Embed Size (px)
Citation preview
Biometrics in Pharma: Politics and Privacy
Daniel Shapiro* and Sidney Shapiro+ *School of Information Technology and Engineering, University of Ottawa
Email: [email protected]+Department of Political Science, Laurentian University
Email: [email protected]
Overview
1. Prescription of Controlled Substances2. Trends in Google Searches, News, Regions3. Spam and Other Marketing4. Biometric Prescriptions: Practical, Political,
and Privacy Issues5. The Impact of Technology6. Conclusions
Prescription of Controlled Substances
• The Drug Enforcement Agency (DEA) has announced the implementation of the use of both computerized and biometric security protocols in the electronic prescription of controlled substances.
• Electronic prescriptions which were up until this point not allowed to be prescribed by electronic means will now be easier for physicians and the DEA to monitor and prescribe.
USA Google Searches 2004-2010
Raw Data with ±5% Error
Jan 4 2004Jun 27 2004Dec 19 2004Jun 12 2005Dec 4 2005M
ay 28 2006Nov 19 2006M
ay 13 2007Nov 4 2007Apr 27 2008O
ct 19 2008Apr 12 2009O
ct 4 2009M
ar 28 2010Sep 19 2010
0
0.5
1
1.5
2
2.5
3
3.5
4
privacyprescriptionpharmacy
Sear
ch V
olum
e
Trends• Pharmacy searches ↑• Prescription, privacy searches
↓• Implication is ↑ use of illegal
online pharmacies in the USA• In 2004, ¼ of Americans had
looked online for drug information, and four percent purchased drugs online [Fox04]
Breakdown by Region
News Coverage in USA
Raw Data with ±5% Error Trends• News coverage of privacy
and prescriptions is ↑ • News coverage of pharmacy
is ↑ too• “Prescription drugs online”
2004 indicates ↑ use of online pharmacies [Fox04]
pharmacy prescription privacy
Spam and Other Marketing
Biometric Prescriptions: Practical, political, and privacy issues
Practical Biometrics Issues:• Non-repudiation • Improved accountability• Delegation prevention• Possible increased cost• Possible information security
concerns• False acceptance and false
rejection cases• Possible serious medical
consequences when a drug cannot be obtained due to failed biometric authentication.
Political / Privacy Biometrics Issues:
• RiteAid installs fingerprint scanners in their pharmacies 2004
• Less privacy (summarizing data)
• Policy issues (HIPAA/ETP/PIPEDA/others)
• Legal issues (selling prescription data)
• Human factors (fear, misconceptions)
The Impact of Technology
Cryptography and Systems• Service interruptions due to
power failures or DDoS.• Biometrics systems would be
unable to function without access to communication and information unless the data was stored locally, negating the usefulness of a large scale distributed system.
• PKI is slow but secure.
Biometrics• Degraded biometric• Combination of several
biometrics in order to improve accuracy
• A certificate authority cannot reissue a biometric.
• Fingerprint scanners can identify fake fingerprint attempts using sensors to observe the finger temperature, pulse, oxygenation, blood pressure, movement, and electrical resistance.
The Impact of Technology
Cryptography and Systems• Certificates are preferred over scans
due to data size.• Digital signatures disallowed in many
jurisdictions.• Risk-based approach for data
encryption.• Clearly a prescription for a controlled
substance would fall under the category of a high-risk, and would be heavily encrypted.
• Hardware failure in any component in the system including cameras, fingerprint scanners, barcode readers, and computers.
Biometrics• Hackers could begin harvesting
biometric information from poorly secured e-health system.
• Setting up a fake service with the express purpose of aggregating biometric information.
• Sometimes it is cheaper to pay off the bad guys.
• Biometric software failure due to a bug in the implementation.
The Impact of Technology
Cryptography and Systems• DEA says you need 2 IDs +
biometric.• This is like saying you need
a biometric + password… • Then why use the
biometric?• As we said earlier,
combining certificates reduces false accept/reject.
Biometrics• A replay attack is a case where a biometric
has been copied by a third party and is being used (fraudulently) to authenticate.
• Picture of a doctor's face in the parking lot, and then displaying the photo to a biometric face scanner.
• Secure authentication, secure data transmission, cost-effective security, and fast execution of security mechanisms are all highly desirable when implementing biometrics and electronic prescriptions on a large scale.
The Impact of TechnologyImpact of Artificial "Gummy" Fingers on Fingerprint Systems Tsutomu Matsumoto, Hiroyuki Matsumoto, Koji Yamada, Satoshi HoshinoGraduate School of Environment and Information Sciences, Yokohama National University 79-7 Tokiwadai, Hodogaya, Yokohama 240-8501, Japan, email: [email protected]
ABSTRACT Potential threats caused by something like real fingers, which are called fake or artificial fingers, should be
crucial for authentication based on fingerprint systems. Security evaluation against attacks using such artificial fingers has been rarely disclosed. Only in patent literature, measures, such as "live and well" detection, against fake fingers have been proposed. However, the providers of fingerprint systems usually do not mention whether or not these measures are actually implmented in emerging fingerprint systems for PCs or smart cards or portable terminals, which are expected to enhance the grade of personal authentication necessary for digital transactions. As researchers who are pursuing secure systems, we would like to discuss attacks using artificial fingers and conduct experimental research to clarify the reality. This paper reports that gummy fingers, namely artificial fingers that are easily made of cheap and readily available gelatin, were accepted by extremely high rates by particular fingerprint devices with optical or capacitive sensors. We have used the molds, which we made by pressing our live fingers against them or by processing fingerprint images from prints on glass surfaces, etc. We describe how to make the molds, and then show that the gummy fingers, which are made with these molds, can fool the fingerprint devices.
Conclusions
• Online pharmacy popularity ↑ using legal prescriptions
• Practical, political, and privacy concerns must be addressed in tandem.
• Market acceptance is possible (RiteAid)• Biometric, hardware, cryptographic
mechanisms for securing prescriptions are complex
Questions?
References
• Background image: http://minnesota.publicradio.org/display/web/2006/11/28/eprescriptions/#
