variance (MANOVA) statistical analysis to compare the BIO-PIN™, the BIO+PIN, and UN/PW authentication methods for research questions (RQs) 1 and 2. Additionally, the Multivariate Analysis of Covariance (MANCOVA) was used to address RQ 3 and RQ4, which seeks to test any differences when controlled by age, gender, user experience, and number of accounts. This research study was conducted over a 10-week period with participant engagement occurring over time including a registration week and in intervals of 2 weeks, 3 weeks, and 5 weeks. This study advances the current research in multi-factor biometric authentication and increases the body of knowledge regarding users’ ability to remember industry standard UN/PWs, the BIO-PIN™ sequence, and traditional BIO+PIN. Acknowledgments First I would like to thank God for blessing me with the mental capacity, physical health, endurance and tenacity to undertake this once in a lifetime challenge. The Lord knows my struggles, my pain, my evil and my heavenly ways and still he blessed me with all I have ever asked for even if it were not good for me. Oh, the lessons I’ve learned and the debt I owe. I’d like to thank my loving wife who is my biggest cheerleader and greatest fan. Thank you for your love, patience, and support. I acknowledge and thank my Dissertation Chair, Dr. Yair Levy, who orchestrated my success with his wisdom, guidance, humor, temperament, and patience. From the first moment I sat in your class you opened my eyes to what it means to succeed in this endeavor. You are brilliant, funny, tough, patient and tenacious. You pushed me to work harder and reach farther in my journey for this terminal and most powerful degree, the Ph.D. I’d also like to think my Dissertation Committee, Dr. Stephen Furnell, who always challenged my ideas and made me see things from a different perspective, and Dr. Peixiang Liu whose attention to detail caused me to double check my actions and intent. I’d like to thank Alen Cruz and Sylvia Traxler, my Twin Pro Software Development team who believed in the BIO-PIN™ concept and gave me an unbelievable application to address my research questions and test my hypothesis. It is always my pleasure and privilege to work with you two in any circumstance. You made it look so easy and fun. Your attitudes are infectious! Additionally, to all those who participated in the BIO-PIN™ Study, your unselfish commitment to the project and its inconveniences are worth their weight. I was so honored that you would take time to help me fulfill my life-long dream and take part in this once-in-a-life-time cutting edge project. To each and everyone, thank you! Finally, I thank the legacy Bobby, Janice, Taja, Demontinah, BJ, and Brockton, from whom I draw inspiration in hopes that I may inspire them to step out of the boat beyond their comfort zone and walk by faith to seek knowledge of the world and higher learning. Lead by example. I love you all! Table of Contents Abstract iii List of Tables viii List of Figures x Chapters 1. Introduction 1 Background 1 Problem Statement 2 Research Goals 7 Research Questions 18 Hypotheses 19 Password Authentication Method 20 Relevance 22 Significance 22 Barriers and Issues 23 Assumptions, Limitations, and Delimitations 24 Assumptions 24 Limitations 24 Delimitations 24 Definition of Terms 24 Summary 30 2. Review of the Literature 31 Multi-biometric 38 Attack Vectors 41 Convenience 43 Summary 46 3. Methodology 47 Overview of Research Methodology/Design 47 Research Design 47 Participant (User) Authentication Activities 50 User’s Ability To Remember Credentials 52 Authentication Effectiveness 52 Demographics and Data Collection 55 Measures 56 BIO-PIN™ Algorithm Operations Example 57 BIO+PIN Algorithm Operations Examples 59 Study Environment 60 Reliability and Validity 61 Internal validity 61 External validity 62 Sample 62 Data Screening 63 Data Analysis 65 vi Addressing the Research Questions 66 Summary 70 4. Results 72 Pre-analysis Data Screening 74 Data Analysis 76 Analysis Methods 76 TM BIO-PIN 76 BIO+PIN 79 Username/Password 81 Addressing the Research Questions 83 Addressing the Hypotheses 88 Findings 91 Summary of Results 92 5. Conclusions, Implications, Recommendations and Summary 94 Overview 94 Conclusion 94 Implications 96 Recommendations 97 Summary 99 Appendix A 102 Appendix B 103 Participant Solicitation Email, and Presentation Information 104 BIO-PIN Solicitation Presentation 105 Appendix C 112 Sample BIO-PIN™ emails 112 Appendix D 117 BIO-PIN™ Registration Form 117 References 118 vii List of Tables Tables 1. Summary of Organizational User Database Compromises (Mirante & Camppos 2013) 11 2. Authenticator Comparison Matrix. 19 3. Comparison of Biometric Identifiers (Prabhakar et al., 2004) 34 4. Most Popular PINs and Frequency of Use (DataGenetics, 2012) 41 5. Security Advantage of Combining Authenticators (O'Gorman, 2003) 44 6. Success, Failure, and FRR 52 7. User Registration and Data Collection Form 56 8. Variable Abbreviations and Description 67 9. Summary of Participants by Age, Percent and Group Numbers 73 10. Summary of Participants by Number of Accounts 73 11. Summary of Participants and Computer Usage 74 12. Descriptive Statistics for Gender and BIO-PIN (Mean & Standard Deviation) 76 13. Descriptive Statistics for Age and Ability to Remember BIO-PIN (Mean & Standard Deviation) 77 14. Descriptive Statistics for Computer Usage and Ability to Remember BIO-PIN (Mean & Standard Deviation) 77 15. Descriptive Statistics for the Number of Accounts and Ability to Remember BIO- PIN (Mean & Standard Deviation) 78 viii 16. Descriptive Statistics for False Rejection Rage (FRR) of BIO-PIN Over Time (Mean& Standard Deviation) 78 17. Descriptive Statistics for Gender and Ability to Remember BIO+PIN (Mean & Standard Deviation) 79 18. Descriptive Statistics for Age and Ability to Remember BIO+PIN (Mean & Standard Deviation) 80 19. Descriptive Statistics for Usage and Ability to Remember BIO+PIN (Mean & Standard Deviation) 80 20. Descriptive Statistics for Number of Accounts and Ability to Remember BIO+PIN (Mean & Standard Deviation) 81 21. Descriptive Statistics for Gender and Ability to Remember UN/PE (Mean & Standard Deviation) 81 22. Descriptive Statistics for Age and Ability to Remember UN/PW (Mean & Standard Deviation) 82 23. Description Statistics for usage and Ability to Remember UN/PW (Mean & Standard Deviation) 82 24. Descriptive Statistics for Number of Accounts and Ability to Remember UN/PW (Mean & Standard Deviation) 83 25. Summary of Statistical Data Success by Demographic Category and Method 83 26. Effectiveness by Week and FRR (Mean) 85 27. Ability to Remember Authentication Methods (Mean & Standard Deviation) 86 28. Authentication Methods by Week (Mean) 86 ix List of Figures Figures 1. BIO-PIN™, Authentication System 15 2. Fingerprint With Minutiae Points (Ross et al., 2003) 33 3. Types of User Authentication Methods (O'Gorman, 2003) 38 4. Attack Points in a Biometric Authentication System (Uludag & Jain, 2004) 42 5. BIO-PIN Enrollment, Identification and Authentication Process 50 6. BIO-PIN Application Welcome and Accounts Creation Screen-shots 54 7. BIO-PIN Application Fingerprint Sequence Screen-shot 54 8. BIO-PINTM Fingerprint Sequence and BIO+PIN Successful Screen-shots 55 9. Research Design 66 10. Summary of Participants by Gender 72 11. Summary of Participants by Age 73 12. Summary of Participants by Number of Accounts 74 13. Percentage of Participants by Computer Usage 74 14. False Rejection by BIO-PIN Method 79 15. User Ability to Remember by Authentication Method 86 16. User Ability to Remember Authentication Method Over Time 87 x